IN RE: Blue Shield of California Privacy Litigation (2026)

ORDER GRANTING MOTION TO DISMISS WITHOUT PREJUDICE

Pending before the Court is defendant California Physicians' Service d/b/a Blue Shield of California's (“Blue Shield”) motion to dismiss plaintiffs' consolidated class action complaint for lack of subject-matter jurisdiction under Rule 12(b)(1) and failure to state a claim under Rule 12(b)(6). The Court held a hearing on May 5, 2026.

Having carefully considered the papers submitted and the pleadings in this action, and for the reasons set forth below and more fully on the record on May 5, 2026, the motion is GRANTED WITHOUT PREJUDICE. In short, although plaintiffs have sufficiently alleged standing, they have failed to state a claim against Blue Shield because they have not alleged sufficient facts to support a cognizable theory of liability under the Wiretap Act.

I. BACKGROUND

The Court consolidated nineteen related cases under this action on June 3, 2025 (Dkt. No. 32) and appointed co-lead counsel on August 6, 2025 (Dkt. No. 72). Plaintiffs Austin Kahn, Rachel Markovitz, and Susan Reiman filed a consolidated class action complaint on September 29, 2025, alleging a single claim for a violation of the Federal Wiretap Act, 18 U.S.C. Section 2510, et seq. (Dkt. No. 102 (“Compl.”).)

The consolidated class action complaint alleges as follows:

Defendant Blue Shield is a “health plan organization” that provides California consumers with “health care service plans.” (Id. ¶ 13.) Plaintiffs Kahn, Markovitz, and Reiman are current or former enrollees of, and received medical care covered by, Blue Shield. (Id. ¶¶ 123, 138, 153.) Plaintiffs logged into and used Blue Shield's website to “locate or contact doctors, find clinical locations, or search for information on various treatments,” among other uses. (Id. ¶ 4.) Blue Shield intentionally installed Google Analytics and Meta Pixel on its website, tracking tools that “enabled Google and Meta to intercept the contents of Plaintiffs' and Class members' highly sensitive, health-related electronic communications for use in targeted advertising without their consent.” (Id. ¶¶ 7, 192.) This information included “intimate and sensitive health data” collected when plaintiffs used the website to “to register for an account, find a doctor, use telehealth services, search the prior authorization list, complete online forms, make payments, review billing statements or claim summaries, and search for member discounts, among other uses.” (Id. ¶¶ 126-28, 141–43, 156–58.) The tools collected this information “alongside [each plaintiff's] device information, IP address, User Agent, and personal cookies, ․ and additional personal identifiers, which revealed to those third parties [his/her] real-world identity.” (Id. ¶¶ 130, 145, 160.) Plaintiffs thereafter saw and were “subjected to ․ targeted ads associated with the treatments, conditions, and services they shared and searched for on Blue Shield's website.” (Id. ¶ 61.)

Plaintiffs sued on behalf of themselves and a putative class of Blue Shield's enrollees who, during 2012 to 2025, “had their [personally identifying information (“PII”)] and/or [protected health information (“PHI”)] disclosed to Google and/or Meta via the Blue Shield website.” (Id. ¶¶ 168–72.) Defendant filed the instant motion to dismiss on November 17, 2025 on the grounds that plaintiffs lack Article III standing and have failed to state a claim under the Wiretap Act. (Dkt. No. 110 (“Mtn.”).)

II. LEGAL FRAMEWORK

A. RULE 12(b)(1)

Federal Rule of Civil Procedure 12(b)(1) requires dismissal when plaintiffs fail to meet their burden of establishing subject matter jurisdiction. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). “The Article III case or controversy requirement limits federal courts' subject matter jurisdiction by requiring, inter alia, that plaintiffs have standing” to pursue their claim. Id. at 1121. In evaluating a motion to dismiss for lack of standing based on the sufficiency of allegations, “a district court must accept as true all material allegations in the complaint, and must construe the complaint in the nonmovant's favor.” Id. (citing Bernhardt v. Cnty. of Los Angeles, 279 F.3d 862, 867 (9th Cir. 2002)).

