Opinion · District Court, N.D. California
Annabel Kady, et al. v. Opencare, Inc.
Annabel Kady v. Opencare, Inc., No. 4:25-cv-05037, UP11432282 (District Court, N.D. California Aug. 31, 2026)
- Type
- Opinion
- Court
- District Court, N.D. California
- Jurisdiction
- California
- Date
- 2026-08-31
- Topic
- bankruptcy
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 ANNABEL KADY, et al., Case No. 4:25-cv-05037-KAW 8 Plaintiffs, ORDER GRANTING IN PART AND DENYING IN PART MOTION TO 9 v. DISMISS FIRST AMENDED CLASS ACTION COMPLAINT 10 OPENCARE, INC., Re: Dkt. No. 33 11 Defendant. 12 13 On January 14, 2026, Defendant Opencare, Inc. filed a motion to dismiss the first amended 14 class action complaint (“FAC”). (Def.’s Mot., Dkt. No. 33.) 15 Upon review of the moving papers, the Court finds this matter suitable for resolution 16 without oral argument pursuant to Civil Local Rule 7-1(b), and, for the reasons set forth below, 17 GRANTS IN PART AND DENIES IN PART the motion to dismiss. 18 I.
Citator
UpLaw has not yet analyzed Annabel Kady, et al. v. Opencare, Inc.. The absence of a flag is not a finding that it is good law.
1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6
7 ANNABEL KADY, et al., Case No. 4:25-cv-05037-KAW
8 Plaintiffs, ORDER GRANTING IN PART AND
DENYING IN PART MOTION TO
9 v. DISMISS FIRST AMENDED CLASS
ACTION COMPLAINT
10 OPENCARE, INC.,
Re: Dkt. No. 33
11 Defendant.
12
13 On January 14, 2026, Defendant Opencare, Inc. filed a motion to dismiss the first amended
14 class action complaint (“FAC”). (Def.’s Mot., Dkt. No. 33.)
15 Upon review of the moving papers, the Court finds this matter suitable for resolution
16 without oral argument pursuant to Civil Local Rule 7-1(b), and, for the reasons set forth below,
17 GRANTS IN PART AND DENIES IN PART the motion to dismiss.
18 I. BACKGROUND
19 Defendant Opencare, Inc. (“Opencare” or “Defendant”) connects patients across the United
20 States to local dental providers through their website, https://www.opencare.com/ (“Website”).
21 (First Am. Class Action Compl., “FAC,” Dkt. No. 31 ¶ 2.) To use this service, Website users
22 provide various pieces of information, including their location, email addresses, IP addresses,
23 unique identifiers (for their devices and for certain internet accounts), date of visit to the Website,
24 URLs visited, insurance information, when they last visited a dentist, whether they are
25 experiencing a dental emergency, and the nature of their dental problem(s). (FAC ¶¶ 7, 63, 86, 97-
26 99, 102, 105.) Unbeknownst to users, Opencare allegedly implemented invisible third-party
27 tracking tools (“Tracking Technologies”) that simultaneously collect and transmit the information
1 The data divulged to the Information Recipients is then connected back to a user’s profile
2 with the respective Information Recipients, or, if a user lacks such a profile, a shadow profile
3 assembled by the Information Recipients. (FAC ¶¶ 88-89, 91.) As a result, the Information
4 Recipients are able to identify the user’s real-world identity (e.g., through the user’s unique
5 TikTok account identifier, accessible via a cookie in the user’s browser, or digital “fingerprints”)
6 and use their Private Information to sell targeted digital advertising, including ads targeted to
7 Plaintiffs, based on their medical conditions. (See FAC ¶¶ 108-109.) This process occurs whether
8 or not a user has an account with Defendant. (See FAC ¶¶ 97-107.)
9 Plaintiff Kady used Defendant’s Website beginning in July of 2023 to research conditions,
10 find dentists, and book appointments. (FAC ¶ 30.) Plaintiff Taylor began using the Website in or
11 around March of 2025 to research dental conditions and treatments and to find local dentists.
12 (FAC ¶ 38.) As a result of using the Website for these purposes, each of the Plaintiffs’ Private
13 Information was shared with the Information Recipients. (FAC ¶¶ 34, 35, 42, 43.) Immediately
14 after using Defendant’s Website, each Plaintiff began receiving unsolicited advertisements related
15 to their disclosed medical conditions. (FAC ¶¶ 108-109.)
16 In its privacy policy (“Privacy Policy”), Defendant promised not to disclose users’ Private
17 Information without consent, stating: “If you do schedule an appointment through Opencare, that
18 information is considered Protected Health Information, and we will not sell that to third parties.”
