A federal judge has ruled that most claims in a class action lawsuit against Google over health data tracking can move forward.
What happened
A class action lawsuit against Google LLC, which accuses the company of unlawfully collecting sensitive health information from users via tracking technologies on healthcare providers’ websites, has mostly survived a motion to dismiss. The case, Doe et al. v. Google LLC, will continue in the U.S. District Court for the Northern District of California, where Judge Vince Chhabria allowed the majority of the privacy and wiretap-related claims to proceed.
The lawsuit centers on Google’s tracking tools, such as Google Analytics, cookies, and pixels that were embedded on hospital and clinic websites. These tools collected data about site visitors, including medical conditions, appointment searches, and even abortion-related queries, which were linked to individual users through identifiers like IP addresses and client IDs.
Going deeper
The plaintiffs argue that Google knowingly received this data without proper user consent and used it to enhance its advertising capabilities. One plaintiff, who visited a Planned Parenthood site in 2018, alleges that Google’s tools collected highly sensitive information, including her selected procedure, location, zip code, and browsing behavior, all without her awareness.
The lawsuit claims that this kind of tracking occurred across numerous healthcare providers’ websites, including Keck Medicine of USC, MemorialCare, and Sharp HealthCare. The tools also allegedly enabled cross-site tracking for remarketing purposes.
Legal claims include common law invasion of privacy, violations of federal wiretap laws, the California Constitution, CIPA, CMIA, and unjust enrichment. Google argued the claims lacked legal grounds, especially since it updated its guidance in 2023, instructing healthcare providers not to send health data through Google Analytics on HIPAA-regulated pages.
What was said
Judge Chhabria found that issues of consent and Google’s role in recording sensitive health communications were significant enough to warrant continuation of the lawsuit. While some breach of contract claims were dismissed, particularly those related to post-2023 activity, the majority of claims relating to data collected before Google’s guidance update were allowed to proceed.
The court found it reasonable to infer that Google may have known about and benefited from health-related data collection before the update and failed to adequately prevent it.
The big picture
The lawsuit brings legal and ethical questions into focus around the use of digital tracking tools on healthcare websites. Although analytics tools are widely used to enhance web performance, their use on HIPAA-regulated sites brings user consent, data privacy, and tech company data practices under scrutiny. The outcome may shape future expectations for how technology providers handle data collection in regulated sectors such as healthcare.
FAQs
How do tracking technologies like Google Analytics collect user data?
These tools collect behavioral data from website visitors, such as clicks, searches, and time spent on pages, and associate them with user identifiers like IP addresses or cookies.
Why is data collection on healthcare websites a legal concern?
Healthcare websites often handle sensitive personal information, and unauthorized collection or transmission of this data may violate privacy laws, especially if done without clear consent.
What is the role of the Wiretap Act in this case?
The lawsuit claims Google’s data collection constitutes unlawful interception of private communications between individuals and healthcare providers, which may fall under federal wiretap violations.
Can website owners prevent this kind of data collection?
Yes. Site administrators can configure tracking tools to exclude sensitive health data or avoid embedding them on pages that involve protected health information.
What might happen next in this case?
With most claims moving forward, the case could proceed to discovery, where both parties gather evidence. Depending on findings, the case could result in a trial, settlement, or additional motions.
Farah Amod
