throbber
Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 1 of 20
`
`
`
`BURSOR & FISHER, P.A.
`L. Timothy Fisher (State Bar No. 191626)
`1990 North California Blvd., Suite 940
`Walnut Creek, CA 94596
`Telephone: (925) 300-4455
`Facsimile: (925) 407-2700
`E-mail: ltfisher@bursor.com
`
`
`Attorney for Plaintiffs
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`EASTERN DISTRICT OF CALIFORNIA
`
`
`
`Case No.
`
`
`CLASS ACTION COMPLAINT
`
`
`JURY TRIAL DEMANDED
`
`
`
`
`
`
`
`
`
`
`
`
`ANGELA COLE and BEATRICE ROCHE,
`individually and on behalf of all others similarly
`situated,
`
`
` Plaintiffs,
`
`
`
`v.
`
`
`QUEST DIAGNOSTICS, INC.,
`
`
` Defendant.
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 2 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Plaintiffs Angela Cole and Beatrice Roche (“Plaintiffs”), on behalf of themselves and all
`other persons similarly situated, by and through their attorneys, make the following allegations
`pursuant to the investigation of their counsel and based upon information and belief, except as to
`allegations specifically pertaining to themselves and their counsel, which are based on personal
`knowledge.
`
`NATURE OF ACTION
`1.
`This is a class action suit brought on behalf of all persons who have visited
`questdiagnostics.com (General Website) or myquest.questdiagnostics.com (Patient Protected
`Website).
`2.
`Quest Diagnostics, Inc. (“Defendant” or “Quest Diagnostics”) describes itself as
`“the world’s leading provider of diagnostic information services,”1 providing “the world’s largest
`database of clinical lab results,” and “annually serv[ing] one in three adult Americans and half the
`physicians and hospitals in the United States.”2
`3.
`Defendant aids, employs, agrees with, and conspires with Facebook to eavesdrop on
`communications sent and received by Plaintiffs and Class members, including communications
`containing protected medical information. Plaintiffs bring this action for legal and equitable
`remedies resulting from these illegal actions.
`
`THE PARTIES
`4.
`Plaintiff Angela Cole is domiciled in Encino, California. In August 2019, Plaintiff
`Cole ordered a diagnostic test from Defendant through her primary care physician. To access those
`results, Plaintiff Cole navigated to the General Website, which redirected her to the Patient
`Protected Website, where she created an account. Once Defendant completed the diagnostic test,
`Plaintiff Cole checked her results through the Patient-Protected Website. Although Plaintiff Cole
`did not know it at the time, Plaintiff Cole is informed and believes Defendant assisted Facebook
`with tracking her through the Facebook Tracking Pixel while she was navigating the General
`Website and Patient-Protected Website.
`
`1 QUEST DIAGNOSTICS, ABOUT US, https://www.questdiagnostics.com/our-company/about-us
`2 QUEST DIAGNOSTICS, COMPANY INFORMATION, https://newsroom.questdiagnostics.com/company-
`information.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`1
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 3 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`5.
`Plaintiff Beatrice Roche is domiciled in Chowchilla, California. Approximately
`four months ago, Plaintiff Roche ordered a diagnostic test from Defendant through her primary
`care physician. To access those results, Plaintiff Roche navigated to the General Website, which
`redirected her to the Patient Protected Website, where she created an account. Once Defendant
`completed the diagnostic test, Plaintiff Roche checked her results through the Patient-Protected
`Website. Although Plaintiff Roche did not know it at the time, Plaintiff Roche is informed and
`believes Defendant assisted Facebook with tracking her through the Facebook Tracking Pixel while
`she was navigating the General Website and Patient-Protected Website.
`6.
`Defendant is a Delaware corporation with its principal place of business in
`Secaucus, New Jersey. Defendant develops, owns, and operates the General Website and the
`Patient-Protected Website, which is used throughout California and the United States.
`
`JURISDICTION AND VENUE
`7.
`This Court has jurisdiction over this action pursuant to 28 U.S.C. § 1332(d)(2)(A) as
`modified by the Class Action Fairness Act of 2005, because at least one member of the Class, as
`defined below, is a citizen of a different state than Defendant, there are more than 100 members of
`the Class, and the aggregate amount in controversy exceeds $5,000,000 exclusive of interests and
`costs.
