Winston Smith v. Facebook, Inc.

FILED NOT FOR PUBLICATION DEC 06 2018 UNITED STATES COURT OF APPEALS MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS

FOR THE NINTH CIRCUIT

WINSTON SMITH; et al., No. 17-16206

Plaintiffs-Appellants, D.C. No. 5:16-cv-01282-EJD

v. MEMORANDUM* FACEBOOK, INC.,

Defendant-Appellee, and

AMERICAN CANCER SOCIETY, INC.; et al.,

Defendants.

Appeal from the United States District Court for the Northern District of California Edward J. Davila, District Judge, Presiding

Argued and Submitted October 16, 2018 San Francisco, California

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3.

Before: THOMAS, Chief Judge, GRABER, Circuit Judge, and LASNIK,** District Judge.

Plaintiffs, Winston Smith and two Jane Does, appeal the district court’s dismissal of their complaint alleging that Facebook violated numerous federal and state laws by collecting and using their browsing data from various healthcare-related websites. We have jurisdiction pursuant to 28 U.S.C. § 1291, and we review the district court’s dismissal de novo. Arakaki v. Lingle, 477 F.3d 1048, 1056 (9th Cir. 2007). We affirm.

I

The district court properly held that Plaintiffs consented to Facebook’s data tracking and collection practices. In determining consent, courts consider whether the circumstances, considered as a whole, demonstrate that a reasonable person understood that an action would be carried out so that their acquiescence demonstrates knowing authorization. Plaintiffs do not dispute that their acceptance of Facebook’s Terms and Policies “constitutes a valid contract.” Those Terms and Policies contain numerous disclosures related to information collection on third-party websites, including: “We collect information when you visit or use third-party websites and apps that use our Services . . . . This includes information about

** The Honorable Robert S. Lasnik, United States District Judge for the Western District of Washington, sitting by designation.

the websites and apps you visit, your use of our Services on those websites and apps, as well as information the developer or publisher of the app or website provides to you or us,” and “we use all of the information we have about you to show you relevant ads.” A reasonable person viewing those disclosures would understand that Facebook maintains the practices of (a) collecting its users’ data from third-party sites and (b) later using the data for advertising purposes. Knowing authorization of the practice constitutes Plaintiffs’ consent. United States v. Staves, 383 F.3d 977, 981 (9th Cir. 2004) (noting that consent, though generally express, may be implied where there are surrounding circumstances indicating that an individual knowingly agreed to an action).

Plaintiffs claim that—though they gave general consent to Facebook’s data tracking and collection practices—they did not consent to the collection of health-related data due to its “qualitatively different” and “sensitive” nature. We do not agree that the collected data is so different or sensitive. The data show only that Plaintiffs searched and viewed publicly available health information that cannot, in and of itself, reveal details of an individual’s health status or medical history. Moreover, many other kinds of information are equally sensitive. We conclude that the practice complained of falls within the scope of Plaintiffs’ consent to Facebook’s Terms and Policies.

Finally, Plaintiffs assert that Facebook could not have gained consent because the healthcare websites’ privacy policies promised not to share data with third parties. But Facebook’s Terms and Policies make no such assurance, and Facebook is not bound by promises it did not make. Therefore, we affirm the district court’s finding that Plaintiffs consented to Facebook’s data tracking and collection practices.

II

The district court also properly rejected Plaintiffs’ claims that the collected data is subject to more stringent disclosure requirements under the Health Information Portability and Accountability Act of 1996 (“HIPAA”) (codified as amended in scattered sections of 42 U.S.C.) and California Civil Code section 1798.91 (2014). Information available on publicly accessible websites stands in stark contrast to the personally identifiable patient records and medical histories protected by these statutes—information that unequivocally provides a window into an individual’s personal medical history. See, e.g., United States v. Huping Zhou, 678 F.3d 1110, 1112 (9th Cir. 2012) (protecting disclosure of a hospital’s patient records under HIPAA). Put simply, the connection between a person’s browsing history and his or her own state of health is too tenuous to support *5 Plaintiffs’ contention that the disclosure requirements of HIPAA or section 1798.91 apply.

III

In sum, the district court properly dismissed the complaint. Given our resolution of these issues, we need not reach any other issues urged by the parties.

AFFIRMED.