Doe I v. Google LLC

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

JOHN DOE I, et al., Case No. 23-cv-02431-VC

Plaintiffs,

ORDER DENYING MOTION FOR

v. PRELIMINARY INJUNCTION

GOOGLE LLC, Re: Dkt. No. 42

Defendant.

The plaintiffs’ motion for a preliminary injunction is denied.1 A “preliminary injunction

is an extraordinary and drastic remedy” where “the requirement for substantial proof” is high and

“the movant, by a clear showing, carries the burden of persuasion.” Mazurek v. Armstrong, 520

U.S. 968, 972 (1997). Based on the evidence the plaintiffs presented, they have not met their

burden. There is doubt as to their likelihood of success on the merits and, even if there are

serious questions going to the merits, the plaintiffs have failed to show the balance of hardships

tips sharply in their favor or that a preliminary injunction would serve the public interest. See

Alliance for the Wild Rockies v. Pena, 865 F.3d 1211, 1217 (9th Cir. 2017).

Two preliminary matters. First, the plaintiffs’ rebuttal declaration from Dr. Zubair Shafiq

is excluded. This declaration was included with the plaintiffs’ reply brief and contains almost

600 pages of new evidence. While rebuttal evidence is appropriate “to contradict, impeach, or

defuse the impact of the evidence offered by an adverse party,” it may not be used “to advance

new arguments or new evidence.” Huawei Techs., Co, Ltd v. Samsung Elecs. Co, Ltd., 340 F.

1 The plaintiffs’ motion to appoint interim lead counsel and lead plaintiff is also denied.

Supp. 3d 934, 995-96 (N.D. Cal. 2018) (citations omitted). In their motion, the plaintiffs

presented evidence that Google acquires patient health information through the use of Google

source code on health care provider web properties. Although the plaintiffs presented evidence

suggesting Google has the capability of using this information for its own purposes, they did not

present evidence suggesting Google actually connects the health information with any specific

patient or uses the acquired health information itself. Only on reply do the plaintiffs attempt to

offer evidence of Google doing more than just acquiring the health information. It should have

been obvious to the plaintiffs that this type of evidence would have made for a stronger case on

the merits, on the balance of hardships, and on whether a preliminary injunction would serve the

public interest. So if they wished to present such evidence in support of their preliminary

injunction motion, they should have done so at the outset and given Google a meaningful

opportunity to respond. Especially given the complexity of the evidence and the arguments

surrounding it.

Second, the parties disagree as to whether the plaintiffs are seeking a mandatory or

prohibitory injunction, which matters in the Ninth Circuit. See Marlyn Nutraceuticals, Inc. v.

Mucos Pharma GmbH & Co., 571 F.3d 873, 878-79 (9th Cir. 2009). The distinction between

mandatory and prohibitory injunctions often seems ephemeral, depending more on the words

used to describe the relief sought than on any meaningful difference between the classifications.

See United Food & Commercial Workers Union, Local 1099 v. Southwest Ohio Regional Transit

Authority, 163 F.3d 341, 348 (6th Cir. 1998) (“We . . . conclude that the distinction between

mandatory and prohibitory injunctive relief is not meaningful.”); see also LaFlamme v. New

Horizons, Inc., 514 F. Supp. 2d 250 (D. Conn. 2007) (“[T]he difference between the two types of

injunctions may be largely academic, and is further complicated by the fact that mandatory

injunctions may use prohibitory language.”). Here, for example, one could describe the relief

sought as “stop acquiring people’s private health information contrary to law.” That sounds like

a prohibitory injunction. Or one could describe the relief sought as “restructure the complicated

systems and relationships you’ve built that have allowed you to acquire people’s private health

information.” That sounds like a mandatory injunction. There probably should just be one test for

whether to issue a preliminary injunction rather than separate tests for “mandatory” vs.

“prohibitory” injunctions, with the understanding that courts should always be careful, in the

exercise of their discretion, not to issue an injunction more burdensome than necessary to

prevent irreparable harm while the litigation is pending. Anyway, the Court will assume for

purposes of this motion that the plaintiffs are seeking a prohibitory injunction, since the law

imposes a lighter burden for obtaining a prohibitory injunction—a burden the plaintiffs have not

met.

Likelihood of Success on the Merits. The plaintiffs argue they are likely to succeed on

their Electronic Communications Privacy Act (ECPA), California Invasion of Privacy Act

(CIPA), invasion of privacy, and Unfair Competition Law (UCL) claims.

ECPA Claim. The plaintiffs have not shown they are likely to succeed on their ECPA

claim because the ECPA makes explicit that it is not unlawful to intercept a communication if

one of the parties to the communication has given prior consent. 18 U.S.C. § 2511(2)(d).