`
`8.
`This Court has personal jurisdiction over Defendant because Quest Diagnostics
`assisted Facebook with intercepting Plaintiffs’ communications in this District.
`9.
`Venue is proper in this District pursuant to 28 U.S.C. § 1391 because Defendant
`transacts business in this District and a substantial part of the events or omissions giving rise to the
`claim occurred in this District.
`//
`//
`//
`//
`//
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`2
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 4 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`A.
`
`FACTUAL ALLEGATIONS COMMON TO ALL CLAIMS
`Facebook’s Platform and its Business Tools
`10.
`Facebook describes itself as a “real identity platform,”3 meaning users are allowed
`only one account and must share “the name they go by in everyday life.”4 To that end, when
`creating an account, users must provide their first and last name, along with their birthday and
`gender.5
`11.
`In 2021, Facebook generated $117 billion in revenue.6 Roughly 97% of that came
`from selling advertising space.7
`12.
`Facebook sells advertising space by highlighting its ability to target users.8
`Facebook can target users so effectively because it surveils user activity both on and off its site.9
`This allows Facebook to make inferences about users beyond what they explicitly disclose, like
`their “interests,” “behavior,” and “connections.”10 Facebook compiles this information into a
`generalized dataset called “Core Audiences,” which advertisers use to apply highly specific filters
`and parameters for their targeted advertisements.11
`13.
`Advertisers can also build “Custom Audiences.”12 Custom Audiences enables
`advertisers to reach “people who have already shown interest in [their] business, whether they’re
`
`
`3 Sam Schechner and Jeff Horwitz, How Many Users Does Facebook Have? The Company
`Struggles to Figure It Out, WALL. ST. J. (Oct. 21, 2021).
`4 FACEBOOK, COMMUNITY STANDARDS, PART IV INTEGRITY AND AUTHENTICITY,
`https://www.facebook.com/communitystandards/integrity_authenticity.
`5 FACEBOOK, SIGN UP, https://www.facebook.com/
`6 FACEBOOK, META REPORTS FOURTH QUARTER AND FULL YEAR 2021 RESULTS,
`https://investor.fb.com/investor-news/press-release-details/2022/Meta-Reports-Fourth-Quarter-and-
`Full-Year-2021-Results/default.aspx
`7 Id.
`8 FACEBOOK, WHY ADVERTISE ON FACEBOOK,
`https://www.facebook.com/business/help/205029060038706.
`9 FACEBOOK, ABOUT FACEBOOK PIXEL,
`https://www.facebook.com/business/help/742478679120153?id=1205376682832142.
`10 FACEBOOK, AD TARGETING: HELP YOUR ADS FIND THE PEOPLE WHO WILL LOVE YOUR BUSINESS,
`https://www.facebook.com/business/ads/ad-targeting.
`11 FACEBOOK, EASIER, MORE EFFECTIVE WAYS TO REACH THE RIGHT PEOPLE ON FACEBOOK,
`https://www.facebook.com/business/news/Core-Audiences.
`12 FACEBOOK, ABOUT CUSTOM AUDIENCES,
`https://www.facebook.com/business/help/744354708981227?id=2469097953376494.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`3
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 5 of 20
`
`
`
`loyal customers or people who have used [their] app or visited [their] website.”13 With Custom
`Audiences, advertisers can target existing customers directly, and they can also build a “Lookalike
`Audiences,” which “leverages information such as demographics, interests, and behavior from your
`source audience to find new people who share similar qualities.”14 Unlike Core Audiences,
`advertisers can build Custom Audiences and Lookalike Audiences only if they first supply Facebook
`with the underlying data. They can do so through two mechanisms: by manually uploading contact
`information for customers, or by utilizing Facebook’s “Business Tools.”15
`14.
`As Facebook puts it, the Business Tools “help website owners and publishers, app
`developers and business partners, including advertisers and others, integrate with Facebook,
`understand and measure their products and services, and better reach and serve people who might be
`interested in their products and services.”16 Put more succinctly, Facebook’s Business Tools are bits
`of code that advertisers can integrate into their website, mobile applications, and servers, thereby
`enabling Facebook to intercept and collect user activity on those platforms.
