Court Dismisses Privacy Violation Against Google Based on Updated Help Pages

Case 23-02431 in the U.S. District Court for Northern California alleged Google was "intentionally receiving communications between health providers and patients that contained PHI that could be connected to an identifiable person" in violation of various federal and state privacy laws.

"In 2023, Google started giving clear instructions to its health-provider clients, explaining how to avoid sending private health care information to Google, and emphasizing that Google didn’t want that information," said District Court Judge Vince Chhabria. "The allegations in the complaint do not support an inference that Google, after this point, intentionally obtained communications containing private health information about identifiable patients."

"That language creates only one plausible inference: Google, aware of how its products operate and the information that it is constantly collecting regardless of selection by its customers, took measures to prevent itself from receiving communications containing private health information by clearly instructing health providers not to put Google Analytics on the wrong webpages," Chhabria added.

Claims under the Wiretap Act, the California Invasion of Privacy Act (CIPA), intrusion upon seclusion, and common law privacy regarding communications prior to the updates in 2023, however, are allowed to continue. "It’s reasonable to infer from the allegations in the complaint and the materials that can be considered at this stage that Google intended to receive communications containing individually identifiable health information," Chhabria said of information collected prior to 2023.