Judge Edward J. Davila, in the Northern District of California, grants in part and denies in part a series of motions to dismiss in consolidated privacy class actions involving LinkedIn’s use of the Insight Tag on health-related websites. The cases raise questions about user consent, adequacy of privacy disclosures, intent, and the application of California privacy law to sensitive health data collected via online tracking technologies.
The lawsuits center on LinkedIn’s Insight Tag, a JavaScript-based tracking pixel that allows advertisers to collect data about website visitors and link that data to LinkedIn user profiles. Plaintiffs allege that LinkedIn, and in some cases healthcare providers and other technology companies, collected sensitive health-related information from users interacting with medical service websites, without adequate consent or disclosure.
Severance and Consolidation of Claims
- The court granted Meta’s motion to sever claims against it and consolidate those claims with an existing related action, recognizing substantial factual and legal overlap with ongoing litigation regarding Meta’s tracking technologies.
Consent and Adequacy of Disclosures
- The court found that LinkedIn’s privacy policies and disclosures were sufficiently specific in notifying users that data would be collected from third-party websites via technologies like the Insight Tag.
- However, the court held that, at the pleading stage, it could not determine as a matter of law that users had consented to the collection of sensitive health-related data, given the context and nature of the information at issue.
just because Plaintiffs consented to LinkedIn collecting its data from third-party websites does not give LinkedIn carte blanche to collect any and all data. See In re Google Inc., No. 13-MD-02430-LHK, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013) (“[C]onsent is not an all-or-nothing proposition.”). Even with LinkedIn’s disclosures, Plaintiffs could still have a reasonable expectation of privacy in certain types of data—i.e., medical-related information.
Courts have often found a lack of consent when the type of data collected, though conceivably included in the disclosure, falls outside the plaintiffs’ reasonable expectations. For example, in In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 784–85 (N.D. Cal. 2022), the plaintiffs alleged Facebook’s Meta Pixel transmitted certain personal information to Facebook when they logged into secured patient portals on their medical provider’s websites. The court found that, though Meta’s policies notified users that it collects and uses personal data from third-party websites, it did not specifically indicate that that it may acquire health data obtained from interactions with their medical providers’ websites. Id. at 794; see also In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d 987, 1003–04 (N.D. Cal. 2024) (finding Meta’s disclosure that it collects information about activity on third-party websites did not provide reasonable expectation that Meta would collect sensitive tax information collected from tax preparation websites). On the other hand, collecting information that is only tangentially related to an internet user’s health does not, by itself, exceed their reasonable expectation of privacy. In Smith v. Facebook, Inc., 262 F. Supp. 3d 943, 955 (N.D. Cal. 2017), aff’d 745 F. App’x 8 (9th Cir. 2018), this Court found that data showing the plaintiffs searched and viewed publicly available health information was not “qualitatively different” and “sensitive” just because it was health-related, particularly given that the data did not “reveal details of an individual’s health status or medical history.” See also In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 784–85 (distinguishing Smith).
- In contrast, the court found that Spring Fertility’s website disclosures were sufficiently specific and conspicuous to defeat claims of lack of consent, leading to dismissal of claims against Spring Fertility and LinkedIn in that case.
Reasonably conspicuous notice requires that the notice is “displayed in a font size and format such that the court can fairly assume that a reasonably prudent Internet user would have seen it,” and if there is a hyperlink, the “the fact that a hyperlink is present must be readily apparent.” Berman, 30 F.4th at 857.7 “A web designer must do more than simply underscore the hyperlinked text in order to ensure that it is sufficiently ‘set apart’ from the surrounding text.” Sellers, 289 Cal. Rptr. 3d at 29. Customary design elements denoting the existence of a hyperlink include the use of a contrasting font color (typically blue) and the use of all capital letters, both of which can alert a user that the particular text differs from other plain text in that it provides a clickable pathway to another webpage.” Berman, 30 F.4th at 857. For example, in Berman, the Ninth Circuit found that two lines of small gray font that stated, “I understand and agree to the Terms & Conditions which includes mandatory arbitration and Privacy Policy” failed to put the plaintiff on notice of the arbitration provision in part because the underlined terms “appeared in the same gray font as the rest of the sentence, rather than in blue, the color typically used to signify the presence of a hyperlink.” Berman, 30 F.4th at 856–57. In other cases, courts have found that underlined text is sufficient “when viewed in the context of the overall design and content of the webpage.” Pizarro v. QuinStreet, Inc., No. 22-CV-02803-MMC, 2022 WL 3357838, at *3 (N.D. Cal. Aug. 15, 2022) (finding reasonably conspicuous notice on an underlined hyperlink where (1) the hyperlink appeared “directly below” the action button, (2) the hyperlink was set off by “ample white spacing” and “primarily surrounded by text no larger than the notice itself,” and (3) the “general design of the webpage,” was “relatively uncluttered and ha[d] a muted, and essentially uniform, color scheme”).
