Unreported / Non-Citable
Background
Plaintiff Judy Oh filed a putative class action against Healthcare, Inc., alleging violations of the California Business & Professions Code, the California Invasion of Privacy Act, and other state laws. The claims arose from a single unsolicited commercial email Oh received on January 13, 2026, with the sender name “Healthcare.com” and subject line “See if you’re eligible for 2025 ACA Plans.” Oh alleged the email used ACA eligibility terminology and third-party tracking infrastructure (including digit-4060.oppsandexecution.com) that transmitted her IP address, browser characteristics, timestamps, and tokenized click URLs. After clicking the link, she was routed through an attribution URL to www.healthcare.com, where Google Analytics and other tracking technology collected identifiers and event data.
Oh claimed this data could associate her device with an ACA eligibility solicitation, potentially revealing sensitive circumstances such as being uninsured or changing jobs. Healthcare, Inc. moved to dismiss for lack of Article III standing and failure to state a claim.
The Court’s Holding
The Court granted the motion to dismiss for lack of subject matter jurisdiction, holding that Plaintiff failed to allege a concrete injury sufficient to establish Article III standing.
The Court found three independent deficiencies: (1) a single unsolicited commercial email, without allegations of calculated time wasted, economic loss, or diminished device function, does not plausibly support a concrete injury; (2) Plaintiff failed to allege what specific data was actually collected or shared about her, offering only conclusory references to “identifiers capable of recognizing her browser or device”; and (3) the categories of data described—IP address, browser metadata, and interaction data—do not implicate a legally protected privacy interest akin to a common-law tort, as they reveal only routine digital interactions and speculative inferences rather than highly offensive disclosures. The Court dismissed the action without prejudice to amendment by November 19, 2026, or pursuit of claims in state court.
Key Takeaways
- A single unsolicited commercial email, absent specific allegations of tangible harm (e.g., economic loss, storage reduction), is insufficient for Article III standing.
- Plaintiffs in digital privacy cases must identify the specific information allegedly collected or disclosed; vague references to “identifiers” or “tokens” fail to plausibly allege a concrete injury.
- Collection of IP addresses, browser metadata, and routine website interaction data does not, without more, resemble the “highly offensive” intrusions actionable at common law (intrusion upon seclusion or public disclosure of private facts).
- Speculative inferences about what data could reveal (e.g., insurance status, job changes) cannot substitute for allegations that the plaintiff actually suffered such a disclosure.
- Pre-TransUnion cases recognizing standing for statutory spam claims (e.g., Van Patten, Silverstein) are no longer controlling; post-TransUnion precedent requires a concrete injury analysis tied to common-law analogues.
Why It Matters
This decision reinforces the stringent post-TransUnion standing requirements in the Northern District of California for digital privacy and spam litigation. It clarifies that statutory violations alone—without a concrete injury resembling a traditional common-law harm—cannot invoke federal jurisdiction.
The ruling aligns with Popa v. Microsoft and a line of district court decisions holding that routine metadata collection (IP addresses, browser fingerprints, clickstream data) lacks the “highly offensive” character necessary for Article III standing. By dismissing claims based on a single email and standard analytics tracking, the Court raises the pleading bar for plaintiffs seeking to federalize California consumer privacy claims, effectively channeling such disputes to state court where Article III does not apply.