19 (FAC ¶ 114.) The Privacy Policy explains that Opencare may receive PHI as a HIPAA “business
20 associate” and that this “prohibits us from using or disclosing the Protected Health Information in
21 ways that are not permissible by the health care provider itself, and requires us to implement
22 certain measures to safeguard the confidentiality, integrity, and availability of the Protected Health
23 Information.” (FAC ¶ 116.)
24 On June 13, 2025, Plaintiffs filed this lawsuit. On January 2, 2026, Plaintiffs filed the first
25 amended complaint. On January 14, 2026, Defendant filed the motion to dismiss. (Def.’s Mot.,
26 Dkt. No. 33.) On January 28, 2026, Plaintiffs filed an opposition. (Pls.’ Opp’n, Dkt. No. 36.) On
27 February 4, 2026, Defendant filed a reply. (Def.’s Reply, Dkt. No. 37.)
1 II. LEGAL STANDARD
2 Under Federal Rule of Civil Procedure 12(b)(6), a party may file a motion to dismiss based
3 on the failure to state a claim upon which relief may be granted. A motion to dismiss under Rule
4 12(b)(6) tests the legal sufficiency of the claims asserted in the complaint. Navarro v. Block, 250
5 F.3d 729, 732
(9th Cir. 2001). 6 In considering such a motion, a court must “accept as true all of the factual allegations 7 contained in the complaint,” Erickson v. Pardus,551 U.S. 89, 94
(2007) (per curiam) (citation 8 omitted), and may dismiss the case or a claim “only where there is no cognizable legal theory” or 9 there is an absence of “sufficient factual matter to state a facially plausible claim to relief.” 10 Shroyer v. New Cingular Wireless Servs., Inc.,622 F.3d 1035, 1041
(9th Cir. 2010) (citing 11 Ashcroft v. Iqbal,556 U.S. 662, 677-78
(2009); Navarro, 250 F.3d at 732) (internal quotation 12 marks omitted). 13 A claim is plausible on its face when a plaintiff “pleads factual content that allows the 14 court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” 15 Iqbal,556 U.S. at 678
(citation omitted). In other words, the facts alleged must demonstrate “more 16 than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not 17 do.” Bell Atl. Corp. v. Twombly,550 U.S. 544, 555
(2007). “Threadbare recitals of the elements of 18 a cause of action” and “conclusory statements” are inadequate. Iqbal,556 U.S. at 678
; see also 19 Epstein v. Wash. Energy Co.,83 F.3d 1136, 1140
(9th Cir. 1996) (“[C]onclusory allegations of 20 law and unwarranted inferences are insufficient to defeat a motion to dismiss for failure to state a 21 claim.”). “The plausibility standard is not akin to a probability requirement, but it asks for more 22 than a sheer possibility that a defendant has acted unlawfully . . . When a complaint pleads facts 23 that are merely consistent with a defendant's liability, it stops short of the line between possibility 24 and plausibility of entitlement to relief.” Iqbal,556 U.S. at 678
(quoting Twombly,550 U.S. at 25
557) (internal citations omitted). 26 Generally, if the court grants a motion to dismiss, it should grant leave to amend even if no 27 request to amend is made “unless it determines that the pleading could not possibly be cured by 1 the allegation of other facts.” Lopez v. Smith,203 F.3d 1122
, 1127 (9th Cir. 2000) (citations 2 omitted). 3 III. DISCUSSION 4 Defendant moves to dismiss on the grounds that Plaintiffs lack Article III Standing and 5 that Plaintiffs separately fail to state a claim under Federal Rule of Civil Procedure 12(b)(6), in 6 part, because they misclassify the information as individually identifiable health information 7 (“IIHI”) and protected health information (“PHI”). (Def.’s Mot. at 1, 5, 17.) 8 A. Article III Standing 9 As an initial matter, Defendant moves to dismiss on the grounds that Plaintiffs lack Article 10 III standing because they fail to allege a concrete injury, their allegations of future harm are 11 speculative and not imminent, and they lack standing for injunctive relief. (Def.’s Mot. at 17.) 12 Article III standing requires the demonstration of three elements: (1) the plaintiff suffered 13 an “injury in fact” that is concrete and particularized and actual or imminent, not conjectural or 14 hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is 15 likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. 16 Lujan v. Defenders of Wildlife,504 U.S. 555, 560-61
(1992). Absent this showing, the action 17 must be dismissed. See Steel Co. v. Citizens for a Better Env’t,523 U.S. 83, 109-10
(1998). 18 Here, Defendant largely relies on Popa v. Microsoft Corporation, in which the Ninth 19 Circuit recently held that a plaintiff had not established a concrete injury-in-fact stemming from 20 Microsoft’s “session-replay technology,” which enables businesses to track users’ browsing 21 activity.153 F.4th 784
(9th Cir. 2025). In sum, the plaintiff failed to establish “how the tracking 22 of her interactions… caused her to experience any kind of harm that is remotely similar to the 23 ‘highly offensive’ interferences or disclosures that were actionable at common law.”Id. at 791
. 24 “[T]he kind of harm and not the degree” is relevant to determining whether an alleged injury-in- 25 fact is sufficiently concrete and comparable “to a specific common-law tort,” such that the injury 26 is one “that has traditionally been actionable in our nation’s legal system.”Id.