B. RULE 12(b)(6)

Under Federal Rule of Civil Procedure 12(b)(6), a party may challenge the sufficiency of allegations in the complaint to state a claim for relief. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). In evaluating a motion to dismiss for failure to state a claim, a court accepts factual allegations as true and construes them in the light most favorable to the plaintiff. Interpipe Contracting, Inc. v. Becerra, 898 F.3d 879, 886-87 (9th Cir. 2018). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible on its face “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Dismissal is appropriate “where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory.” Interpipe Contracting, Inc., 898 F.3d at 886.

If granting a motion to dismiss, the court must decide whether to grant leave to amend. The Ninth Circuit has a liberal policy favoring amendments. United States v. Corinthian Colleges, 655 F.3d 984, 995 (9th Cir. 2011). “Dismissal without leave to amend is improper unless it is clear ․ that the complaint could not be saved by any amendment.” Thinket Ink Info. Res., Inc. v. Sun Microsystems, Inc., 368 F.3d 1053, 1061 (9th Cir. 2004).

C. THE WIRETAP ACT

The Wiretap Act, as amended by the Electronic Communications Privacy Act (“ECPA”), authorizes criminal punishment against “any person who” falls within the purview of five categories set forth in subsections (1)(a) through (e) of Title 18, Section 2511 of the United States Code. Section 2520 provides a private right of action for “any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter.” Id. § 2520(a). Relevant here, plaintiffs bring suit for violations of subsections (1)(a) (interception), (1)(c) (disclosure), and (1)(d) (use) of Section 2511, which apply to “any person who”:

(a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; ․

(c) intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection;

(d) intentionally uses, or endeavors to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection[.]

18 U.S.C. § 2511(1)(a), (c)–(d).

III. ANALYSIS

A. ARTICLE III STANDING

Blue Shield moves to dismiss the complaint under Rule 12(b)(1) on the grounds that plaintiffs lack Article III standing.

To establish Article III standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). Defendant does not dispute the second and third elements. Rather, defendant challenges standing only on the grounds that plaintiffs have failed to allege a concrete injury in fact.

An injury is concrete if the asserted harm bears a “close relationship to a harm traditionally recognized as providing a basis for a lawsuit” including, for example, “disclosure of private information[ ] and intrusion upon seclusion.” Id. at 424–425 (internal quotation marks omitted). The Ninth Circuit has explained that this inquiry be “particularized to a plaintiff's circumstances and benchmarked to a specific tort.” Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025). Though an “exact duplicate” is not required (TransUnion, 594 U.S. at 433), courts “look to the specific underlying harm experienced by the plaintiff and compare it, in detail, to a specific common-law tort.” Popa, 153 F.4th at 791 (emphasis in original).

Here, the parties dispute whether plaintiffs have sufficiently alleged harm that is traditionally recognized as providing a basis for suit. Defendant argues that the “alleged collection and limited disclosure of the non-sensitive information in this case cannot give rise to an injury analogous to those redressed by” the torts of “intrusion upon seclusion and public disclosure of private facts” on two grounds. (Mtn. at 14–15.) First, plaintiffs do not allege that their information was collected or disclosed in a “highly offensive” manner. Second, plaintiffs cannot rely on allegations of what Google Analytics and the Meta Pixel “may be capable” of collecting to establish harm. Both arguments are unavailing.

1. Highly Offensive Invasion of Privacy

Defendant argues that plaintiffs' alleged injuries cannot give rise to a harm analogous to a harm redressable under common law because the information allegedly collected and disclosed was “non-sensitive,” so its collection and disclosure was not “highly offensive.” (Mtn. at 14–15.)

To show intrusion upon seclusion, a plaintiff must show an “intentional interference with his interest in solitude or seclusion ․ of a kind that would be highly offensive to a reasonable [person].” Popa, 153 F.4th at 791 (quoting Restatement (Second) of Torts § 652B cmt. a (1977)) (emphasis in original). Similarly, a claim for public disclosure of private facts requires showing that a defendant “gives publicity” to information regarding “the private life of another” that is not of legitimate public concern and “highly offensive to a reasonable person.” Id. (quoting Restatement (Second) of Torts § 652D) (emphasis in original). Thus, for plaintiffs' alleged injuries to give rise to the kind of harm redressable under either tort, the information at issue must have been collected or disclosed in a manner that is highly offensive to a reasonable person.

