Judge thins claims that Google unlawfully collected users’ private health information

SAN FRANCISCO (CN) — A federal judge on Friday allowed some claims to survive in a class action that accuses Google of deliberately tracking, collecting and monetizing third-party private health information from health care websites for advertising purposes.

In his order, U.S. District Judge Vince Chhabria dismissed certain claims against Google for events that occurred after Google updated its help pages in 2023, when the company specifically outlined to health care companies that it did not wish to receive identifying health care information.

“The allegations in the complaint do not support an inference that Google, after this point, intentionally obtained communications containing private health information about identifiable patients,” Chhabria ruled.

Google previously argued that it tells its business partners not to send it data with personally identifiable information that could violate privacy laws like the Health Insurance Portability and Accountability Act, or HIPAA. If a business partner ignores that warning and places personal information in the URL of a web page, the tech company argued it cannot control that.

However, though the claims were dismissed for communications intercepted by the company after 2023, Chhabria said this may not be the case for those before 2023.

Despite his partial dismissal, the judge said he would let these same claims survive for any communications Google intercepted before it updated the language on its help page in 2023.

The Barack Obama appointee stated that whether these claims move forward hinges on whether Google intended to collect this information.

“And it’s plausible to infer, given how obvious this problem was before 2023, that Google actually intended to capitalize on the problem,” Chhabria said.

These time-contingent claims include prospective violations under the Wiretap Act, California Invasion of Privacy Act and common law privacy violations for communications.

Though Google argues that the health providers consented to the interception of the plaintiffs’ communications because they installed Google’s products on their websites, the judge said this was a “factual issue” that can’t be resolved at this stage in the lawsuit.

The judge also ruled that there is no dispute Google received at least “some communications” that were between health providers and users of the providers’ websites and that the plaintiffs sufficiently argued the information collected by Google could be individually tied to a particular person for advertising purposes.

“That’s the point of Google’s products — the source code is designed to collect and analyze communications on the web pages on which it is enabled,” Chhabria said.

Chhabria ultimately dismissed in part a breach of contract claim by the patients, claiming that while they made a compelling argument that Google promised not to collect users’ health information outside of the specific instances identified in the company’s terms of service and privacy policy, none of them claimed that they received any ads related to their browsing activity.

The judge noted that all his dismissals are with prejudice, and plaintiffs will not be given a chance to repair them.

The judge’s rulings are related to a 2023 class action, where a group of patients claimed that Google used its source code on health care provider websites to collect sensitive health information without their knowledge or consent, violating state and federal law as well as Google’s own terms of service.

The patients claim that Google source code is on 94% of health care provider web properties in the United States and that the Alphabet company collected unique patient identifiers — including communications relating to specific doctors, appointment requests, symptoms, conditions, treatments, insurance and prescription drugs.

Google is then able to amplify the knowledge and insight it has about patients, compile detailed and precise profiles on patients and monetize that information into advertising revenue, the patients say.

The case’s next hearing will be a case management conference, which will be on July 11 at 10 a.m. via Zoom Workplace.

This case was filed in the Northern District of California.