Winston Smith v. Facebook, Inc.

                                                                            FILED
                            NOT FOR PUBLICATION
                                                                            DEC 06 2018
                    UNITED STATES COURT OF APPEALS                       MOLLY C. DWYER, CLERK
                                                                          U.S. COURT OF APPEALS


                            FOR THE NINTH CIRCUIT


WINSTON SMITH; et al.,                           No.   17-16206

              Plaintiffs-Appellants,             D.C. No. 5:16-cv-01282-EJD

 v.
                                                 MEMORANDUM*
FACEBOOK, INC.,

              Defendant-Appellee,

 and

AMERICAN CANCER SOCIETY, INC.;
et al.,

              Defendants.


                    Appeal from the United States District Court
                      for the Northern District of California
                    Edward J. Davila, District Judge, Presiding

                      Argued and Submitted October 16, 2018
                            San Francisco, California




       *
             This disposition is not appropriate for publication and is not precedent
except as provided by Ninth Circuit Rule 36-3.
Before: THOMAS, Chief Judge, GRABER, Circuit Judge, and LASNIK,** District
Judge.

      Plaintiffs, Winston Smith and two Jane Does, appeal the district court’s

dismissal of their complaint alleging that Facebook violated numerous federal and

state laws by collecting and using their browsing data from various healthcare-

related websites. We have jurisdiction pursuant to 

28 U.S.C. § 1291

, and we

review the district court’s dismissal de novo. Arakaki v. Lingle, 

477 F.3d 1048, 1056

 (9th Cir. 2007). We affirm.

                                          I

      The district court properly held that Plaintiffs consented to Facebook’s data

tracking and collection practices. In determining consent, courts consider whether

the circumstances, considered as a whole, demonstrate that a reasonable person

understood that an action would be carried out so that their acquiescence

demonstrates knowing authorization. Plaintiffs do not dispute that their acceptance

of Facebook’s Terms and Policies “constitutes a valid contract.” Those Terms and

Policies contain numerous disclosures related to information collection on third-

party websites, including: “We collect information when you visit or use third-

party websites and apps that use our Services . . . . This includes information about


      **
            The Honorable Robert S. Lasnik, United States District Judge for the
Western District of Washington, sitting by designation.
                                          2
the websites and apps you visit, your use of our Services on those websites and

apps, as well as information the developer or publisher of the app or website

provides to you or us,” and “we use all of the information we have about you to

show you relevant ads.” A reasonable person viewing those disclosures would

understand that Facebook maintains the practices of (a) collecting its users’ data

from third-party sites and (b) later using the data for advertising purposes.

Knowing authorization of the practice constitutes Plaintiffs’ consent. United States

v. Staves, 

383 F.3d 977, 981

 (9th Cir. 2004) (noting that consent, though generally

express, may be implied where there are surrounding circumstances indicating that

an individual knowingly agreed to an action).

       Plaintiffs claim that—though they gave general consent to Facebook’s data

tracking and collection practices—they did not consent to the collection of health-

related data due to its “qualitatively different” and “sensitive” nature. We do not

agree that the collected data is so different or sensitive. The data show only that

Plaintiffs searched and viewed publicly available health information that cannot, in

and of itself, reveal details of an individual’s health status or medical history.

Moreover, many other kinds of information are equally sensitive. We conclude

that the practice complained of falls within the scope of Plaintiffs’ consent to

Facebook’s Terms and Policies.


                                            3
      Finally, Plaintiffs assert that Facebook could not have gained consent

because the healthcare websites’ privacy policies promised not to share data with

third parties. But Facebook’s Terms and Policies make no such assurance, and

Facebook is not bound by promises it did not make. Therefore, we affirm the

district court’s finding that Plaintiffs consented to Facebook’s data tracking and

collection practices.

                                          II

      The district court also properly rejected Plaintiffs’ claims that the collected

data is subject to more stringent disclosure requirements under the Health

Information Portability and Accountability Act of 1996 (“HIPAA”) (codified as

amended in scattered sections of 42 U.S.C.) and California Civil Code section

1798.91 (2014). Information available on publicly accessible websites stands in

stark contrast to the personally identifiable patient records and medical histories

protected by these statutes—information that unequivocally provides a window

into an individual’s personal medical history. See, e.g., United States v. Huping

Zhou, 

678 F.3d 1110, 1112

 (9th Cir. 2012) (protecting disclosure of a hospital’s

patient records under HIPAA). Put simply, the connection between a person’s

browsing history and his or her own state of health is too tenuous to support




                                           4
Plaintiffs’ contention that the disclosure requirements of HIPAA or section

1798.91 apply.

                                         III

      In sum, the district court properly dismissed the complaint. Given our

resolution of these issues, we need not reach any other issues urged by the parties.

      AFFIRMED.




                                          5