Federal judge says class privacy claims may proceed against online mental health platform

SAN FRANCISCO (CN) — Class action claims brought by consumers who say online mental health platform Headway allowed Google to collect their personal data without permission may proceed, a federal judge in California ruled Monday.

Headway is an online service that helps people find mental health care providers who accept insurance.

In a 2023 complaint, the lead plaintiff, identified only as M.G., claims that his and other Headway users’ medical concerns and conditions, their preferences regarding the gender and ethnic preferences of providers, the kind of treatment they sought, and the dates and locations of their medical appointments were shared with Google without their permission, because Headway embeds Google Analytics code into its website.

“Through that embedded tracking technology, while plaintiff and class members were and are interacting with the Headway website, Google, in real time, is able to and does intercept, eavesdrop upon, and collect Headway website users’ sensitive information, including their protected mental health information,” the plaintiffs say in the complaint.

The class claims the company violated the California Invasion of Privacy Act by aiding and abetting Google’s collection of their information through a wiretap.

Headway said that no substantive patient information was submitted to Google, and wiretapping claims could not stick, because there were two separate communications occurring — one between the user’s browser and Headway’s browser, and another through the user’s browser and Google. The company asked the court to dismiss the suit for failure to state a claim.

U.S. District Judge Araceli Martinez-Olguin, a Joe Biden appointee, sided with the plaintiffs Monday, writing in a 15-page order that there was enough on the record at this point to show that Headway used embedded Google analytics on its website without notifying users.

“M.G. alleges that Google simultaneously intercepted class members’ data in real time by using embedded Google Analytics Code. The Court must accept as true M.G.’s allegations that ‘as users navigate the Headway website and platform, Google Analytics, in real-time, surreptitiously is collecting their sensitive information, including patient-clients’ private personal and medical information, without the users’ knowledge or consent.’ Thus, M.G. has alleged real-time interception of users’ information. The case law Headway cites does not persuade otherwise,” Martinez-Olguin wrote.

As for the aiding and abetting claims, Headway argued that the plaintiffs failed to plead sufficient facts to prove it knowingly allowed Google to tap or make unauthorized connections with the lines of Internet communications between the mental health company and the class members.

Martinez-Olguin rejected that argument.

“This misstates M.G.’s allegations, which include that Headway knowingly agreed to use Google Analytics, embedded tracking technology code on its website, and allowed Google to have direct access to Headway users’ private medical information … Headway has failed to show why this is insufficient to state a claim for aiding and abetting," the judge wrote.

Headway also argued that invasion of privacy claims should be dismissed because the data collection practices put forth by the class plaintiffs were “routine commercial behavior,” and thus did not constitute a “serious intrusion of privacy.”

Martinez-Olguin allowed the claims to survive for now, writing that Headway failed to show at this point that the information shared with Google was not a serious breach of privacy.

“Courts have refused to dismiss invasion of privacy claims at the motion to dismiss stage where … a data breach involved medical information, because the disclosure of such information is more likely to constitute an ‘egregious breach of the social norms’ that is ‘highly offensive,’” Martinez-Olguin wrote.

Martinez-Olguin did dismiss some of the plaintiffs’ claims, including those under the Confidentiality of Medical Information Act and the California Consumer Privacy Act. She also ruled that the plaintiffs did not have a right to seek money damages for invasion of privacy claims.

“This case is more than a year old, and the judge’s recent ruling is a substantial victory for Headway. We’re pleased that the judge already dismissed many of the claims. We look forward to making our case in court and resolving this matter as quickly as possible. In an ever-evolving online environment, Headway continues to invest in security and privacy practices,” a spokesperson for Headway said in a statement.

Lawyers for the plaintiffs did not respond to requests for comment.