“any 11 consent with respect to the processing and sending of messages itself does not necessarily 12 constitute consent to the specific practice alleged in this case – that is, the scanning of message 13 content for use in targeted advertising.”
How later courts described this case
- “any 11 consent with respect to the processing and sending of messages itself does not necessarily 12 constitute consent to the specific practice alleged in this case – that is, the scanning of message 13 content for use in targeted advertising.”
Written by the judges who cited it.
The opinion
1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6
7 M.D., et al., Case No. 24-cv-06369-AMO
8 Plaintiffs,
ORDER GRANTING DEFENDANTS’
9 v. MOTIONS TO DISMISS
10 GOOGLE LLC, et al., Re: Dkt. Nos. 37, 40
Defendants.
11
12
13 This is a putative data privacy class action against two tech behemoths. Plaintiffs allege
14 that Defendants Google, LLC (“Google”) and Meta Platforms, Inc. (“Meta”) improperly gleaned
15 their personal health data, including erectile dysfunction prescriptions, from a website. Google
16 and Meta’s motions to dismiss were heard before this Court on July 10, 2025. Having read the
17 papers filed by the parties and carefully considered their arguments therein and those made at the
18 hearing, as well as the relevant legal authority, and good cause appearing, the Court hereby
19 GRANTS the motions to dismiss for the following reasons.
20 I. BACKGROUND1
21 Non-party Dermacare, LLC d/b/a BlueChew (“BlueChew”) operates www.bluechew.com
22 (the “Website”) and provides “a technology platform which enables registered users to connect
23 with physicians and other health care providers for the diagnosis and treatment of erectile
24 dysfunction.” FAC ¶ 2. Plaintiff M.D. is a California citizen who, on December 6, 2022, and
25 January 4, 2023, was prescribed and ordered erectile dysfunction medication through the Website.
26
27
1 This factual background is taken from the allegations in the operative complaint, which the Court
1 First Am. Compl. (“FAC,” Dkt. No. 34) ¶ 7. Plaintiff O.F., a Pennsylvania citizen, purchased
2 erectile dysfunction medication through the Website in January 2022. FAC ¶ 9. Plaintiff J.P., a
3 Maryland citizen, purchased erectile dysfunction medication through the Website in August 2024.
4 FAC ¶ 11.
5 In using the Website, Plaintiffs and class members provided protected health information
6 to BlueChew for the purpose of obtaining medical treatment, including providing responses to a
7 “medical profile” questionnaire to determine whether they qualify for erectile dysfunction
8 medication. FAC ¶¶ 20-24, Figures 1-4. Defendants intercepted Plaintiffs’ sensitive health
9 information conveyed through the Website using the Facebook Tracking Pixel, Google Analytics
10 tool, and other similar software. FAC ¶ 32. The data transferred by BlueChew to Google and
11 Meta included a Website user’s name, birthday, email address, and a pseudonymous identifier
12 created and assigned to them by BlueChew. FAC ¶¶ 44, 68-69. The data intercepted and
13 collected also included de-anonymized, prescription erectile dysfunction medications purchased
14 by Plaintiffs and class members on the Website. FAC ¶¶ 3-4, 35, 39 (illustrating how the
15 Facebook Tracking Pixel functions to intercept private health information from the Website); id.
16 ¶¶ 61-75 (same as to Google’s tracking technologies). Examples of Defendants’ interceptions
17 from the Website show that Defendants intercepted personally identifying information such as
18 name, state of residence, email address, and various forms of protected health information. For
19 example, Google intercepted information showing that a BlueChew user registered on the
20 Website, added a medication to their cart, and ultimately purchased the medication. FAC ¶ 67-69,
21 Figures 8 and 9. Meta accomplished the same using its technology. FAC ¶ 40, Figures 4 and 5;
22 see also id. ¶ 41 (“Through the Facebook Tracking Pixel, Defendant Facebook intercepted and
23 recorded ‘AddToCart’ and ‘CompleteRegistration’ events, which detail information about which
24 prescription the patient was purchasing on the Website.”); id. ¶¶ 42-44. Plaintiffs’ protected
25 health information intercepted by Defendants was personally identifiable, and Defendants used
26 Plaintiffs’ and class members’ intercepted health information for the purpose of targeted
27 advertising. FAC ¶¶ 5, 36, 57, 73-74. At some point after Plaintiffs’ respective purchases on
1 medications,” but they do not allege whether those ads were served by Meta, Google, or another
2 entity. FAC ¶¶ 8, 10, 12.