27 In opposition, Plaintiffs argue that they have adequately alleged injury in fact caused by 1 courts in this district. See, e.g., Lineberry v. AddShopper, Inc., No. 23-CV-01996-VC,2025 WL 2
551864, at *1 (N.D. Cal. Feb. 19, 2025) (The court found injury in fact based on website tracking 3 when allegations involved misappropriation of browsing activity by using it to “barrage that 4 person’s devices with unwanted email communications.”); Shah v. MyFitnessPal, Inc., No. 25- 5 CV-04430-PCP,2026 WL 216334
, at *3 (N.D. Cal. Jan. 27, 2026) (Claims regarding misuse of 6 nutrition and fitness tracking information sufficient qualified as “embarrassing, invasive, or 7 otherwise private information,” which was sufficient for standing under Popa.). Namely, 8 Plaintiffs allege facts showing they used Defendant’s Website, submitted Private Information, and 9 Defendant invaded their privacy rights by disclosing such information to third parties without 10 consent through the Tracking Technologies. (Pls.’ Oppp’n at 4 (citing FAC ¶ 33 (detailing 11 Defendant’s unauthorized disclosure of confidential medical information concerning dental 12 surgery required after a traumatic accident).) 13 Moreover, to the extent that Defendant contends that Plaintiffs’ allegations of future harm 14 are speculative and not imminent and that they lack standing for injunctive relief, those arguments 15 are not well taken. (See Def.’s Mot. at 18-19.) As Plaintiffs argue in opposition, their claims are 16 based on harms that have already occurred, such as the invasion of privacy rights by disclosing 17 their information to third parties without their consent. (See Pls.’ Opp’n at 5.) Furthermore, the 18 allegations of ongoing harm support standing for injunctive relief. Campbell v. Facebook, Inc., 19951 F.3d 1106, 1120
(9th Cir. 2020) (quoting she Friends of the Earth, Inc. v. Laidlaw Env't Servs. 20 (TOC), Inc.,528 U.S. 167, 191-92
(2000) (threat of future harm sufficiently alleged despite
21 voluntary cessation of using data from personal messages to populate users’ Recommendations
22 Feed due to formidable burden of showing that wrongful behavior could not reasonably be
23 expected to recur).
24 Accordingly, Plaintiffs’ allegations are sufficient to establish standing at the pleadings
25 stage.
26
B. Whether the information at issue is individually identifiable health information
27 (“IIHI”) and protected health information (“PHI”).
1 cannot state any valid claim because the information shared never became IIHI or PHI. (Def.’s
2 Mot. at 5.) Specifically, Defendant argues that Opencare is akin to a receptionist, and, upon
3 calling a receptionist, a person may provide demographic, insurance, and location information in
4 order to schedule an appointment, which is not IIHI or PHI under federal or California statutory
5 definitions. Id.
6 In opposition, Plaintiffs argue that HIPAA applies to receptionists in healthcare offices. 7 (Pls.’ Opp’n at 6.) Specifically, Plaintiffs contend that HIPAA applies to Defendant as a “business 8 associate” of the dentists to which it connects users of its Website.Id.
(citing45 C.F.R. § 9
160.103.)45 C.F.R. § 160.103
provides that “[a] covered entity may be a business associate of 10 another covered entity,” and that “business associate” includes: (i) persons that provide “data 11 transmission services with respect to protected health information to a covered entity”; (ii) persons 12 that offer a personal health record to an “individual[] on behalf of a covered entity”; and (iii) 13 subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate. 4514 C.F.R. § 160.103
(3). The Court notes that the operative complaint quotes Defendant’s 15 acknowledgement in its Privacy Policy that it might be subject to HIPAA: “[w]hen we act as a 16 Business Associate, we may be subject to certain laws and regulations, including certain HIPAA 17 rules, that govern our use and disclosure of Protected Health Information.” (FAC ¶ 116.) 18 Additionally, the Privacy Policy allegedly explained that, in its role as a Business Associate, 19 Opencare is prohibited from “using or disclosing the Protected Health Information in ways that are 20 not permissible by the health care provider itself and requires us to implement certain measures to 21 safeguard the confidentiality, integrity, and availability of the Protected Health Information.”Id.
22 Perhaps tellingly, Defendant does not argue that the information provided would not
23 qualify as PHI or IIHI if it were a covered entity under HIPAA. Based on the foregoing, Plaintiffs
24 sufficiently plead that Defendant qualifies as a Business Associate under HIPAA, so, at the
25 pleading stage, the information transmitted and obtained by the Tracking Technologies qualifies as
26 PHI or IIHI. Thus, the Court declines to dismiss the complaint on this basis.
27 //
C. Whether Plaintiffs consented to disclosure through the Privacy Policies of
1 Opencare, Facebook, TikTok, and Google
2 Alternatively, Defendant argues that Plaintiffs consented to disclosure through the privacy
3 policies of Opencare, Facebook, TikTok, and Google. (Def.’s Mot. at 5.) In opposition, Plaintiff
4 alleges that users are not asked to consent to the Privacy Policy until after they provide their