Although the plaintiffs did not consent to Google receiving their health information, the health

care providers consented to the use of Google source code on their web properties. The plaintiffs

contend the criminal or tortious exception to the one-party consent exception applies. Id.

(creating an exception to the exception when a “communication is intercepted for the purpose of

committing any criminal or tortious act”). However, the plaintiffs have not provided sufficient

evidence to show “the purpose for the interception—its intended use—was criminal or tortious.”

Sussman v. American Broadcasting Companies, Inc., 186 F.3d 1200, 1202 (9th Cir. 1999). It is

not enough for the interception itself to have violated the law, the interception must be “done for

the purpose of facilitating some further impropriety” for the criminal or tortious exception to

apply. Id.

CIPA Claim. The plaintiffs’ CIPA claim may be their strongest. CIPA mirrors the ECPA

but does not contain a one-party consent exception. Instead CIPA requires consent from all

parties to the communication. Cal. Penal Code § 631(a). Here, the plaintiffs have presented

evidence that they did not consent to Google obtaining their personal health information. Google,

however, argues it is merely a vendor providing a service for the health care providers to capture

their patients’ information while using their web properties. Courts have drawn a distinction for

purposes of CIPA liability between “independent parties who mined information from other

websites and sold it” versus vendors who provide “a software service that captures its clients’

data, hosts it on [its] servers, and allows the clients to analyze their data.” Graham v. Noom, Inc.,

533 F. Supp. 3d 823, 832 (N.D. Cal. 2021); see also Williams v. What If Holdings, LLC, No. C

22-03780 WHA, 2022 WL 17869275, at *3 (N.D. Cal. Dec. 22, 2022). Based on the evidence

presented in connection with this motion, it seems possible that Google could fall into either

category, but the answer is far from obvious.

Privacy Claims. There is a reasonable expectation of privacy in one’s private health

information. See In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799-800 (N.D. Cal.

2022). But whether Google’s actions constitute “highly offensive” conduct is less clear based on

the plaintiffs’ evidence at this stage. The acquisition of this information in conjunction with a

service being offered to the health care provider web properties, without evidence that Google

itself used the information, is not obviously “highly offensive,” and in this case it may depend on

a better understanding of Google’s role (including whether it is merely acting as a vendor within

the meaning of CIPA).

UCL Claim. The UCL “requires that a plaintiff have ‘lost money or property’ to have

standing to sue” making “[t]he plain import of this [] that a plaintiff now must demonstrate some

form of economic injury.” Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 323 (2011). The issue

of whether the disclosure of personal information or data constitutes an economic injury is not

well-settled. See Katz-Lacabe v. Oracle Am., Inc., No. 22-CV-04792-RS, 2023 WL 2838118, at

*8 (N.D. Cal. Apr. 6, 2023) (collecting cases). Thus, it is not clear the plaintiffs are likely to

succeed on this claim.

Balance of Hardships and Public Interest. Even assuming serious questions going to the

merits, and even assuming the plaintiffs suffered some degree of irreparable injury by having

Google merely acquire (as opposed to use) their private health information, the plaintiffs have

not demonstrated that the balance of hardships tips sharply in their favor or that a preliminary

injunction would be in the public interest. Given the absence of evidence that Google is using the

patient information for its own purposes, the plaintiffs have not shown that they or the public

suffer in any significant way from Google’s activity. On the other hand, the proposed

preliminary injunctive relief would place a substantial burden on Google (regardless of whether

you label it a mandatory or prohibitory injunction), and potentially on the health care companies

with whom Google works. In a similar case, Facebook users alleged Meta Pixel allowed Meta to

obtain their personal health information when they logged into their healthcare providers’ patient

portals. Meta Pixel, 647 F. Supp. 3d at 784-86. Judge Orrick denied a preliminary injunction

based on the balance of hardships and the public interest prongs. Id. at 804-05. Despite evidence

that Meta actually used the data to send targeted ads—evidence the plaintiffs have not presented

here—Judge Orrick concluded “neither the equities nor the public interest currently support[ed]

an injunction.” Id. at 805. That’s even more true here.

* * *

Now that there has been a significant airing of some of the merits issues in this case, and

now that the motion for a preliminary injunction has been denied, it seems possible that the

plaintiffs may wish to amend their complaint rather than spending time and money on a further

hearing on Google’s pending motion to dismiss. If the plaintiffs wish to seek leave to file an

amended complaint, they may do so by way of administrative motion pursuant to Local Rule 7-

11 within 7 days of this ruling. The Court will grant leave to file an amended complaint absent

extraordinary circumstances presented by Google. If the plaintiffs choose not to amend their

complaint, the Court will likely schedule another hearing before adjudicating the motion to

dismiss.

IT IS SO ORDERED.

Dated: October 11, 2023 Koo. -

VINCE CHHABRIA

United States District Judge