Doe I et al v. Google LLC

Filing 76

ORDER by Judge Vince Chhabria denying #42 Motion for Preliminary Injunction and #58 Motion to Appoint Lead Plaintiff and Lead Counsel. (vclc2, COURT STAFF) (Filed on 10/18/2023)

Case 3:23-cv-02431-VC Document 76 Filed 10/18/23 Page 1 of 6

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA

JOHN DOE I, et al.,

Case No. 23-cv-02431-VC

Plaintiffs,
ORDER DENYING MOTION FOR
PRELIMINARY INJUNCTION

v.
GOOGLE LLC,

Re: Dkt. No. 42

Defendant.

The plaintiffs’ motion for a preliminary injunction is denied.1 A “preliminary injunction
is an extraordinary and drastic remedy” where “the requirement for substantial proof” is high and
“the movant, by a clear showing, carries the burden of persuasion.” Mazurek v. Armstrong, 520
U.S. 968, 972 (1997). Based on the evidence the plaintiffs presented, they have not met their
burden. There is doubt as to their likelihood of success on the merits and, even if there are
serious questions going to the merits, the plaintiffs have failed to show the balance of hardships
tips sharply in their favor or that a preliminary injunction would serve the public interest. See
Alliance for the Wild Rockies v. Pena, 865 F.3d 1211, 1217 (9th Cir. 2017).
Two preliminary matters. First, the plaintiffs’ rebuttal declaration from Dr. Zubair Shafiq
is excluded. This declaration was included with the plaintiffs’ reply brief and contains almost
600 pages of new evidence. While rebuttal evidence is appropriate “to contradict, impeach, or
defuse the impact of the evidence offered by an adverse party,” it may not be used “to advance
new arguments or new evidence.” Huawei Techs., Co, Ltd v. Samsung Elecs. Co, Ltd., 340 F.

1

The plaintiffs’ motion to appoint interim lead counsel and lead plaintiff is also denied.

Case 3:23-cv-02431-VC Document 76 Filed 10/18/23 Page 2 of 6

Supp. 3d 934, 995-96 (N.D. Cal. 2018) (citations omitted). In their motion, the plaintiffs
presented evidence that Google acquires patient health information through the use of Google
source code on health care provider web properties. Although the plaintiffs presented evidence
suggesting Google has the capability of using this information for its own purposes, they did not
present evidence suggesting Google actually connects the health information with any specific
patient or uses the acquired health information itself. Only on reply do the plaintiffs attempt to
offer evidence of Google doing more than just acquiring the health information. It should have
been obvious to the plaintiffs that this type of evidence would have made for a stronger case on
the merits, on the balance of hardships, and on whether a preliminary injunction would serve the
public interest. So if they wished to present such evidence in support of their preliminary
injunction motion, they should have done so at the outset and given Google a meaningful
opportunity to respond. Especially given the complexity of the evidence and the arguments
surrounding it.
Second, the parties disagree as to whether the plaintiffs are seeking a mandatory or
prohibitory injunction, which matters in the Ninth Circuit. See Marlyn Nutraceuticals, Inc. v.
Mucos Pharma GmbH & Co., 571 F.3d 873, 878-79 (9th Cir. 2009). The distinction between
mandatory and prohibitory injunctions often seems ephemeral, depending more on the words
used to describe the relief sought than on any meaningful difference between the classifications.
See United Food & Commercial Workers Union, Local 1099 v. Southwest Ohio Regional Transit
Authority, 163 F.3d 341, 348 (6th Cir. 1998) (“We . . . conclude that the distinction between
mandatory and prohibitory injunctive relief is not meaningful.”); see also LaFlamme v. New
Horizons, Inc., 514 F. Supp. 2d 250 (D. Conn. 2007) (“[T]he difference between the two types of
injunctions may be largely academic, and is further complicated by the fact that mandatory
injunctions may use prohibitory language.”). Here, for example, one could describe the relief
sought as “stop acquiring people’s private health information contrary to law.” That sounds like
a prohibitory injunction. Or one could describe the relief sought as “restructure the complicated
systems and relationships you’ve built that have allowed you to acquire people’s private health

