• by Wendy Davis  @wendyndavis, March 21, 2025

A federal judge has signaled that he is leaning toward requiring Google to face a lawsuit by users who accused the company of wrongly obtaining their health information from websites operated by health care providers.

In an order issued Thursday, U.S. District Court Judge Vince Chhabria in San Francisco said the case was “difficult,” but that he was “very tentatively inclined” to allow the users to proceed with some of their claims -- including that Google allegedly violated statements in its privacy policy.

“It appears that the plaintiffs may have stated a claim based on allegations that Google collected communications about private health information between patients and providers that could be linked to Google account holders through the cookies tied to users’ accounts, after promising to collect only health information that Google account holders chose to provide,” Chhabria wrote.

“It appears that a reasonable person reading Google’s privacy policy could conclude that Google promised to only collect health information after consent by users and that the health information at issue here was covered by that promise,” he added.

Chhabria hasn't yet made a final decision about whether the plaintiffs can proceed with the suit. Instead, he issued an order directing both sides to submit additional arguments regarding his tentative conclusions.

The order comes in a privacy dispute dating to May 2023, when web users alleged that Google was collecting patients' sensitive health data from online sites.

The first complaint was brought by an anonymous “Jane Doe” who said she used Planned Parenthood's site to search for an abortion provider, and received treatment at the reproductive health-care center's affiliate in Burbank, California.

Her complaint referred to an investigation by the app Lockdown Privacy, which reported in 2022 that Planned Parenthood's site used third-party analytics tools leaked “extremely sensitive data" to third parties including Google, Meta and TikTok.

Soon after she sued, other anonymous plaintiffs alleged in a separate complaint that Google collected health information from a variety of health-care sites. The suits, which were consolidated in 2023, include claims that Google violated wiretap laws, and its own privacy policy.

Google countered that it's simply a vendor of analytics tools, that health care sites don't send it personally identifying information, and that it doesn't allow sensitive health data to be used for ad targeting.

Chhabria dismissed an earlier version of the complaint, but allowed the plaintiffs to beef up their allegations and bring them again.

Last September, the users alleged in an amended complaint that Google linked the health information to cookies -- including what Chhabria referred to as a “gid” cookie (for Google account holders) and a “cid” cookie (which the judge described as a “synonymized” cookie).

Google urged Chhabria to dismiss that complaint, arguing that even if the allegations were proven true, they wouldn't support the plaintiffs' claims.

Chhabria said in Thursday's order that the “gid” cookie “seems to collect information that, when a website interaction involves Google account holders, can link that website interaction to those account holders in a way that identifies them.”

Therefore, he wrote, “it appears reasonable to infer that Google, which obviously knows the personal information that users input to create their Google accounts, can use the gid cookie to tie information that came from the health providers’ webpages to a specific person.”

“The plaintiffs allege that this health information then becomes included in Google’s 'digital dossier' on that person,” Chhabria wrote. “If this cannot be inferred from the allegations ... Google should explain why.”

By contrast, he said the “cid” cookie doesn't appear to collect the kind of information “that could be used to identify a person in the real world.”

As a result, he said, the plaintiffs “do not appear to have adequately alleged that Google collects private health information on non-Google account holders that can be linked to them in an identifiable way.”

He has told Google to submit written papers by March 27.