5 Private Information through the Website, and the notice itself is inconspicuous. (Pls.’ Opp’n at 7.)
6 As a result, Plaintiffs contend that they had no reason to opt out as they were not aware of the
7 Privacy Policy. Id.
8 Specifically, the operative complaint alleges:
9 A user of the Website is not asked to review Defendant’s privacy
practices until well after Defendant has shared copious amounts of
10 IIHI and PHI about that user. Specifically, a user is only asked to
consent to Defendant’s privacy policy after that user has completed
11 the entire questionnaire on Defendant’s Website, imputing highly
sensitive information about the user’s medical conditions, insurance
12 information, geographic location, dental history, and more. After
Opencare has shared all of this sensitive information, users are
13 provided with a small reference to the Defendant’s privacy policy
page below the form in which they input their email. The form claims
14 that a user consents to Opencare’s privacy policy by inputting their
email. Many users are likely to miss this as it is in a small font in a
15 grey color.
16 (FAC ¶ 113.) Once users process and book an appointment, they are promised that “[i]f you do
17 schedule an appointment through Opencare, that information is considered Protected Health
18 Information, and we will not sell that to third parties.” Id.
¶ 114 (citing Opencare Privacy Policy). 19 Even after, Plaintiffs contend that users are deceived and misled by the Privacy Policy, which, 20 while it mentions that third parties may collect information about your activity, it provides 21 assurances that “[i]f you do schedule an appointment through Opencare, that information is 22 considered Protected Health Information, and we will not sell that to third parties.” (FAC ¶ 115 23 (quoting Opencare Privacy Policy).) Moreover, whether “users could have taken additional 24 measures to prevent cookies from tracking their browsing” is not relevant at the pleading stage, 25 because that “is a fact-based defense to be developed and asserted at a later stage of the litigation.” 26 In re Facebook, Inc. Internet Tracking Litig.,956 F.3d 589, 605
(9th Cir. 2020). 27 Accordingly, the Court finds that Plaintiffs’ allegations are sufficient to plead that they did 1 D. Individual Claims 2 i. Negligence 3 Plaintiffs’ first cause of action is for negligence. (FAC ¶¶ 201-210.) To plead negligence, 4 Plaintiffs must show that Defendant “owed [Plaintiffs] a legal duty, that it breached the duty, and 5 that the breach was a proximate or legal cause of [Plaintiffs’] injuries.” Merrill v. Navegar, Inc., 626 Cal. 4th 465, 477
(2001).
7 Defendant moves to dismiss on the grounds that HIPAA does not create a private right of
8 action and cannot be used to define a tort duty enforceable under state common law. (Def.’s Mot.
9 at 6.) In opposition, Plaintiffs contend that they are not alleging negligence under HIPAA. (Pls.
10 Opp’n at 17.) Rather, Plaintiffs allege that Defendant had a common law duty “to exercise
11 reasonable care to secure, safeguard and protect their highly sensitive Private Information.” (Pl.’s
12 Opp’n at 16 (citing FAC ¶¶ 131, 141-145, 150, 202, 205).) While this claim mentions
13 Defendant’s duty to safeguard this information under HIPAA, the negligence claim itself does not
14 plead that HIPAA is the source of the common law duty. (See FAC ¶ 206.) Thus, Defendant’s
15 argument is unavailing.
16 California courts consider several factors when deciding whether a duty of care exists,
17 including
the foreseeability of harm to the plaintiff, the degree of certainty that
18 the plaintiff suffered injury, the closeness of the connection between
the defendant's conduct and the injury suffered, the moral blame
19 attached to the defendant's conduct, the policy of preventing future
harm, the extent of the burden to the defendant and the consequences
20 to the community of imposing a duty to exercise care with resulting
liability for breach, and the availability, cost, and prevalence of
21 insurance for the risk involved.
22 Regents of Univ. of Cal. v. Superior Court, 4 Cal. 5th 607, 628
(2018) (quoting Rowland v. 23 Christian,69 Cal. 2d 108 113
(1968)). These factors “must be evaluated at a relatively broad level 24 of factual generality.”Id.
(quotation omitted). Courts in this district have found a duty in data 25 breach cases because “[t]he lack of reasonable care in the handling of personal information can 26 foreseeably harm the individuals providing the information.” Bass v. Facebook, Inc.,394 F. Supp. 27
3d 1024, 1039 (N.D. Cal. 2019). The harm is even more foreseeable when the information 1 “would create perverse incentives for businesses who profit off the use of consumers' personal 2 data to turn a blind eye and ignore known security risks.”Id.