Disclosure of an individual's medical information “is more likely to constitute an egregious breach of the social norms that is highly offensive.” See In re Ambry Genetics Data Breach Litig., 567 F.Supp.3d 1130, 1143 (C.D. Cal. 2021) (internal quotation marks omitted); Popa, 153 F.4th at 791 (acknowledging that tracking software could “be offensive in particular circumstances,” such as when “sensitive medical” information is involved). Moreover, “information [that] relates specifically to [p]laintiffs' health” is generally protected under federal and California law. See Smith v. Facebook, Inc., 262 F.Supp.3d 943, 954–55 (N.D. Cal. 2017), aff'd, 745 F.App'x 8 (9th Cir. 2018) (distinguishing health information attributable to a plaintiff from general health information viewable by the public); see also Maghoney v. Dotdash Media, Inc., 2026 WL 497402 (S.D. Cal. Feb. 23, 2026) (data showing that plaintiff “searched and viewed publicly available health information ․ cannot, in and of itself, reveal details of an individual's health status or medical history”) (quoting Smith, 745 F.App'x at 9).¹ “Whatever information users[ ] input into [a healthcare-related] website is likely more sensitive than” searches or browsing on websites not related to healthcare. Gabrielli v. Haleon US Inc., 815 F. Supp. 3d 852, 867 (N.D. Cal. 2025); see In re Google RTB Consumer Priv. Litig., 606 F.Supp.3d 935, 947 (N.D. Cal. 2022) (information such as “sensitive websites that plaintiffs visited relating to ․ health” is “personal information under California law and parties generally maintain a reasonable expectation [of privacy] in their personal information”).

Here, plaintiffs' complaint contains numerous relevant allegations, namely that:

(i) “By installing Google Analytics and the Meta Pixel on its website, Blue Shield knowingly shared massive amounts of Blue Shield enrollees' ․ protected and strictly confidential communications, PII, and PHI with Google and Meta.” (Compl. ¶ 3.)

(ii) Plaintiffs “provided and communicated [their] ․ intimate and sensitive health data” to Blue Shield's website, including information regarding their health conditions, referrals, and plans. (Id. ¶¶ 126–28, 141–43, 156–58.)

(iii) The tracking tools on Blue Shield's website collected health information alongside plaintiffs' “personal identifiers,” such as their “device information, IP address, User Agent, and personal cookies.” (Id. ¶¶ 130, 145, 160.)

(iv) Google and Meta were “able to connect and associate” the “PII and PHI embedded in [plaintiffs'] communications” with plaintiffs' personal information, which “revealed to those third parties [each plaintiff's] real-world identity” and enabled them to “track and profile” each plaintiff for targeted advertising. (Id. ¶¶ 130, 134, 145, 149, 160, 164.)

Based on the foregoing, plaintiffs have sufficiently alleged that Blue Shield's website collected and disclosed their personal health information. Accepting their allegations as true and construing them in the light most favorable to plaintiffs, the Court finds that the sensitive nature of this information renders its alleged collection and disclosure highly offensive to a reasonable person.

