Google LLC in California is facing a lawsuit with allegations that the tech company illegally obtained personal health information (PHI) through tracking codes installed on healthcare organizations’ websites. Google filed a motion to dismiss, but the court rejected the request, and so most of the claims were permitted to move forward.
Google’s tracking technology consists of Google Analytics code, tracking pixels, software development kits, and cookies. When these tools are installed on websites, they can gather data concerning visitors’ activities on web pages. Website owners may use the information to enhance websites, products, and services. Google may use the information to improve its ad-targeting functionality. When the code is installed on healthcare organizations’ websites, it can acquire sensitive healthcare data, which includes data regarding health conditions, treatments, consultations, and website queries. That data is linked to every website visitor through identifiers like IP addresses.
Google is facing several lawsuits involving the use of tracking technology on healthcare provider websites. In May 2023, the lawsuits were combined and filed in the U.S. District Court for the Northern District of California. The Doe et al. v. Google LLC lawsuit claims that using Google’s tracking code on healthcare providers’ websites enabled the collection of sensitive health data without acquiring patient consent. That data was then sent to Google and employed to improve its ad-targeting services.
One plaintiff states that in 2018, she visited a Planned Parenthood website to look for an abortion treatment. The plaintiff thought that her visit to a website and the data she used for searches were confidential. Nevertheless, Google’s tracking code recorded the plaintiff’s IP address, her zip code, purpose for visiting, activities on the site, chosen abortion procedures, her client ID, the Planned Parenthood center selected for the treatment, how she arrived at the Planned Parenthood website, and other data. The collected data was sent to Google without the plaintiff’s awareness or permission.
The data obtained from healthcare organizations’ websites is intercepted and sent to Google. The tracking tools allow the monitoring of individuals across several websites for remarketing reasons. The lawsuits allege that many healthcare providers’ websites use Google’s tracking technology. Some major hospitals and medical facilities involved are MemorialCare: Long Beach Medical Center, Keck Medicine of USC, and Sharp HealthCare.
The lawsuit alleges Google knew about the use of the tracking code on healthcare providers’ websites, yet did not make known that simple fact to users and did not do anything to stop the installation of he code on healthcare websites. The lawsuit claims common law breach of privacy, unjust enrichment, violation of the California Invasion of Privacy Act (CIPA), violation of the California Constitution, violation of the federal Wiretap Act, and violation of the Confidentiality of Medical Information Act (CMIA).
Google filed a motion to dismiss the lawsuit, saying it didn’t have enough merit. However, U.S. District Court Judge Vince Chhabria determined that the concerns relating to permissions and Google’s part in recording information doesn’t support dismissal of the lawsuit at this time. Google updated its guidance for healthcare organizations in 2023, telling them not to transmit sensitive information using the Google Analytics code added to HIPAA-protected web pages. Judge Chhabria found it appropriate to infer that before the update, Google meant to obtain communications that contain individually identifiable health data and possibly took advantage of that data collection.
A number of breach of contract claims were rejected together with claims associated with data collection, after Google changed its guidance. The majority of claims associated with data collection before the updated guidance in 2023 were permitted to continue.