• by Wendy Davis  @wendyndavis, December 22, 2023

Google is urging a federal judge to throw out a privacy lawsuit by web users who allege that the company's analytics tool collected sensitive data from health care sites that had installed the tool.

“Google cannot be liable for merely serving as a vendor of analytics tools to the websites,” the company argues in a motion filed Thursday with U.S. District Court Judge Vince Chhabria in the Northern District of California.

Google's argument comes in response to privacy lawsuits filed in May, when users alleged that the company was collecting patients' sensitive health data from online sites. The first complaint was brought by an anonymous “Jane Doe” who alleged that she used Planned Parenthood's site to search for an abortion provider, and received treatment at the reproductive health care center's affiliate in Burbank, California.

The complaint in that case referred to an investigation by the app Lockdown Privacy, which reported last June that Planned Parenthood's site used third-party analytics tools leaked “extremely sensitive data" to third parties including Google, Meta and TikTok.

Soon after that case was filed, other anonymous plaintiffs alleged in a separate lawsuit that Google collected health information from a variety of health care sites.

The matters were consolidated earlier this year and are pending in front of Chhabria. The complaint includes claims that Google violated federal and California wiretap laws.

In October Chhabria rejected the plaintiffs' request to issue an order banning Google from collecting data from several health sites, writing that it wasn't obvious whether Google's alleged data collection violated any laws.

He added that the plaintiffs' strongest claim against Google might be the contention that it violated California's wiretap law -- which prohibits the interception of communications unless all parties consent. But Chhabria also said it wasn't clear whether Google's alleged interceptions would be covered by that law, given the company's position that it was merely a vendor of software services.

“Courts have drawn a distinction ... between 'independent parties who mined information from other websites and sold it' versus vendors who provide 'a software service that captures its clients’ data, hosts it on [its] servers, and allows the clients to analyze their data,'” Chhabria wrote in October.

The plaintiffs then amended their complaint, which now alleges that Google isn't merely a vendor of analytics tools, but that the company also draws on the data it collects in numerous ways -- including by using the data to improve search algorithms, ad targeting and ad attribution. The complaint specifically alleges that Google used health data to create user profiles for ad-serving purposes.

Google counters in its new papers that the plaintiffs haven't alleged any of their own data was harnessed by the company for profit.

“While plaintiffs make bare allegations regarding Google’s use of data for advertising, they do not allege that any data about them was used by Google or that they received any targeted ads following their use of the websites in question,” the company writes.

The plaintiffs are expected to file a response with the court next month.