3 Plaintiffs advance the following claims in the FAC:
4 • (1) violation of the California Invasion of Privacy Act (“CIPA”), California Penal Code
5 section 631 (Claim I);
6 • (2) violation of CIPA, California Penal Code section 632 (Claim II); and
7 • (3) invasion of privacy under the California Constitution (Claim III).
8 • (4) Plaintiff O.F.’s claim for a violation of the Pennsylvania Wiretapping Act (“WESCA”),
9 18 Pa. Cons. Stat. § 5701 et seq., on behalf of a putative Pennsylvania class (FAC ¶¶ 120-
10 28); and
11 • (5) Plaintiff J.P.’s claim for a violation of the Maryland Wiretapping and Electronic
12 Surveillance Act (“MWESA”), Md. Cts. & Jud. Proc. Code Sec. 10-401 et seq. on behalf
13 of a putative Maryland class (FAC ¶¶ 129-40).
14 M.D seeks to represent a putative California class including “all natural persons in California who,
15 during the class period, purchased medication on www.bluechew.com.” FAC ¶ 78. Plaintiff O.F.
16 brings claims on behalf of himself and an identical class of persons in Pennsylvania. FAC ¶ 79.
17 Plaintiff J.P. brings claims on behalf of himself and an identical class of persons in Maryland.
18 FAC ¶ 80.
19 II. DISCUSSION
20 Defendants both move to dismiss the Complaint for failure to state a claim. See Dkt. Nos.
21 37, 40. The Court begins by taking up Defendants’ requests for judicial notice, the contents of
22 which inform the subsequent analysis of the motions to dismiss.
23 A. Request for Judicial Notice
24 Each Defendant filed their own request for judicial notice. See Dkt. No. 39 (Meta); Dkt.
25 No. 41 (Google). A district court may take judicial notice of facts that are “not subject to
26 reasonable dispute” because they are (1) “generally known within the trial court’s territorial
27 jurisdiction,” or (2) “can be accurately and readily determined from sources whose accuracy
1 F.2d 331, 333 (9th Cir. 1993). “Accordingly, ‘[a] court may take judicial notice of matters of
2 public record.’ ” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018)
3 (quoting Lee, 250 F.3d at 688). A court cannot, however, “take judicial notice of disputed facts
4 contained in such public records.” Id.
5 “Unlike rule-established judicial notice, incorporation-by-reference is a judicially created
6 doctrine that treats certain documents as though they are part of the complaint itself. The doctrine
7 prevents plaintiffs from selecting only portions of documents that support their claims, while
8 omitting portions of those very documents that weaken – or doom – their claims.” Khoja, 899
9 F.3d at 1002. “Although the incorporation-by-reference doctrine is designed to prevent artful
10 pleading by plaintiffs, the doctrine is not a tool for defendants to short-circuit the resolution of a
11 well-pleaded claim.” Id. at 1003.
12 Google requests the Court take judicial notice of several documents, including screenshots
13 of webpages as well as iterations of Google’s and BlueChew’s terms, all of them with differing
14 effective dates. See McKinley Corbo Decl. (Dkt. No. 41-1). Google avers that all of these
15 materials are incorporated by reference into the Complaint and that all of these materials,
16 consisting of publicly available webpages, are not subject to reasonable dispute and are capable of
17 accurate and ready determination. See Google RJN (Dkt. No. 41).
18 Similarly, Meta requests the Court take judicial notice of several categories of materials,
19 including screenshots of webpages as well as Meta’s and BlueChew’s terms. See Blunschi Decl.,
20 Exs. 1-21 (Dkt. No. 38). Meta avers that all of these materials are incorporated by reference into
21 the Complaint and that all of these materials, consisting of publicly available webpages, are not
22 subject to reasonable dispute and are capable of accurate and ready determination. See Meta RJN
23 (Dkt. No. 39).
24 Though Plaintiffs argue in their brief that the Court should disregard the materials as
25 insufficiently authenticated and too attenuated to the dates of Plaintiffs’ access of the website, see,
26 e.g., Opp. to Meta (Dkt. No. 42) at 10-12, Plaintiffs’ counsel made clear at the hearing that they
27 did not object to the Court considering the materials submitted for judicial notice in its assessment
1 see Hrg. Tr. (Dkt. No. 55) at 15. The Court therefore GRANTS the request for judicial notice of
2 the existence of the various terms and policies at issue, and it considers the materials incorporated
3 by reference.