(quoting In re Equifax, Inc., 3 Customer Data Sec. Breach Litig.,362 F. Supp. 3d 1295, 1325
(N.D. Ga. 2019) (internal 4 quotations omitted)). Here, Defendants collected private, medical information from Plaintiffs and 5 used Tracking Technologies to collect other information about Plaintiffs. Thus, the Court finds 6 that Plaintiffs’ allegations are sufficient to state a common law duty for negligence. 7 Next, Defendant argues that the harm to is too speculative to constitute a breach of duty. 8 (Def.’s Mot. at 7.) The Court disagrees. As discussed above, the Court finds that the harms are not 9 speculative, as they have both occurred and remain ongoing. See discussion, supra, Part III.A. 10 Finally, to the extent that Defendant argues that Plaintiffs could have opted out of targeted 11 advertising pursuant to Opencare’s Privacy Policy, that argument is also not availing. (Def.’s Mot. 12 at 8.) As discussed above, Plaintiff alleges that users are not asked to consent to the Privacy 13 Policy until after they provide their Private Information through the Website, and the notice itself 14 is inconspicuous. See discussion, supra, Part III.C. 15 Accordingly, the motion is denied as to the negligence cause of action. 16 ii. Invasion of Privacy 17 Plaintiffs’ second cause of action is for invasion of privacy. (FAC ¶¶ 211-224.) Defendant 18 moves to dismiss on the grounds that this claim in not cognizable because the use of tracking 19 pixels or analytics is not offensive as a matter of law. (Def.’s Mot. at 8.) 20 To state a claim for common law invasion of privacy, Plaintiffs “must allege: (1) intrusion 21 into a private place, conversation or matter (2) in a manner highly offensive to a reasonable 22 person.” Low v. LinkedIn Corp.,900 F. Supp. 2d 1010, 1025
(N.D. Cal. 2012) (citing Shulman v. 23 Group W Prods., Inc.,18 Cal.4th 200, 231
,74 Cal.Rptr.2d 843
,955 P.2d 469
(1998) (emphasis in 24 original). Similarly, to state a claim for invasion of privacy under the California Constitution, 25 “Plaintiffs must show that (1) they possess a legally protected privacy interest, (2) they maintain a 26 reasonable expectation of privacy, and (3) the intrusion is ‘so serious ... as to constitute an 27 egregious breach of the social norms’ such that the breach is ‘highly offensive.’” In re Facebook, 1 Inc.,47 Cal. 4th 272, 287
(2009)). 2 In opposition, Plaintiffs claim to submit claims for invasion of privacy under both common 3 law and the California Constitution. (Pls.’ Opp’n at 20.) As previously discussed, at this juncture, 4 the Court finds that Plaintiffs have sufficiently alleged that the information transmitted was private 5 information, and that the opt-out procedure was not sufficient to confer consent. See discussion, 6 supra, Parts III.B-C. In accordance with other courts in this district, the Court finds that Plaintiffs 7 had a reasonable expectation that the information shared would remain private, and the Tracking 8 Technologies installed to share that information is highly offensive. See, e.g., Shah v. 9 MyFitnessPal, Inc., No. 25-CV-04430-PCP,2026 WL 216334
, at *5 (N.D. Cal. Jan. 27, 2026) 10 (third-party data collection and disclosure was highly offensive based on the information 11 transmitted and the misrepresentation that it would be kept private). 12 In reply, however, Defendant argues that the operative complaint does not mention the 13 California Constitution. (Def.’s Reply at 6.) This argument is well taken. 14 Plaintiffs, however, did request leave to amend to clearly allege both claims, and the Court 15 grants them that opportunity. (See Pls.’ Opp’n at 20.) 16 Thus, while the motion is denied as to the invasion of privacy claim, Plaintiffs are granted 17 leave to amend to allege separate invasion of privacy claims under common law and the California 18 Constitution. 19 iii. Breach of Confidence 20 Plaintiffs’ third cause of action is for breach of confidence under California law. (FAC ¶¶ 21 225-231.) To state a claim for breach of confidence, a plaintiff must adequately allege “(1) the 22 plaintiff conveyed ‘confidential and novel information’ to the defendant; (2) the defendant had 23 knowledge that the information was being disclosed in confidence; (3) there was an understanding 24 between the defendant and the plaintiff that the confidence be maintained; and (4) there was a 25 disclosure or use in violation of the understanding.” Berkla v. Corel Corp.,302 F.3d 909, 917
(9th 26 Cir. 2002) (quoting Ent. Rsch. Grp., Inc. v. Genesis Creative Grp., Inc.,122 F.3d 1211
