On October 15, 2025, Judge Charles R. Breyer of the U.S. District Court for the Northern District of California issued a mixed ruling in a putative class action alleging that SkinSpirit Essential LLC, a skincare and dermatology company, used third-party tracking software by Google and LinkedIn on its website to unlawfully disclose users’ private health and appointment information. The court granted in part and denied in part the defendants’ motions to dismiss, allowing a California constitutional privacy claim to proceed while dismissing the federal Electronic Communications Privacy Act (“ECPA”) claim with prejudice and the California Invasion of Privacy Act (“CIPA”) claim with leave to amend.
Background
Plaintiffs alleged that SkinSpirit installed the LinkedIn Insight Tag and Google Analytics on its website, which allowed LinkedIn and Google to intercept users’ personal information—including appointment location, type of procedure, desired provider, date, and time—during the online booking process. Plaintiffs alleged that LinkedIn and Google used probabilistic identity-matching techniques to link the intercepted data to individual users’ real identities, facilitating targeted advertising. Plaintiffs brought three principal claims: (1) violation of the ECPA (both plaintiffs), (2) violation of CIPA (Rusow only), and (3) invasion of privacy under the California Constitution (Rusow only). Two additional corporate defendants—SkinSpirit Holdings, LLC and Dean Vistnes, M.D., Inc.—also moved to dismiss on jurisdictional and pleading grounds.
Key Holdings
Personal Jurisdiction Over SkinSpirit Holdings Dismissed (With Leave to Amend). The court found that SkinSpirit Holdings, a Delaware corporation with its principal place of business in Washington, was not subject to general or specific personal jurisdiction in California. Plaintiffs argued that SkinSpirit Holdings’ inclusion on the website’s Terms of Use established that it controlled the website, but the court held that this inference was insufficient under existing precedent, which holds that corporate entities presenting themselves as one online does not establish that one entity controls the other. The court also denied jurisdictional discovery.
Claims Against the Vistnes Company Dismissed for Group Pleading (With Leave to Amend). The court dismissed all claims against Dean Vistnes, M.D., Inc. because plaintiffs relied on undifferentiated group pleading and failed to plausibly allege how the Vistnes Company was involved with the website at issue.
CIPA Claim Dismissed as Untimely (With Leave to Amend), but Substantively Sufficient. The court found Rusow’s CIPA claim untimely under the one-year statute of limitations because she did not allege when she first saw targeted advertisements—the point at which she would have had inquiry notice—even though she alleged actual discovery of the tracking in November 2024. However, the court made several significant substantive rulings on the CIPA claim that will apply if the statute-of-limitations defect is cured.
First, the court held that LinkedIn’s broadly worded Privacy Policy did not constitute consent to the interception of health data from third-party websites. Following the reasoning of In re Meta Pixel Healthcare Litigation and Doe v. Microsoft Corp., the court declined to read a general third-party tracking consent as extending to health data, emphasizing that a reasonable user of a job-networking site like LinkedIn would have no occasion to believe it would collect health information from a healthcare website.
Second, the court weighed in on a circuit split regarding the intent standard for CIPA aiding liability under Section 631(a). Siding with Tate v. VITAS Healthcare Corp. and similar cases, the court held that Section 631 requires only intentional conduct—that is, knowledge of and intent to aid the underlying interception—not knowledge that the conduct violates the statute. The court reasoned that the Legislature’s use of the phrase “aided, agreed with, employed, or conspired with” in Section 631, as distinguished from the “aid and abet” language used in a neighboring CIPA section, indicates that the common-law aiding-and-abetting standard (which requires knowledge of illegality) does not apply.
California Constitutional Privacy Claim Survives Dismissal. The court denied the motion to dismiss Rusow’s claim under Article I, Section 1 of the California Constitution, finding that she adequately alleged all three required elements.
On the first element—a legally protected privacy interest—the court held that a patient’s desired medical procedure and the underlying reason for the procedure constitute more than merely administrative information and implicate a recognized privacy interest in the confidentiality of medical information.
On the second element—a reasonable expectation of privacy—the court recognized a reasonable expectation of privacy between a patient and her medical provider, even in the online context, and rejected the argument that LinkedIn’s general Privacy Policy eliminated that expectation.
On the third element—a highly offensive invasion—the court found that the disclosure of medical information, as opposed to common digital information such as browsing history, plausibly constituted a serious and egregious breach of social norms at the pleading stage.
ECPA Claim Dismissed With Prejudice. The court dismissed the ECPA claim without leave to amend, concluding that plaintiffs’ own allegations defeated the claim. Under the ECPA, a party to a communication (like SkinSpirit) can only be liable if it intercepted communications “for the purpose of committing any criminal or tortious act”—the so-called crime-tort exception. The court found that plaintiffs themselves alleged SkinSpirit’s purpose was “to monetize that data for targeted advertising,” not to commit any independent criminal or tortious act. The court held this was fatal to the claim, as the alleged tortious conduct was the interception itself, not an independent purpose.
Rusow v. SkinSpirit Essential LLC, No. 24-cv-09317-CRB (N.D. Cal. Oct. 15, 2025).