*10 The visual placement of the Cookie Banner here could provide sufficient notice of the Cookies Policy and Privacy Notice for several reasons. First, the notice is written in clear font in the middle of the page with a contrasting blue box as a background and no surrounding clutter. The also message clearly informs users in plain language that continued use of the website constitutes acceptance, and though not required, users are notified that they can consent to the policy by clicking a large box with “ACCEPT” written in all caps.8 Finally, the “Cookies Policy” hyperlink is underlined and capitalizes the first letter of each word. In the context of the clean and simple format of the page, the Court finds that a reasonably prudent internet user would see the notice and understand that the continued use of the website constitutes agreement to the Cookies Policy, and that “Cookies Policy” is a hyperlink that ultimately leads to the terms of the Cookies Policy and Privacy Notice. See Ghazizadeh v. Coursera, Inc., 737 F. Supp. 3d 911, (N.D. Cal. June 20, 2024) (collecting cases).
Intent
- Plaintiffs adequately alleged that LinkedIn intentionally collected sensitive data for advertising purposes, despite LinkedIn’s policies prohibiting the collection of sensitive health data. The court found that the question of LinkedIn’s true intent and the effectiveness of its safeguards could not be resolved at the motion to dismiss stage.
Choice of Law
- The court emphasized that plaintiffs must demonstrate sufficient contacts with California to invoke California law in class actions, particularly where named plaintiffs reside outside the state. As applied to one of the actions:
It is also unclear at best that California’s interest in enforcing CIPA would outweigh the interest of other states in enforcing their own privacy laws. The first two prongs of the governmental interest test are met because “[t]here are material differences between CIPA and the wiretapping statutes of the other 49 states.” In re Yahoo Mail Litig., 308 F.R.D. 577, 602 (N.D. Cal. 2015); Doe v. Kaiser Found. Health Plan, Inc., No. 23-CV-02865-EMC, 2024 WL 1589982, at *12 (N.D. Cal. Apr. 11, 2024). But the third prong weighs against applying California law here. As one court in this District has held, “[b]ecause wiretapping statutes are designed to protect the privacy interests of individual members, the residences of the individuals are more important to the respective sovereign than the residence of the alleged wrongdoer.” Kaiser, 2024 WL 1589982, at *13. Plaintiffs here fail to plead that they or any putative class member are a California resident. Accordingly, choice-of-law serves as an independent basis for dismissing Plaintiffs’ CIPA claims in V.R. v. LinkedIn.
Claims Under the California Invasion of Privacy Act (CIPA)
- The court analyzed whether LinkedIn could be considered a third-party “eavesdropper” or merely an extension of the website operator under Section 631. While some courts have found analytics providers to be extensions of the website, the court here found plaintiffs’ allegations sufficient to proceed under the theory that LinkedIn had the capability to use the data for its own purposes.
- However, the court dismissed certain CIPA claims for failure to adequately allege that LinkedIn “read” or intercepted communications “in transit” under Section 631(a), granting leave to amend.
Confidentiality and Use of Software as a “Device”
- The court found that software such as the Insight Tag can constitute a “device” under CIPA Section 632, and that communications in the context of seeking medical services may be considered confidential.
California Constitutional Privacy Claims
- Plaintiffs sufficiently alleged a legally protected privacy interest, a reasonable expectation of privacy, and conduct that could be considered “highly offensive” under the California Constitution, allowing these claims to proceed.
L.B., v. LINKEDIN CORPORATION, (consolidated) No. 5:24-CV-06832-EJD, 2025 WL 2899514 (N.D. Cal. Oct. 10, 2025).