, 1227 (9th 27 Cir. 1997)). 1 Defendant moves to dismiss on the grounds that “California does not recognize a standalone tort 2 for breach of confidence outside of a traditional, confidential professional relationship such as a 3 physician-patient relationship.” (Def.’s Mot. at 10.) As a result, Defendant contends that 4 Plaintiffs’ failure to allege the existence of a special relationship beyond a duty to keep medical 5 information confidential is fatal to this claim. Id. Defendant’s interpretation of SocialApps is 6 much narrower than the order itself, which merely states that such a claim requires that the 7 plaintiff “plead the existence of a confidential relationship and [Defendant’s] voluntary 8 assumption thereof,” but it is “not limited to fiduciary relationships, nor to the existence of a 9 contract.” SocialApps,2012 WL 381216
, at *3 (citing Faris v. Engberg,97 Cal.App.3d 309, 321
, 10158 Cal.Rptr. 704
(1979)). 11 In opposition, Plaintiffs argue that their allegations satisfy the elements of this claim. (Pls.’ 12 Opp’n at 21.) Plaintiffs allege that they had reasonable expectations of privacy in the responses 13 and communications entrusted through the Website, which included highly sensitive health 14 information, and, while Defendant made express promises to keep the information confidential, 15 Opencare installed Tracking Technologies to disclose the Private Information regarding Plaintiffs’ 16 health. (FAC ¶¶ 227-228.) This is sufficient to state a claim for breach of confidence. 17 Accordingly, the motion is denied as to this cause of action. 18 iv. Unjust Enrichment 19 Plaintiffs fourth cause of action is for unjust enrichment. (FAC ¶¶ 232-238.) While 20 California does not have a standalone cause of action for “unjust enrichment,” “[w]hen a plaintiff 21 alleges unjust enrichment, a court may construe the cause of action as a quasi-contract claim 22 seeking restitution.” Astiana v. Hain Celestial Grp., Inc.,783 F.3d 753, 762
(9th Cir. 2015); see 23 also Hartford Cas. Ins. Co. v. J.R. Mktg., L.L.C.,61 Cal. 4th 988, 998
(2015). “To allege unjust 24 enrichment as an independent cause of action, a plaintiff must show that the defendant received 25 and unjustly retained a benefit at the plaintiff's expense.” ESG Cap. Partners, LP v. Stratos, 82826 F.3d 1023
, 1038–39 (9th Cir. 2016) (citing Lectrodryer v. SeoulBank,77 Cal. App. 4th 723
, 726 27 (2000)). 1 purported information provided, nor do Plaintiffs explain how Opencare has been able to monetize 2 said information.” (Def.’s Mot. at 10.) Additionally, Defendant argues that Plaintiffs plead no 3 facts that Opencare retained the benefit and the retention is unjust. Id. at 10-11. 4 In opposition, Plaintiffs contend that they specifically allege that the benefit conferred was 5 in the form of valuable Private Information in the expectation that their Private Information would 6 remain confidential. (Pls.’ Opp’n at 22 (citing FAC ¶¶ 234-235.) Plaintiffs allege that Defendant 7 unjustly retained those benefits at the expense of Plaintiffs and Class without providing any 8 commensurate compensation to Plaintiffs or Class members. (FAC ¶ 236.) Defendant accepted 9 Plaintiffs’ Private Information, but it did not provide the confidentiality promised, and, instead, it 10 used Plaintiffs’ Private Information for its own benefit. (FAC ¶¶ 114, 237.) There appears to be 11 no dispute that Plaintiffs have sufficient facts to plead this cause of action, but the current 12 allegations set forth under the claim itself constitute the type of threadbare recitals and conclusory 13 statements not permitted by Federal Rule of Civil Procedure 8. See Gibson v. City of Portland, 16514 F.4th 1265
, 1288 (9th Cir. 2026) (“Incorporation by reference is permitted by Rule 10(b) and (c),
15 but when it is used indiscriminately, it becomes a shortcut by counsel that violates Rule 8.”)
16 Accordingly, the unjust enrichment claim is dismissed with leave to amend.
17 v. Violations of the Electronic Communications Privacy Act (“ECPA”) and the
California Invasion of Privacy Act (“CIPA”)
18
The fifth cause of action is for violations of the ECPA, 18 U.S.C. § 2511
(1), et seq. (FAC
19
¶¶ 239-252.) The sixth cause of action is for violation of CIPA, California Penal § 631. (FAC ¶¶
20
262-270.) These are both wiretapping claims and the courts treat them similarly, so the Court will
21
address them together. See Shah v. MyFitnessPal, Inc., No. 25-CV-04430-PCP, 2026 WL 216334
,
22
at *6 (N.D. Cal. Jan. 27, 2026).
23
Defendant moves to dismiss these claims on three independent grounds: “(i) the content at
24
issue is not covered by the narrow statutory definition; (ii) Opencare was a party to the
25
communication and cannot intentionally intercept its own communication (18 U.S.C. § 26
2511(2)(c)); and (iii) Plaintiffs consented to the communication….” (Def.’s Mot. at 11-12.)
27
As an initial matter, the consent argument is not well taken for the same reasons set forth
1 above. See discussion, supra, Part III.C. As far as whether the contents requirement is satisfied,
