A California federal judge hinted on Thursday that he may grant Google’s request to dismiss a class action accusing the tech giant of improperly collecting personal data from healthcare providers' websites. However, U.S. District Judge Vince Chhabria said he still needs "a lot more thinking" before making a final decision.

The proposed class action, first filed in May 2023, claims that when users visit healthcare provider websites, their personal data is transferred to Google, which allegedly uses the information to enhance its advertising services. The suit, filed by several anonymous plaintiffs, asserts violations of the Federal Wiretap Act, California’s Invasion of Privacy Act, and other privacy-related laws, as well as breach of contract and unjust enrichment claims.

Judge Chhabria dismissed an earlier version of the lawsuit in July, giving the plaintiffs a final opportunity to amend their complaint. The current version, which is the second amended complaint, remains under scrutiny.

Concerns Over General Allegations

During a Zoom hearing on Google’s motion to dismiss, Judge Chhabria raised concerns about the vague nature of the plaintiffs' allegations. He noted that Google has explicitly instructed developers not to transmit sensitive health information, citing the Health Insurance Portability and Accountability Act (HIPAA).

"Google has flagged the issue for them, and I'm just not sure what else Google is supposed to do," Judge Chhabria said, expressing doubts about the plaintiffs’ argument that Google failed to obtain consent for data collection. He suggested that Google’s actions, such as its warning to healthcare providers, could undermine the plaintiffs' claims.

Plaintiff attorney Melissa Gardner, from Lieff Cabraser Heimann & Bernstein LLP, countered that Google fails to mention how it places unique identifiers on user data it receives from healthcare websites, making the information traceable.

Even if Google complies with HIPAA, Gardner argued, the transmission of sensitive health data could still violate the Wiretap Act and California privacy laws.

Google's Defense

Google’s lawyer, Eduardo Santacana, argued that the plaintiffs have not proven that Google intentionally collected personal health data through its Google Analytics and advertising services. Santacana stressed that Google provides clear terms of service to healthcare providers, warning them of potential violations.

He also pointed out that the plaintiffs’ claim is based on the assumption that Google was aware it would receive personal health information, but Santacana argued that this was speculative. The alleged issues stemmed from the actions of third parties, such as healthcare providers who may improperly use identifiable URLs.

Judge Chhabria appeared to agree that the plaintiffs’ theory seemed overly generalized. He noted that while the plaintiffs suggested that Google’s practices were problematic, there was insufficient evidence to support claims of intentional data misuse.

Encryption and Privacy

Santacana also addressed the plaintiffs' concern that Google’s encryption of user data was unlawful, explaining that the U.S. Department of Health & Human Services approves of the encryption methods Google uses to protect patient privacy. He further emphasized that Google does not connect the anonymized data to specific individuals.

However, Gardner contended that Google’s system is not secure and that the sensitive data could still be misused. Judge Chhabria, while acknowledging the privacy concerns, noted that the plaintiffs failed to provide convincing evidence that Google’s practices were directly responsible for the transmission of sensitive health data.

Privacy Violations and Lack of Specificity

In his remarks, Judge Chhabria pointed out two key issues with the lawsuit. First, he noted that Google had explicitly warned healthcare providers not to transmit personal health information through its services. Second, he emphasized that the plaintiffs’ allegations were too vague to establish a clear link between Google’s practices and any specific privacy violations.

He also noted that the complaint did not provide adequate evidence to support the claim that Google intended to use sensitive data for its advertising purposes.

The Path Forward

As the hearing concluded, Judge Chhabria acknowledged that the case presented complex issues but emphasized the need for more concrete evidence. While the plaintiffs raised valid concerns about privacy, the judge expressed doubts about whether the allegations were sufficient to warrant a lawsuit against Google.

The plaintiffs are represented by several law firms, including Lieff Cabraser Heimann & Bernstein LLP and Simmons Hanly Conroy LLC. Google is represented by Willkie Farr & Gallagher LLP.

The case, John Doe I et al. v. Google LLC, is ongoing in the U.S. District Court for the Northern District of California under case number 3:23-cv-02431.