`15.
`The Business Tools are automatically configured to capture certain data, like when a
`user visits a webpage, that webpage’s Universal Resource Locator (“URL”) and metadata, or when
`a user downloads a mobile application or makes a purchase.17 Facebook’s Business Tools can also
`track other events. Facebook offers a menu of “standard events” from which advertisers can
`
`
`13 FACEBOOK, AD TARGETING, HELP YOUR ADS FIND THE PEOPLE WHO WILL LOVE YOUR BUSINESS,
`https://www.facebook.com/business/ads/ad-targeting.
`14 Facebook, About Lookalike Audiences,
`https://www.facebook.com/business/help/164749007013531?id=401668390442328.
`15 FACEBOOK, CREATE A CUSTOMER LIST CUSTOM AUDIENCE,
`https://www.facebook.com/business/help/170456843145568?id=2469097953376494; Facebook,
`Create a Website Custom Audience,
`https://www.facebook.com/business/help/1474662202748341?id=2469097953376494.
`16 FACEBOOK, THE FACEBOOK BUSINESS TOOLS,
`https://www.facebook.com/help/331509497253087.
`17 See FACEBOOK, FACEBOOK PIXEL, ACCURATE EVENT TRACKING, ADVANCED,
`https://developers.facebook.com/docs/facebook-pixel/advanced/; see also FACEBOOK, BEST
`PRACTICES FOR FACEBOOK PIXEL SETUP,
`https://www.facebook.com/business/help/218844828315224?id=1205376682832142; FACEBOOK,
`APP EVENTS API, https://developers.facebook.com/docs/marketing-api/app-event-api/.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`4
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 6 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`choose, including what content a visitor views or purchases.18 Advertisers can even create their
`own tracking parameters by building a “custom event.”19
`16.
`One such Business Tool is the Facebook Tracking Pixel. Facebook offers this piece
`of code to advertisers, like Quest Diagnostics, to integrate into their website. As the name implies,
`the Facebook Tracking Pixel “tracks the people and type of actions they take.”20 When a user
`accesses a website hosting the Facebook Tracking Pixel, Facebook’s software script surreptitiously
`directs the user’s browser to send a separate message to Facebook’s servers. This second, secret
`transmission contains the original GET request sent to the host website, along with additional data
`that the Pixel is configured to collect. This transmission is initiated by Facebook code and
`concurrent with the communications with the host website. Two sets of code are thus
`automatically run as part of the browser’s attempt to load and read Defendant’s websites—
`Defendant’s own code, and Facebook’s embedded code.
`17.
`An example illustrates the point. Take an individual who navigates to Defendant’s
`website and clicks on a tab for allergy information. When that tab is clicked, the individual’s
`browser sends a GET request to Defendant’s server requesting that server to load the particular
`webpage. Because Quest Diagnostics utilizes the Facebook Tracking Pixel, Facebook’s embedded
`code, written in JavaScript, sends secret instructions back to the individual’s browser, without
`alerting the individual that this is happening. Facebook causes the browser to secretly duplicate the
`communication with Quest Diagnostics, transmitting it to Facebook’s servers, alongside additional
`information that transcribes the communication’s content and the individual’s identity.
`18.
`After collecting and intercepting this information, Facebook processes it, analyzes
`it, and assimilates it into datasets like Core Audiences and Custom Audiences.
`
`
`
`
`18 FACEBOOK, SPECIFICATIONS FOR FACEBOOK PIXEL STANDARD EVENTS,
`https://www.facebook.com/business/help/402791146561655?id=1205376682832142.
`19 FACEBOOK, ABOUT STANDARD AND CUSTOM WEBSITE EVENTS,
`https://www.facebook.com/business/help/964258670337005?id=1205376682832142; see also
`FACEBOOK, APP EVENTS API, https://developers.facebook.com/docs/marketing-api/app-event-api/.
`20 FACEBOOK, RETARGETING, https://www.facebook.com/business/goals/retargeting.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`5
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 7 of 20
`
`
`
`B.
`
`Quest Diagnostics and the Facebook Tracking Pixel
`19.
`Defendant owns and operates www.questdiagnostics.com (“General Website”) and
`www.myquest.diagnostics.com (“Patient-Protected Website”).