2 Plaintiffs allege that the Tracking Technologies unlawfully disclosed Private Information, IIHI,
3 PHI, IP addresses, Google account information, and health information to Information Recipients.
4 (FAC ¶¶ 252-254.) The Ninth Circuit has held that to satisfy the statutory definition of “contents,”
5 the information must be “a person's intended message to another (i.e., the ‘essential part’ of the
6 communication, the ‘meaning conveyed,’ and the ‘thing one intends to convey’).” In re Zynga
7 Priv. Litig., 750 F.3d 1098, 1106
(9th Cir. 2014). Thus, the allegations are sufficient to satisfy the 8 content requirement. 9 The only meritorious argument is the second one. Courts perform the same analysis for 10 both the ECPA and CIPA regarding the party exemption. In re Facebook, Inc. Internet Tracking11 Litig., 956
F.3d 589, 607 (9th Cir. 2020). The ECPA prohibits the unauthorized “interception” of 12 an “electronic communication.”18 U.S.C. § 2511
(1)(a)–(e). Similarly, California Penal Code 13 Section 631(a) prohibits “willfully and without the consent of all parties to the communication, or 14 in any unauthorized manner, read[ing], or attempt[ing] to read, or to learn the content or meaning 15 of any message, report, or communication while the same is in transit.” “Both statutes contain an 16 exemption from liability for a person who is a ‘party’ to the communication, whether acting under 17 the color of law or not.” In re Facebook, Inc. Internet Tracking Litig.,956 F.3d at 607
. 18 Here, however, Defendant was a party to the communications, and, therefore, cannot 19 intercept its own communications. To adequately plead the wiretapping claims, Plaintiffs would 20 need to allege that a third party intercepted their communications with Opencare’s website. Shah 21 v. MyFitnessPal, Inc., No. 25-CV-04430-PCP,2026 WL 216334
, at *7 (N.D. Cal. Jan. 27, 2026) 22 (failure to allege that communications were intercepted by a third party fatal to wiretapping 23 claim.) Alleging mere tracking is not sufficient. Seeid.
24 Accordingly, the fifth and sixth causes of action for wiretapping are dismissed with leave 25 to amend. If Plaintiffs cannot in good faith allege interception by a third-party, they should not 26 include these claims in the second amended class action complaint. 27 vi. Pen Register 1 violation of California Penal Code § 638.51. (FAC ¶¶ 271-276.) California Penal Code Section 2 638.51(a) prohibits “install[ing] or us[ing] a pen register” without a court order under specific 3 circumstances. Section 638.50(b) defines a “pen register” as “a device or process that record or 4 decodes dialing, routing, addressing, or signaling information transmitted by an instrument or 5 facility from which a wire or electronic communication is transmitted, but not the contents of a 6 communication.” 7 Defendant argues that this claim should be dismissed, because consent of the user is an 8 exception to the use of these devices. (Def.’s Mot. at 13.) Defendant further contends that Plaintiff 9 Kady’s claim is barred by the applicable one-year statute of limitations, because Plaintiff Kady 10 accessed Opencare in July 2023. Id. at 13-14. 11 In opposition, Plaintiffs acknowledge that the pen register claim is being pled in the 12 alternative to the wiretapping claims. (Pls.’ Opp’n at 16.) Plaintiffs also argue that Plaintiff 13 Kady’s claim is not time-barred due to the delayed discovery rule, because she did not discover 14 Opencare’s violations until shortly before the initial complaint was filed. (See Pls.’ Opp’n at 13, 15 16.) 16 Again, the Court finds the consent argument unavailing for the reasons set forth above. 17 See discussion, supra, Part III.C. Defendant’s statute of limitations argument, however, appears 18 well taken. (Def.’s Mot. at 13-14; Def.’s Reply at 5.) Indeed, Plaintiff Kady alleges that she 19 received unwanted advertisements almost immediately after visiting the Website in July 2023, and 20 this lawsuit was not filed until June 2025. (See FAC ¶¶ 30-31.) 21 “Generally speaking, a cause of action accrues at the time when the cause of action is 22 complete with all of its elements.” Fox v. Ethicon Endo-Surgery, Inc.,35 Cal. 4th 797, 806
, 2723 Cal.Rptr.3d 661
,110 P.3d 914
(2005) (cleaned up). The statute of limitations will begin to run so 24 long as the plaintiff knows the facts underlying the claim even if they did not know that the 25 conduct is illegal. Wakefield v. Wells Fargo & Co., No. C 13-05053-LB,2014 WL 5077134
, at 26 *12 (N.D. Cal. Oct. 9, 2014). “The discovery rule is an exception to the accrual rule and 27 postpones ‘accrual of a cause of action until the plaintiff discovers, or has reason to discover, the 1 at *4 (N.D. Cal. June 5, 2026) (quoting Fox,35 Cal. 4th at 807
.)
2 Here, the operative complaint does not allege any specific facts to support the imposition
3 of the delayed discovery rule, and, instead, relies on a threadbare recital that tolling applies. (See
4 FAC ¶ 186.) Thus, the pen register claim is dismissed with leave to amend to allege facts to
5 support delayed discovery as to Plaintiff Kady. If Plaintiffs cannot do so, they shall amend this
6 claim to apply only to Plaintiff Taylor, who utilized the Website within the statutory period. (See
7 FAC ¶ 38.)
8
vii. Violation of the California Confidentiality of Medical Information Act
9 (“CMIA”)