4 B. Motions to Dismiss
5 1. Legal Standard
6 A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests for the legal
7 sufficiency of the claims alleged in the complaint. Ileto v. Glock, 349 F.3d 1191, 1199-1200 (9th
8 Cir. 2003). Under Federal Rule of Civil Procedure 8, which requires that a complaint include a
9 “short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ.
10 P. 8(a)(2), a complaint may be dismissed under Rule 12(b)(6) if the plaintiff fails to state a
11 cognizable legal theory, or has not alleged sufficient facts to support a cognizable legal theory.
12 Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013).
13 While the court is to accept as true all the factual allegations in the complaint, it need not
14 accept legally conclusory statements unsupported by factual allegations. Ashcroft v. Iqbal, 556
15 U.S. 662, 678-79 (2009). The complaint must proffer sufficient facts to state a claim for relief that
16 is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 558-59 (2007) (citations
17 and quotations omitted). “A claim has facial plausibility when the plaintiff pleads factual content
18 that allows the court to draw the reasonable inference that the defendant is liable for the
19 misconduct alleged.” Iqbal, 556 U.S. at 678 (citation omitted). “[W]here the well-pleaded facts
20 do not permit the court to infer more than the mere possibility of misconduct, the complaint has
21 alleged – but it has not ‘show[n]’ – that the pleader is entitled to relief.” Id. at 679.
22 Review is generally limited to the contents of the complaint, although the court can also
23 consider a document on which the complaint relies if the document is central to the claims asserted
24 in the complaint, and no party questions the authenticity of the document. See Sanders v. Brown,
25 504 F.3d 903, 910 (9th Cir. 2007). The court may consider matters that are properly the subject of
26 judicial notice, Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005); Lee v. City of Los Angeles,
27 250 F.3d 668, 688-89 (9th Cir. 2001), and may also consider documents referenced extensively in
1 Teamster Jt. Council Pension Tr. Fund v. Am. W. Holding Corp., 320 F.3d 920, 925 n.2 (9th Cir.
2 2003). If dismissal is warranted, it is generally without prejudice, unless it is clear that the
3 complaint cannot be saved by any amendment. Sparling v. Daou, 411 F.3d 1006, 1013 (9th Cir.
4 2005).
5 2. Consent
6 Among the several arguments raised by Google and Meta, Defendants move to dismiss on
7 the grounds that Plaintiffs consented to having their information collected on BlueChew’s website
8 and shared with Defendants. “Consent generally defeats privacy claims.” Javier v. Assurance IQ,
9 LLC, No. 4:20-CV-02860-JSW, 2021 WL 940319, at *2 (N.D. Cal. Mar. 9, 2021). “On a motion
10 to dismiss, the burden of proof to show consent rests with defendants.” Doe v. FullStory, Inc., 712
11 F. Supp. 3d 1244, 1253 (N.D. Cal. 2024); Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064,
12 1077-78 (N.D. Cal. 2023) (“On this motion to dismiss, the issue of consent is front and center and
13 the burden of proof to show this exemption applies is on Meta.”). Under CIPA, WESCA, and
14 MWESA, a plaintiff must plausibly allege that the complained-of interception occurred without
15 consent. To state claims under CIPA sections 631 and 632, Plaintiff M.D. must plausibly allege,
16 among other things, that he did not consent to the alleged interception or recording. See Cal.
17 Penal Code §§ 631(a) and 632(a). Like CIPA, Plaintiff O.F.’s WESCA claim requires a plaintiff
18 to plausibly allege a lack of consent – it “contains an exception to its prohibition on the
19 interception of electronic communications ‘where all parties to the communication have given
20 prior consent to such interception.’ ” Vonbergen v. Liberty Mut. Ins. Co., 705 F. Supp. 3d 440,
21 458 (E.D. Pa. 2023) (quoting 18 Pa. Cons. Stat. § 5704(4)). Plaintiff J.P.’s MWESA claim
22 likewise requires a plaintiff to plausibly allege a lack of consent – it protects only “those who do
23 not consent to the interception of their private conversations.” Agnew v. State, 197 A.3d 27, 33
24 (Md. Ct. App. 2018). Even the sole non-statutory cause of action, Plaintiff M.D.’s invasion of
25 privacy claim under California law, falters if Defendants demonstrate consent because a plaintiff
26 cannot have a reasonable expectation of privacy if they consented to the intrusion. Hill v. Nat’l
27 Collegiate Athletic Assn., 7 Cal. 4th 1, 26 (1994) (“The plaintiff in an invasion of privacy case
1 privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the
2 invasive actions of defendant.”); see also Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072
3 (N.D. Cal. 2016). All claims thus rely on the absence of Plaintiffs’ consent to the challenged data
4 interception.