`20.
` The General Website is exactly that: generally available to all internet users. Here,
`users can browse articles, read publications, and access Defendant’s other services and products.
`Figure 1
`
`21.
`The Patient-Protected Website is a password-protected platform that Defendant
`offers to patients who seek to review test results, schedule appointments, or pay bills.
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`6
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 8 of 20
`
`
`
` Figure 2
`
`22. When operating the Patient-Protected Website, Defendant is a “business organized
`for the purpose of maintaining medical information … in order to make the information available
`to an individual or to a provider of health care at the request of the individual or a provider of
`health care, for the purposes of allowing the individual to manage his or her information, or for the
`diagnosis and treatment of the individual[.]” Cal. Civ. Code § 56.06(a).
`23.
`Defendant integrates the Facebook Tracking Pixel into both websites.
`Figure 3 (General Website)
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`7
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 9 of 20
`
`Figure 4 (Patient-Protected Website)21
`
`24.
`For both websites, Defendant’s Pixels intercept and transmit PageView information.
`Figures 5 & 6
`
`
`
`
`
`
`
`25.
`PageView transmits the URL accessed.
`26.
`For the Patient-Protected Website, PageView discloses information “regarding a
`patient’s medical history, mental or physical condition, or treatment” because it transmits
`
`
`21 Figure 4, unlike Figure 3, shows a spinning wheel next to the “PageView” event. This signifies
`that the Pixel has yet to capture and transmit any data. That’s because Defendant removed the
`Pixel from its Patient-Protected Website sometime after December 2021. Before Defendant did
`that, however, Plaintiffs’ counsel recorded a URL transmission sent to Facebook. This URL
`transmission, once entered into a browser, allows Plaintiffs’ counsel to reconstruct what
`communications Defendant previously aided Facebook with eavesdropping upon. The only
`difference is that, because Defendant removed the Pixel, it no longer registers a completed
`interception. In short, the spinning wheel has no significance.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 10 of 20
`
`
`
`information showing, at a minimum, that a patient has received and is accessing test results. Cal.
`Civ. Code. § 56.05(j).
`27.
`For the General Website, Defendant’s Pixel also intercepts and transmits
`ButtonClick and Microdata information.
`Figures 7 & 8
`
`28.
`Quest Diagnostics transmitted PageView, Microdata and Button Click data so
`Facebook could learn the contents and meaning of a user’s electronic communication. By
`integrating and configuring the Pixel into its websites, Defendant aided, employed, agreed with,
`and conspired with Facebook to eavesdrop on these communications.
`29.
`Defendant’s Pixels also intercept and collect personally identifiable information.
`30.
`A user who accesses either website while logged into Facebook will transmit the
`c_user cookie to Facebook, which contains that user’s unencrypted Facebook ID. When accessing
`the General Website, for example, Facebook received eight cookies, seven of which are visible
`here:
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`9
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 11 of 20
`
`
`
`Figure 9
`
`31. When a visitor’s browser has recently logged out of an account, Facebook compels
`the visitor’s browser to send a smaller set of cookies.22
`Figure 10
`
`32.
`The fr cookie contains, at least, an encrypted Facebook ID and browser identifier. 23
`The _fbp cookie contains, at least, an unencrypted value that uniquely identifies a browser. 24 The
`datr cookies also identifies a browser. Facebook, at a minimum, uses the fr and _fbp cookies to
`identify users. 25
`33.
`If a visitor has never created an account, at least two cookies are transmitted.
`Figure 11
`
`34. Without a corresponding Facebook ID, the fr cookie contains, at least, an abbreviated
`and encrypted value that identifies the browser. The _fbp cookie contains, at least, an unencrypted
`value that uniquely identifies a browser. Facebook uses both for targeted advertising.
`
`22 Not pictured here and in the preceding image is the _fbp cookie, which is transmitted as a first-
`party cookie.
`23 DATA PROTECTION COMMISSIONER, FACEBOOK IRELAND LTD, REPORT OF RE-AUDIT (Sept. 21,
`2012), http://www.europe-v-facebook.org/ODPC_Review.pdf.
`24 FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`25 FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`10
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 12 of 20
`
`
`
`35.