10 The eighth cause of action is for violation of CMIA, California Civil Code § 56, et seq.
11 (FAC ¶¶ 277-283.) The CMIA states that “[a] provider of health care… shall not disclose medical
12 information regarding a patient of the provider of health care… without first obtaining an
13 authorization.” Cal. Civ. Code § 56.10
(a)-(c). A health care provider “who negligently creates, 14 maintains, preserves, stores, abandons, destroys, or disposes of medical information” is subject to 15 liability.Cal. Civ. Code § 56.101
(a). “The Legislature enacted the CMIA to ‘protect the 16 confidentiality of individually identifiable medical information obtained from a patient by a health 17 care provider, while at the same time setting forth limited circumstances in which the release of 18 such information to specified entities or individuals is permissible.’” J.M. v. Illuminate Educ., Inc., 1919 Cal. 5th 705
, 714,588 P.3d 611
, 615 (2026) (quoting Loder v. City of Glendale,14 Cal. 4th 20 846, 859
(1997)). The California Supreme Court recently clarified that “confidentiality is 21 breached when the information is exposed to a significant risk of unauthorized access or use.” 22 J.M., 19 Cal. 5th at 711. 23 Here, Defendant moves to dismiss on the grounds that it is not a provider of health care 24 under the CMIA. (Def.’s Mot. at 15.) Section 56.06, however, broadly defines a “provider of 25 health care” to include “[a]ny business organized for the purpose of maintaining medical 26 information in order to make the information available to an individual or to a provider of health 27 care at the request of the individual or a provider of health care.”Cal. Civ. Code § 56.06
(a). In 1 businesses that offer software or hardware to consumers, including mobile applications and 2 websites, that “make the information available to an individual or a provider of health care at the 3 request of the individual or a provider of health care, for purposes of allowing the individual to 4 manage the individual's information, or for the diagnosis, treatment, or management of a medical 5 condition of the individual….”Cal. Civ. Code § 56.06
(b); see also J.M., 19 Cal. 5th at 714 (noting 6 the expansion of the provider definition). 7 In opposition, Plaintiffs contend that Defendant is provider of healthcare under the statute, 8 because it falls within the definition of a “contractor” under Section 56.05(d), but they concede 9 that additional facts could be included to sufficiently plead the elements of this cause of action. 10 (Pls.’ Opp’n at 15 & n. 131.) In reply, Defendant argues that Plaintiffs’ categorization of Opencare 11 as “any other entity” and a “contractor” in the opposition should not be entertained, because those 12 terms have distinct definitions under CIMA. (Def.’s Reply at 7.) While Defendant is correct that 13 the claim is subject to dismissal for failure to adequately allege that it is a provider, the Court will 14 grant Plaintiffs leave to amend. 15 To the extent that Defendant argues that Plaintiffs are not “patients” or that the Private 16 Information does not constitute “medical information,” these arguments must be addressed after 17 amendment. (See Def.’s Mot. at 15.) The CMIA defines “patient” as “a natural person, whether or 18 not still living, who received health care services from a provider of health care and to whom 19 medical information pertains.”Cal. Civ. Code § 56.05
(m). “Medical information” is defined as 20 “any individually identifiable information, in electronic or physical form, in possession of or 21 derived from a provider of health care, health care service plan, pharmaceutical company, or 22 contractor regarding a patient’s medical history, mental health application information, 23 reproductive or sexual health application information, mental or physical condition, or treatment.” 24Cal. Civ. Code § 56.05
(i). In the motion, Defendant concedes that whether Plaintiffs qualify as
25
26
1 Generally, the parties are dissuaded from including legal argument in footnotes, because the
Court is under no obligation to consider them. See Indep. Towers of Wash. v. Washington, 350
27 F.3d 925
, 929 (9th Cir. 2003). As the Seventh Circuit observed in its now familiar maxim, “judges
] “patients” or that the information qualifies as “medical information” depends on whether
2 Opencare is a “provider.” (Def.’s Mot. at 15.)
3 Accordingly, the eighth cause of action is dismissed with leave to amend.
4 viii. Violation of the California Customer Records Act
5 The ninth cause of action is for violation of the California Customer Records Act,
6 || California Civil Code § 1798.80, et seq. (FAC 9 284-295.) Plaintiffs explicitly abandoned this
7 || claim in their opposition, so it is dismissed with prejudice. (See Pls.” Opp’n at 9 n. 6.)
8 IV. CONCLUSION
9 For the reasons set forth above, Defendant’s motion to dismiss is GRANTED IN PART
10 AND DENIED IN PART. Specifically, the fourth, fifth, sixth, seventh, and eighth causes of
1] action are dismissed with leave to amend, while the ninth cause of action is dismissed without
12 || leave to amend. The motion is denied in all other respects, but Plaintiffs are GRANTED leave to
13 amend to separately allege invasion of privacy under common law and the California Constitution.
14 || IfPlaintiffs cannot in good faith allege sufficient facts to satisfy all of the elements of the
3 15 dismissed claims, they are encouraged to forego amendment of those claims.
a 16 Plaintiffs shall file a second amended class action complaint within 21 days of this order.
17 IT IS SO ORDERED.
18 || Dated: August 31, 2026
20 Unitéd States Magistrate Judge
21
22
23
24
25
26
27
28