Defendant's cited authorities do not persuade otherwise. In Popa, for example, the plaintiff alleged that defendant's website captured her browsing activity on pet supplies, which “reveal[ed] nothing more than the products that interested [plaintiff] and thus is not the type of private information that the law has historically protected.” 153 F.4th at 787. Likewise, in Maghoney, although plaintiff browsed and searched health-related topics, the complaint failed to allege how that information was attributable or “tied to [plaintiff's] personal medical history.” 2026 WL 497402, at *5; see also, Byars v. Sterling Jewelers, Inc., 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023) (no standing because the plaintiff did “not allege that she disclosed any sensitive information to Defendant, much less identify any specific personal information she disclosed that implicates a protectable privacy interest”); Khamooshi v. Politico LLC, 786 F.Supp.3d 1174, 1180 (N.D. Cal. 2025) (information at issue was “associated with a device,” like an IP address, “not sensitive personal information”); Rodriguez v. Culligan International Company, 2025 WL 3064113, at *4 (S.D. Cal. Nov. 3, 2025) (same). In contrast, plaintiffs here allege that their healthcare-related communications were “connect[ed] and associate[d]” with their “real-world identit[ies].” (Compl. ¶¶ 130, 134, 145, 149, 160, 164.) Accordingly, plaintiffs have identified the “specific personal information” at issue “that implicates a protectable privacy interest.” Mikulsky v. Noom, Inc., 682 F.Supp.3d 855, 864 (S.D. Cal. 2023) (quoting Byars, 2023 WL 2996686, at *3).

2. Capable of Collecting Versus Actually Collected

Next, defendant argues that plaintiffs may not rely on allegations regarding what Google Analytics and Meta Pixel “may be capable” of collecting, as opposed to what they “actually collected,” to establish concrete injury. (Mtn. at 16.)

Courts have held that there is no standing where plaintiffs merely allege their information “could be captured” by tracking tools. See, e.g., Hughes v. Vivint, Inc., 2024 WL 5179916, at *4 (C.D. Cal. July 12, 2024), adopted, 2024 WL 5179917 (C.D. Cal. Aug. 5, 2024). Aside from alleging that tools are capable of collecting personal data, a plaintiff must allege those tools actually “collected his data” to establish standing. Greenley v. Kochava, Inc., 684 F.Supp.3d 1024, 1038 (S.D. Cal. 2023) (emphasis in original).

To satisfy this requirement, plaintiffs allege that they each “logged in and used Blue Shield's website” when it was embedded with the tracking tools. (See Compl. ¶¶ 124, 139, 154.) Those tools then allegedly “locked onto the visitors, tracked their activities, and intercepted their communications in transit on the site.” (Id. ¶¶ 4, 126–30, 141–45, 156–60.) The tools collected each plaintiff's “personal identifiers,” such as “device information, IP address, User Agent, and personal cookies,” as well as the “PII and PHI embedded in [their] communications.” (Id. ¶¶ 130, 134, 145, 149, 160, 164.) By pairing both sets of information, the tools allegedly intercepted “individually identifiable health information.” (Id. ¶ 197.)

Construing the complaint as a whole in the light most favorable to plaintiffs, the Court can reasonably infer that the code on Blue Shield's website actually collected and disclosed each plaintiff's sensitive health information. Compare Greenley, 684 F.Supp.3d at 1038 (the court could reasonably infer plaintiff's data was actually collected where plaintiff alleged he used a device embedded with the tracking technology at issue), with De Ayora v. Inspire Brands, Inc., 2025 WL 3707561, at *1 (N.D. Cal. December 22, 2025) (no standing because, inter alia, “no named plaintiff alleges ever visiting [defendant's] website”).

Plaintiffs' allegation that they received targeted advertising “associated with the treatments, conditions, and services they shared and searched for on Blue Shield's website” further supports this inference. (See Compl. ¶ 61.) Compare Gaige v. Exer Holding Co., 2025 WL 559719, at *2 (C.D. Cal. Mar. 2, 2025) (finding standing where plaintiff received targeted advertisements related to his searches regarding health conditions on defendant's website), with Maghoney, 2026 WL 497402, at *5 (finding no concrete injury, in part, because plaintiff failed to allege how he “became aware of the sharing of this information,” that “anyone directly contacted him related to his searches,” or “that his searches were made publicly visible”).

Because plaintiffs have adequately alleged that their sensitive information was actually captured and disclosed in a manner that would be highly offensive to a reasonable person, plaintiffs have sufficiently alleged an injury analogous to the type of harm redressable by common-law privacy torts. Accordingly, plaintiffs have alleged a concrete injury sufficient to satisfy Article III standing, and the motion on this ground is denied.

B. FAILURE TO STATE A CLAIM

Next, the Court considers whether plaintiffs have sufficiently alleged a claim under the Wiretap Act.

