• by Wendy Davis  @wendyndavis, July 22, 2024

Siding with Google, a federal judge has dismissed a privacy lawsuit alleging that the company's analytics tool collected sensitive data from health-care sites.

In a ruling issued Monday, U.S. District Court Judge Vince Chhabria in the Northern District of California effectively held that even if the allegations in the complaint were proven true, they wouldn't show that Google intended to receive health-care data.

“Most of the legal claims asserted by the plaintiffs require an allegation that Google actually intended to acquire or use people’s personal health information,” Chhabria wrote in a 21-page decision throwing out the complaint. “The plaintiffs are all over the map on the issue of intent, and ultimately they fail to offer a coherent narrative.”

The ruling stems from privacy lawsuits brought in May 2023, when a group of web users alleged that Google was collecting patients' sensitive health data from online sites.

The first complaint was brought by an anonymous “Jane Doe” who said she used Planned Parenthood's site to search for an abortion provider, and received treatment at the reproductive health-care center's affiliate in Burbank, California.

Her complaint referred to an investigation by the app Lockdown Privacy, which reported in 2022 that Planned Parenthood's site used third-party analytics tools leaked “extremely sensitive data" to third parties including Google, Meta and TikTok.

Soon after she sued, other anonymous plaintiffs alleged in a separate complaint that Google collected health information from a variety of health-care sites. The suits, which were consolidated last year, include claims that Google violated federal and California wiretap laws.

Google countered that it's simply a vendor of analytics tools, arguing in court papers that its tools “only provide developers with information about how users use the developers’ own properties.”

Google also said health-care sites don't send it personally identifying information, and that it does not allow the use of sensitive health data for ad targeting.

In October, Chhabria rejected the web users' request for an injunction banning Google from collecting data from certain health sites, writing that it wasn't obvious whether Google's alleged data collection violated any laws.

He added at the time that the plaintiffs' strongest claim against Google might be the contention that it violated California's wiretap law -- which prohibits the interception of communications unless all parties consent. But Chhabria also said in the ruling that it wasn't clear whether Google's alleged interceptions would be covered by that law, given the company's position that it was merely a vendor of software services.

The plaintiffs then amended their complaint to add allegations that Google isn't merely a vendor of analytics tools, but that the company also draws on the data it collects in numerous ways -- such as by using the data to improve search algorithms, ad targeting and ad attribution.

Chhabria said in Monday's ruling that the complaint couldn't move forward for several reasons, including that allegations were too vague to prove that health-care sites transmitted users' personally identifying health information to Google.

What's more, he added, even if the allegations could support an inference that health sites sent personally identifying data to Google, none of the allegations warrant the conclusion that Google either “intends to receive this information” or “intends to feed the information into its own advertising machinery.”

“The complaint acknowledges that Google repeatedly told developers not to send personally identifiable information through use of its source code,” Chhabria wrote.

“For health care providers specifically, Google warned that they must not use its source code in ways that would result in HIPAA-covered information being sent to Google,” he added, referring to data covered by the Health Insurance Portability and Accountability Act -- which prohibits health-care providers from disclosing patients' medical information.

“The takeaway from these allegations is that Google purposefully acted so as not to receive any personal health information,” he wrote.

The ruling appears at odds with a decision by District Court Judge William Orrick, who recently allowed Facebook users to proceed with a lawsuit alleging that Meta Platforms violated federal and state laws by tracking users' visits to health-care providers' websites and monetizing data collected from those sites.

Chhabria acknowledged Orrick's contrary opinion, writing: “To the extent Judge Orrick’s ruling stands for the notion that allegations like the ones in this case are sufficient to plead intent, this court disagrees.”

Chhabria's ruling allows the users to beef up their allegations and bring the complaint again, but he suggested the plaintiffs have an uphill battle.

“The court is increasingly skeptical, based on what’s transpired in this case so far, that the plaintiffs can successfully amend their complaint,” he wrote. “But in an abundance of caution, they will get one more chance to do so.”