LinkedIn can't dodge claims it tracked users' medical data

(CN) — A federal judge on Friday rejected attempts by LinkedIn and other tech companies to toss out the bulk of consumer privacy claims asserting the companies secretly tracked users’ sensitive medical information across healthcare websites without their knowledge or consent.

Senior U.S. District Judge Edward Davila ruled that it is plausible that consumers had no idea how much of their private medical data was being collected by LinkedIn’s tracking software and that the company’s data practices could constitute a “highly offensive” intrusion into their privacy.

“Given the nature of LinkedIn’s alleged conduct and the sensitivity of the information shared here, the court finds this issue is inappropriate to resolve at the pleadings stage,” Davila wrote.

Davila, a Barack Obama appointee, permitted key privacy claims to proceed, particularly those asserting eavesdropping and constitutional privacy violations.

He found that the named plaintiffs, four LinkedIn users, sufficiently stated they had a reasonable expectation of privacy in their communications with health care providers and that LinkedIn’s conduct could be considered highly offensive.

He said that exchanges between patients and health care providers deserve heightened privacy protection compared to typical online interactions.

“Communications made in the context of a patient–medical provider relationship are readily distinguishable from online communications in general,” he wrote.

The decision allows the core class action claims to move forward in four consolidated lawsuits targeting LinkedIn’s Insight Tag, a tracking pixel the professional networking site provides to advertisers. Davila dismissed some individual claims and severed others for separate proceedings.

The plaintiffs claim that LinkedIn’s Insight Tag — a piece of JavaScript code embedded on third-party websites — collected sensitive health information from users visiting health care providers’ sites, including ReflexMD, CityMD, Headway and Spring Fertility.

They claim the tracking software captured details about medical conditions, treatments sought and other personal health data to fuel LinkedIn’s advertising analytics, all without users’ meaningful consent.

The four LinkedIn users brought the lawsuits in the Northern District of California as putative class actions, claiming violations of the California Invasion of Privacy Act and the California Constitution’s privacy protections. LinkedIn, along with co-defendants Spring Fertility and Meta Platforms, moved to dismiss the claims.

However, Davila did dismiss wiretapping claims under a different provision of California’s privacy law, ruling that the plaintiffs failed to adequately show that LinkedIn intercepted their communications “in transit” or actively read them. He granted plaintiffs leave to amend those claims.

“Plaintiffs must plead additional facts to support the inference that LinkedIn specifically read, attempted to read, or learned the contents of Plaintiffs’ communications when using such information to fuel their advertising analytics,” he wrote.

The judge also granted Meta’s motion to sever claims against the social media company and consolidate them with ongoing litigation over Meta’s own tracking pixel. That case involves similar claims about Meta’s data collection practices on health care websites.

He also dismissed claims against Spring Fertility after finding that the health care provider’s cookie banner provided adequate notice of its data collection practices.

“The visual placement of the Cookie Banner here could provide sufficient notice of the Cookies Policy and Privacy Notice for several reasons,” Davila wrote.

The cases could set important precedents for how California’s privacy laws apply to tracking technologies used across the internet. California has some of the nation’s strongest privacy protections, and judicial interpretations of those laws frequently influence privacy practices nationwide.

LinkedIn, Meta and representatives for the plaintiffs could not immediately be reached for comment.

Follow @JeremyYurow