The Wiretap Act generally prohibits the nonconsensual interception of wire, oral, and electronic communications as well as the disclosure or use of intercepted communications while “knowing or having reason to know that the information was obtained” through interception. See 18 U.S.C. § 2511(1)(a) (interception), 2511(1)(c) (disclosure), 2511(1)(d) (use). The statute defines “intercept” as the “aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” Id. § 2510(4). It defines “contents” as “any information concerning the substance, purport, or meaning of that communication.” Id. § 2510(8). The statute only provides a private right of action against “any person or entity” who “intercepted, disclosed, or intentionally used” any person's “wire, oral, or electronic communication” in violation of the Act. Id. § 2520(a).

Blue Shield argues that plaintiffs have failed to state a Wiretap Act claim because they have failed to allege:

(i) unlawful interception by Blue Shield itself, since Blue Shield is a party to the communications and the crime-tort exception does not apply;

(ii) contemporaneous interception;

(iii) a cognizable legal theory because plaintiffs do not allege interception by Blue Shield and the Act does not provide a private right of action for procurement or aiding and abetting another to intercept; and

(iv) any plausible interception or disclosure of the “contents” of communications.

The Court addresses the third issue first because it is dispositive of plaintiffs' claim.

1. No Cognizable Legal Theory

Defendant argues that plaintiffs have failed to state a claim under the Wiretap Act because (1) plaintiffs have not alleged that Blue Shield itself intercepted the contents of communications and (2) there is no private right of action based on procurement of third parties to intercept or aiding and abetting interception. Plaintiffs disagree and urge that even if their claim fails under subsection (1)(a) of Section 2511 (interception), their claim nonetheless survives under subsections (1)(c) (disclosure) and (1)(d) (use).

With respect to defendant's first argument, all acts of interception described in the complaint are by non-parties Google and Meta. (See, e.g., Compl. ¶¶ 4, 7, 26, 122, 176.) Plaintiffs allege that Blue Shield merely “enabled,” “facilitate[d],” and thus “procured” Google and Meta to intercept. (Id. ¶¶ 192, 194, 198.) Taken together, these allegations do not allow for a plausible inference that Blue Shield itself engaged in any interception. At the hearing, plaintiffs effectively conceded that they have not alleged interception by Blue Shield:

THE COURT: But then you said that the information was intercepted by Google and Meta. You didn't say it was intercepted by Blue Shield.

MS. SCHUBERT: You know, I think we allege in the complaint that they procured them to do the interception. But our position is that it's not necessary for Blue Shield itself to have intercepted it. It was sufficient for them to place the code on their website, which enabled the interception.

(Dkt. No. 132, Transcript of Proceedings on May 5, 2026 (“Hearing Tr.”) at 13:14–21.)

Plaintiff's procurement-based theory of liability is not cognizable. By way of background, prior to 1986, Section 2520 provided standing to sue another who “procure[d] any other person to intercept, disclose, or use [the] communications” at issue, but Congress eliminated that phrase. See Peavy v. WFAA-TV, Inc., 221 F.3d 158, 168 (5th Cir. 2000). In light of the statutory amendment, courts have read Sections 2520 and 2511 together to provide a private right of action only against defendants who intercept communications or disclose or use communications while knowing the communications were obtained through interception—not against those who merely procure or aid and abet another to intercept. Id. at 169 (private right of action under Section 2520 extends “only to illegal interception, disclosure, or use, and not to procuring interception by another”) (emphasis in original). Although the Ninth Circuit has not ruled on this issue, judges in this district have routinely found that defendants cannot be civilly liable for procuring or aiding and abetting interceptions by third parties. See In re Carrier IQ, Inc., 78 F.Supp.3d 1051, 1089 (N.D. Cal. 2015) (“[T]here is simply no secondary liability (such as aiding and abetting) under the ECPA”); Smith v. Rack Room Shoes, Inc., 2025 WL 1085169, at *7 (N.D. Cal. Apr. 4, 2025) (Section 2520 does not provide for a private right of action based on procuring others to intercept); In re Toys R Us, Inc. Priv. Litig., 2001 WL 34517252, at *6–7 (N.D. Cal. Oct. 9, 2001) (same). Further, there is no civil liability against a party “who merely provided a means through which a third party subsequently intercepts communications.” In re Carrier IQ, Inc., 78 F.Supp.3d at 1088.