2

Case 3:23-cv-02431-VC Document 76 Filed 10/18/23 Page 3 of 6

information.” That sounds like a mandatory injunction. There probably should just be one test for
whether to issue a preliminary injunction rather than separate tests for “mandatory” vs.
“prohibitory” injunctions, with the understanding that courts should always be careful, in the
exercise of their discretion, not to issue an injunction more burdensome than necessary to
prevent irreparable harm while the litigation is pending. Anyway, the Court will assume for
purposes of this motion that the plaintiffs are seeking a prohibitory injunction, since the law
imposes a lighter burden for obtaining a prohibitory injunction—a burden the plaintiffs have not
met.
Likelihood of Success on the Merits. The plaintiffs argue they are likely to succeed on
their Electronic Communications Privacy Act (ECPA), California Invasion of Privacy Act
(CIPA), invasion of privacy, and Unfair Competition Law (UCL) claims.
ECPA Claim. The plaintiffs have not shown they are likely to succeed on their ECPA
claim because the ECPA makes explicit that it is not unlawful to intercept a communication if
one of the parties to the communication has given prior consent. 18 U.S.C. § 2511(2)(d).
Although the plaintiffs did not consent to Google receiving their health information, the health
care providers consented to the use of Google source code on their web properties. The plaintiffs
contend the criminal or tortious exception to the one-party consent exception applies. Id.
(creating an exception to the exception when a “communication is intercepted for the purpose of
committing any criminal or tortious act”). However, the plaintiffs have not provided sufficient
evidence to show “the purpose for the interception—its intended use—was criminal or tortious.”
Sussman v. American Broadcasting Companies, Inc., 186 F.3d 1200, 1202 (9th Cir. 1999). It is
not enough for the interception itself to have violated the law, the interception must be “done for
the purpose of facilitating some further impropriety” for the criminal or tortious exception to
apply. Id.
CIPA Claim. The plaintiffs’ CIPA claim may be their strongest. CIPA mirrors the ECPA
but does not contain a one-party consent exception. Instead CIPA requires consent from all
parties to the communication. Cal. Penal Code § 631(a). Here, the plaintiffs have presented

3

Case 3:23-cv-02431-VC Document 76 Filed 10/18/23 Page 4 of 6

evidence that they did not consent to Google obtaining their personal health information. Google,
however, argues it is merely a vendor providing a service for the health care providers to capture
their patients’ information while using their web properties. Courts have drawn a distinction for
purposes of CIPA liability between “independent parties who mined information from other
websites and sold it” versus vendors who provide “a software service that captures its clients’
data, hosts it on [its] servers, and allows the clients to analyze their data.” Graham v. Noom, Inc.,
533 F. Supp. 3d 823, 832 (N.D. Cal. 2021); see also Williams v. What If Holdings, LLC, No. C
22-03780 WHA, 2022 WL 17869275, at *3 (N.D. Cal. Dec. 22, 2022). Based on the evidence
presented in connection with this motion, it seems possible that Google could fall into either
category, but the answer is far from obvious.
Privacy Claims. There is a reasonable expectation of privacy in one’s private health
information. See In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799-800 (N.D. Cal.
2022). But whether Google’s actions constitute “highly offensive” conduct is less clear based on
the plaintiffs’ evidence at this stage. The acquisition of this information in conjunction with a
service being offered to the health care provider web properties, without evidence that Google
itself used the information, is not obviously “highly offensive,” and in this case it may depend on
a better understanding of Google’s role (including whether it is merely acting as a vendor within
the meaning of CIPA).
UCL Claim. The UCL “requires that a plaintiff have ‘lost money or property’ to have
standing to sue” making “[t]he plain import of this [] that a plaintiff now must demonstrate some
form of economic injury.” Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 323 (2011). The issue
of whether the disclosure of personal information or data constitutes an economic injury is not
well-settled. See Katz-Lacabe v. Oracle Am., Inc., No. 22-CV-04792-RS, 2023 WL 2838118, at
*8 (N.D. Cal. Apr. 6, 2023) (collecting cases). Thus, it is not clear the plaintiffs are likely to
succeed on this claim.
Balance of Hardships and Public Interest. Even assuming serious questions going to the
merits, and even assuming the plaintiffs suffered some degree of irreparable injury by having

4

Case 3:23-cv-02431-VC Document 76 Filed 10/18/23 Page 5 of 6

Google merely acquire (as opposed to use) their private health information, the plaintiffs have
not demonstrated that the balance of hardships tips sharply in their favor or that a preliminary
injunction would be in the public interest. Given the absence of evidence that Google is using the
patient information for its own purposes, the plaintiffs have not shown that they or the public
suffer in any significant way from Google’s activity. On the other hand, the proposed
preliminary injunctive relief would place a substantial burden on Google (regardless of whether
you label it a mandatory or prohibitory injunction), and potentially on the health care companies
with whom Google works. In a similar case, Facebook users alleged Meta Pixel allowed Meta to
obtain their personal health information when they logged into their healthcare providers’ patient
portals. Meta Pixel, 647 F. Supp. 3d at 784-86. Judge Orrick denied a preliminary injunction
based on the balance of hardships and the public interest prongs. Id. at 804-05. Despite evidence
that Meta actually used the data to send targeted ads—evidence the plaintiffs have not presented
here—Judge Orrick concluded “neither the equities nor the public interest currently support[ed]
an injunction.” Id. at 805. That’s even more true here.
* * *
Now that there has been a significant airing of some of the merits issues in this case, and
now that the motion for a preliminary injunction has been denied, it seems possible that the
plaintiffs may wish to amend their complaint rather than spending time and money on a further
hearing on Google’s pending motion to dismiss. If the plaintiffs wish to seek leave to file an
amended complaint, they may do so by way of administrative motion pursuant to Local Rule 711 within 7 days of this ruling. The Court will grant leave to file an amended complaint absent
extraordinary circumstances presented by Google. If the plaintiffs choose not to amend their
complaint, the Court will likely schedule another hearing before adjudicating the motion to
dismiss.
IT IS SO ORDERED.

5

Case 3:23-cv-02431-VC Document 76 Filed 10/18/23 Page 6 of 6

Dated: October 11, 2023
______________________________________
VINCE CHHABRIA
United States District Judge

6