5 Here, Plaintiffs allege they did not consent to Defendant’s interception of their personal
6 information conveyed to BlueChew. FAC ¶ 6; see also id. ¶ 13 (Defendants “committed the
7 interceptions at issue without Plaintiffs’ knowledge, consent, or express written authorization.”),
8 id. ¶¶ 58, 93. Defendants argue that Plaintiffs consented to BlueChew’s transmission of
9 information about their activity on its website to service providers like Meta and Google, pointing
10 to BlueChew’s sign-up process. After a visitor navigates to BlueChew’s website and clicks
11 “choose plan,” see FAC ¶ 21 (Fig. 2), the visitor is asked to sign up for an account, see, e.g.,
12 Blunschi Decl., Exs. 5-9 at 1. To sign up, a visitor must affirmatively “agree to [the] Terms &
13 Conditions,” which are hyperlinked and which incorporate the Privacy Policy. Blunschi Decl.,
14 Exs. 5-9 at 1. The visitor cannot proceed to enter personal information or order medication without
15 logging into a preexisting account or signing up for a new one. Id.
16 Both Defendants contend that BlueChew’s Privacy Policy disclosed throughout the
17 relevant time period (2022 to 2024, when Plaintiffs allege they used the BlueChew website, see
18 FAC ¶¶ 7-11) both that BlueChew may collect and use information about users’ activity on its
19 website and that BlueChew may share that information. Defendants argue that BlueChew’s
20 Privacy Policy discloses its use of vended analytics technologies, expressly using Google
21 Analytics as an example, to collect and analyze user data. See, e.g., Google Mot. at 9 (citing RJN
22 Exs. 5-C, 5-D, and 5-E and excerpting (“We may also use automated devices and applications,
23 such as Google Analytics . . . . We use these tools to help us improve our Services, performance
24 and user experiences. These entities may use cookies and other tracking technologies to perform
25 their services.”; “As you browse our Websites, advertising cookies may be placed on your
26 computer so that we can understand what you are interested in. We may work with display
27 advertising partners . . . that enable us to present you with retargeted advertising on other sites
1 Reference to these excerpts within the previous iterations of BlueChew’s Privacy Policy
2 does not establish consent, however, because the Privacy Policy did not “explicitly notify”
3 Plaintiffs of the practice at issue. See Calhoun v. Google LLC, 526 F. Supp. 3d 605, 620 (N.D.
4 Cal. 2021) (“In order for consent to be actual, the disclosures must ‘explicitly notify’ users of the
5 practice at issue.”); In re Google Inc., 2013 WL 5423918, at *13 (N.D. Cal. Sept. 26, 2013)
6 (“Google points to its Terms of Service and Privacy Policies, to which all Gmail and Google Apps
7 users agreed, to contend that these users explicitly consented to the interceptions at issue. The
8 Court finds, however, that those policies did not explicitly notify Plaintiffs that Google would
9 intercept users’ emails for the purposes of creating user profiles or providing targeted
10 advertising.”); Campbell v. Facebook Inc., 77 F. Supp. 3d 836, 848 (N.D. Cal. 2014) (“any
11 consent with respect to the processing and sending of messages itself does not necessarily
12 constitute consent to the specific practice alleged in this case – that is, the scanning of message
13 content for use in targeted advertising.”). In fact, these older versions of BlueChew’s Privacy
14 Policy do not establish consent because they espouse that BlueChew safeguards sensitive health
15 information and only shares it with certain third parties for certain purposes that do not include
16 online advertising. In the very section relied upon by Defendants (“Use of Cookies and Other
17 Technologies on the Websites”), the Privacy Policy explicitly states: “[w]e do not share your
18 personal information with these third parties their own direct marketing purposes.” Blunschi
19 Decl., Ex. 17 at 6 (BlueChew Privacy Policy in effect on October 8, 2022). BlueChew users may
20 have consented to the disclosure of certain information to Meta and Google by using the
21 BlueChew Website, but they did not agree to the disclosure of their private health information
22 under those earlier Privacy Policies. At minimum, the majority of the BlueChew Privacy Policy
23 iterations reproduced by Defendants are ambiguous as to the purported consent Defendants claim
24 here, particularly where the Privacy Policies make no reference to disclosure of private health
25 information to Meta or Google for the purposes of online advertising. The older BlueChew
26 Privacy Policies fall short of providing explicit notification of the conduct at issue, and Defendants
27 fall short of demonstrating consent that would defeat Plaintiffs’ claims at this stage.