Plaintiffs urge the Court to hold otherwise, but their authorities do not support their argument. Rather, their cited cases merely recite Section 2511(1)(a)—none address procurement-based liability under the statute. See Campbell v. Facebook, Inc., 951 F.3d 1106, 1117 (9th Cir. 2020); Brown v. Google LLC, 685 F. Supp. 3d 909, 933 (N.D. Cal. 2023).

This Court is therefore “in agreement with the majority of courts that have found that defendants cannot be liable under Section 2520 for ‘procuring’ an interception.” Rack Room, 2025 WL 1085169, at *7. Because plaintiffs have failed to allege that Blue Shield itself intercepted any communications and because procurement-based liability is unavailable in a private suit, plaintiffs have failed to plausibly allege a violation of subsection (1)(a).

This leaves subsections (1)(c) and (1)(d). At the hearing, plaintiffs argued that they are “not relying on [subsection (1)(a)] to survive” because “this claim survives, very clearly, under (c) and (d) based on the extensive allegations ․ in [their] complaint.” (Hearing Tr. at 22: 21–24.) However, plaintiffs dedicate just a single sentence of their opposition brief to explain these theories and therein cite only three paragraphs of their complaint addressing illegal disclosure and use. (See Dkt. No. 119 at 20 (“Plaintiffs also allege that Blue Shield violated the Act because it subsequently ‘disclosed the contents of communications to Google and Meta without Plaintiffs' and Class members' authorization’ and ‘use[d] enrollees' PII and PHI for targeted advertising campaigns via Google Ads and on Facebook and Instagram’ in violation of 18 U.S.C. § 2511(1)(c)-(d). [Compl.] ¶¶ 185, 208, 211[.]”).)

Upon further review, the cited paragraphs fail to plausibly allege a violation under either theory. Plaintiffs have failed to allege a disclosure-based violation—i.e., that Blue Shield “intentionally disclose[d], or endeavor[ed] to disclose, to [Google or Meta] the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication”—because they have not alleged that Blue Shield obtained any information by interception in the first place. See § 2511(1)(c). Likewise, plaintiffs have failed to allege a use-based violation—i.e., that Blue Shield “intentionally use[d], or endeavor[ed] to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication”—because they have not adequately alleged that Blue Shield, as opposed to Google or Meta, performed an illegal use. See § 2511(1)(d). To the extent plaintiffs maintain that targeted advertising was the illegal use, their complaint is vague as to which entity delivered the targeted ads and, in some instances, suggests that Google and Meta delivered them, not Blue Shield. (See, e.g., Compl. ¶¶ 4 (“The communications collected by Google Analytics and the Meta Pixel were automatically transmitted to Google and Meta, respectively, where they were packaged to provide detailed insights on each individual enrollee's activities on Blue Shield's website and for use in personalized advertisements, among other things.”), 7 (“Blue Shield enabled Google and Meta to intercept the contents of Plaintiffs' and Class members' highly sensitive, health-related electronic communications for use in targeted advertising[.]”), 28 (alleging Blue Shield admitted that “Google used this information to conduct focused ad campaigns back to those individual enrollees”), 62 (describing “targeted advertising campaigns on Facebook and Instagram.”), 73 (“Meta can use this intercepted information to profile users and deliver targeted advertisements to them[.]”).)

Even read in the light most favorable to plaintiffs, these allegations do not allow the Court to draw a reasonable inference that Blue Shield engaged in an illegal use of intercepted communications. Plaintiffs' conclusory allegation that “Blue Shield was able to use enrollees' PII and PHI for targeted advertising campaigns” (Compl. ¶ 211) does not provide a sufficient factual basis for pleading this theory of liability against Blue Shield.

Accordingly, because plaintiffs have failed to allege a cognizable violation of the Wiretap Act by Blue Shield, the motion to dismiss is GRANTED on this ground. The Court briefly addresses remaining issues below.