1 Sometime in 2024, however, BlueChew changed its Privacy Policy. In contrast to the
2 earlier versions, the version of BlueChew’s Privacy Policy that appeared on August 16, 2024,
3 clearly stated that BlueChew would use the “Meta Pixel” to “keep track of what users do after they
4 see or click on a Facebook or Instagram advertisement” on BlueChew’s website and “keep track
5 of users who access our Website or advertisements from different devices[.]” Blunschi Decl.,
6 Ex. 19 (Dkt. No. 38-19, the “August 2024 Policy”) at 3. The August 2024 Policy explained that
7 such user data would be “processed by Facebook and Instagram.” Id. Relatedly, the August 2024
8 Policy described how BlueChew employed “Google Analytics” to track users’ interactions with
9 the website, providing several links regarding Google’s ability to receive and use data obtained
10 from the website. Id. at 3. The August 2024 Policy also disclosed that BlueChew collects
11 “Personal Information consisting of health information,” and that it shares such “Personal
12 Information” “with third parties,” including for advertising and data analysis. Id. at 3-4. Most
13 notably, the August 2024 Policy omits a key assertion by BlueChew that appeared in earlier
14 versions, that “[w]e do not share your personal information with these third parties their own
15 direct marketing purposes.” See, e.g., Blunschi Decl., Ex. 17 at 6 (BlueChew Privacy Policy as it
16 appeared on October 8, 2022). The August 2024 Policy thus makes clear that BlueChew would
17 share data about users’ activity on BlueChew’s site with both Meta and Google and without any
18 limitation regarding the sharing of personal information as had been included in the previous
19 iterations of the Privacy Policy. At the hearing, Plaintiffs’ counsel conceded that the August 2024
20 Policy establishes users’ consent to the data collection practices. See Hrg. Tr. (Dkt. No. 55) at 15.
21 Plaintiffs’ claims accordingly may only survive for the period prior to the adoption of the August
22 2024 Privacy Policy.
23 More fundamentally, Plaintiffs claims fail because they have not averred that the
24 challenged data sharing practices were in place before Defendants’ obtained Plaintiffs’ consent to
25 employ them. Plaintiffs became aware that Defendants intercepted their personal information in
26 September 2024, following the August 2024 Privacy Policy’s grant of consent for Defendants’
27 conduct. See Compl. ¶¶ 7, 9, 11. Though they seek to challenge the interception of data reaching
1 users consented in August 2024 were previously undertaken. As presently alleged, Plaintiffs’
2 claims fail for want of factual support. Accordingly, Plaintiffs “have not nudged their claims
3 across the line from conceivable to plausible,” and their claims, which all rely on the absence of
4 consent, all must face dismissal. Twombly, 550 U.S. at 570. The Court DISMISSES Plaintiffs’
5 Complaint.
6 3. Leave to Amend
7 “Generally, Rule 15 advises the court that leave shall be freely given when justice so
8 requires. This policy is to be applied with extreme liberality.” Eminence Cap., LLC v. Aspeon,
9 Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (internal quotations and citations omitted). Courts may
10 deny leave to amend “only if there is strong evidence of undue delay, bad faith or dilatory motive
11 on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed,
12 undue prejudice to the opposing party by virtue of allowance of the amendment, [or] futility of
13 amendment, etc.” Sonoma Cnty. Ass’n of Retired Emps. v. Sonoma Cnty., 708 F.3d 1109, 1117
14 (9th Cir. 2013) (quoting Foman v. Davis, 371 U.S. 178, 182 (1962)) (modification in original).
15 At this stage, the Court cannot determine as a matter of law that amendment would prove
16 futile. Plaintiffs may still be able to proffer factual allegations that support their claims of privacy
17 violations for the period preceding the adoption of the August 2024 Privacy Policy. In light of this
18 potential as well as the extreme liberality with which the Court must apply Rule 15, the Court will
19 grant Plaintiffs leave to file an amended complaint.
20 III. CONCLUSION
21 For the foregoing reasons, the Court GRANTS Defendants’ requests for judicial notice
22 and GRANTS Defendants’ motions to dismiss the Complaint. Plaintiffs may file any amended
23 //
24 //
25 //
26 //
27 //
1 complaint by no later than October 24, 2025. No parties or claims may be added without leave of
2 || Court or stipulation of Defendants.
3 IT IS SO ORDERED.
4
5 Dated: September 23, 2025
6 =
7 .
ARACELI MARTINEZ-OLGUIN
8 United States District Judge
9
10
11
12
13
©
15
16
= 17
Z 18
19
20
21
22
23
24
25
26
27
28