2. Party Exception and Crime-Tort Exception

Defendant argues that plaintiffs have not pled any unlawful interception by defendant because defendant is a party to the communication and the crime-tort exception does not apply, citing Section 2511(2)(d).

Section 2511(2)(d) provides:

It shall not be unlawful for a person ․ to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.

18 U.S.C. § 2511(2)(d) (emphasis supplied).

Here, plaintiffs have not alleged that Blue Shield itself intercepted any communications, as explained supra. In one instance, plaintiffs allege that Blue Shield is not immune from liability because “its interception” was for a criminal or tortious purpose. (Compl. ¶ 205.) However, this single characterization of Blue Shield as an interceptor is unsupported by any other factual allegations and therefore is insufficient to provide a factual foundation for this otherwise bald conclusion.

Accordingly, plaintiffs have not alleged a factual basis for applying Section 2511(2)(d) to their claim against Blue Shield. See Rack Room, 2025 WL 1085169, at *7 (finding that plaintiffs failed “to allege that the crime-tort exception applies” because they “have not alleged that [defendant] ‘intercepted’ their communications”).

3. Contemporaneous Interception

Defendant briefly argues that plaintiffs have not sufficiently alleged contemporaneous interception of the contents of plaintiffs' communications while in transit.

For a communication to be “intercepted” in violation of the Wiretap Act, “it must be acquired during transmission, not while it is in electronic storage.” Hazel v. Prudential Fin., Inc., 2023 WL 3933073, at *2 (N.D. Cal. June 9, 2023) (quoting Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002)). Thus, “a qualifying ‘intercept’ under the [Wiretap Act] ․ can only occur where an [electronic] communication is accessed at some point between the time the communication is sent and the time it is received by the destination server.” NovelPoster v. Javitch Canfield Grp., 140 F.Supp.3d 938, 952 (N.D. Cal. 2014) (quoting another case).

The Court need not resolve this issue because, as explained supra, plaintiffs have failed to allege an actionable violation of the Wiretap Act by Blue Shield. Thus, the question of whether plaintiffs adequately alleged that Google or Meta contemporaneously intercepted plaintiffs' communications is irrelevant.

4. Contents of Communications

Lastly, defendant argues that plaintiffs have failed to allege that the “contents” of any communications were intercepted or disclosed.

The Wiretap Act defines “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral communication,” whereby “contents” are “any information concerning the substance, purport, or meaning of that communication.” 18 U.S.C. § 2510(4), (8). Accordingly, actionable interception, disclosure, or use of communications under the Act must involve “the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014).

The Court need not resolve this issue because, as explained supra, Blue Shield cannot be liable for procuring third parties to intercept and plaintiffs have not plausibly alleged that defendant intercepted, disclosed, or used any information in violation of the Act. The question of whether plaintiffs have adequately alleged that Google or Meta intercepted “contents” and whether Blue Shield disclosed or used “contents” is therefore not dispositive.

IV. CONCLUSION

For the foregoing reasons, the Court GRANTS the motion to dismiss for failure to state a claim.

Given the Ninth Circuit's liberal policy favoring leave to amend, plaintiffs' request for leave to amend is GRANTED. Plaintiffs may amend their complaint to plead a legally cognizable violation of the Wiretap Act in accordance with this order. Plaintiffs shall file an amended complaint within twenty-one (21) days of the date of this order and in compliance with the Court's Standing Order, paragraph 13. Defendant shall respond within fourteen (14) days thereafter. Parties shall not renew arguments already made and resolved in this order, nor may defendant assert new arguments that could have been asserted in the first instance.

This Order terminates Dkt. Nos. 110, 124.

IT IS SO ORDERED.

FOOTNOTES

1.   The Court GRANTS defendant's administrative motion for leave to submit a statement of recent decision regarding Maghoney (Dkt. No. 124), to which plaintiffs filed a statement of non-opposition (Dkt. No. 125).

YVONNE GONZALEZ ROGERS CHIEF UNITED STATES DISTRICT JUDGE