`The fr cookie expires after 90 days unless the visitor’s browser logs back into
`Facebook.26 If that happens, the time resets, and another 90 days begins to accrue.27
`36.
`The _fbp cookie expires after 90 days unless the visitor’s browser accesses the same
`website.28 If that happens, the time resets, and another 90 days begins to accrue.29
`37.
`The Facebook Tracking Pixel uses both first- and third-party cookies. A first-party
`cookie is “created by the website the user is visiting”—i.e., Quest Diagnostics.30 A third-party cookie
`is “created by a website with a domain name other than the one the user is currently visiting”—i.e.,
`Facebook.31 The _fbp cookie is always transmitted as a first-party cookie. A duplicate _fbp cookie
`is sometimes sent as a third-party cookie, depending on whether the browser has recently logged into
`Facebook.
`38.
`Facebook, at a minimum, uses the fr, _fbp, and c_user cookies to link to Facebook
`IDs and corresponding Facebook profiles.
`39.
`Defendant uses these cookies to pair event data with personally identifiable
`information so it can later retarget patients on Facebook.
`40.
`Quest Diagnostics expressly warrants that it will never conspire with a third-party to
`intercept usage data paired with personally identifiable information.
`
`
`26 See FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`27 Confirmable through developer tools.
`28 See FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`29 Also confirmable through developer tools.
`30 PC MAG, FIRST-PARTY COOKIES, https://www.pcmag.com/encyclopedia/term/first-party-cookie.
`This is confirmable by using developer tools to inspect a website’s cookies and track network
`activity.
`31 PC MAG, THIRD-PARTY COOKIES, https://www.pcmag.com/encyclopedia/term/third-party-cookie.
`This is also confirmable by tracking network activity.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`11
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 13 of 20
`
`
`
`Figures 12 & 13
`
`41.
`By warranting as much, Defendant has failed to receive consent from visitors to
`intercept their communications.
`42.
` Facebook confirms that it eavesdrops on communications between Defendant and
`visitors.
`Figures 14 & 15
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`12
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 14 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CLASS ACTION ALLEGATIONS
`43.
`Plaintiffs bring this action as a class action under Federal Rule of Civil Procedure 23
`on behalf of a Class consisting of all persons in California who have navigated and accessed
`questdiagnostics.com (the “General Website”) and/or myquest.questdiagnostics.com (the “Patient-
`Protected Website”).
`44.
`Excluded from the Class is Defendant, the officers and directors of the Defendant at
`all relevant times, members of their immediate families and their legal representatives, heirs,
`successors or assigns and any entity in which either Defendant has or had a controlling interest.
`45.
`Plaintiffs are members of the Class they seek to represent.
`46.
`The Class is so numerous that joinder of all members is impractical. Although
`Plaintiffs do not yet know the exact size of the Class, upon information and belief, the Class
`includes more than one million members.
`47.
`The Class is ascertainable because the Class Members can be identified by objective
`criteria – all individuals who have had their activity intercepted by Facebook while navigating
`questdiagnostics.com and/or myquest.questdiagnostics.com. Individual notice can be provided to
`Class Members “who can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B).
`48.
`There are numerous questions of law and fact common to the Class which
`predominate over any individual actions or issues, including but not limited to:
`(a) Whether Quest Diagnostics represented to Class members that it would not
`collect sensitive, confidential or protected information;
`(b) Whether Quest Diagnostics gave the Class members a reasonable
`expectation of privacy that their communications were not being intercepted,
`received, or collected by Facebook when they accessed and viewed medical
`records through myquest.questdiagnostics.com;
`(c) Whether Quest Diagnostics in fact assisted, conspired with, or otherwise
`aided Facebook with intercepting, receiving, or collecting communications
`from Class members when Class members communicated generally with
`Quest Diagnostics or were viewing protected health information;
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`13
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 15 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`(d) Whether Defendant assistance with intercepting, receiving, or collecting
`communications between Quest Diagnostics and Class members violated
`state and federal privacy laws;
`(e) Whether Defendant’s assistance with intercepting, receiving, or collecting
`communications between Quest Diagnostics and Class members violated
`anti-wiretapping laws;
`(f) Whether Defendant’s assistance with intercepting, receiving, or collecting
`communications between Quest Diagnostics and Class members violated
`any other state and federal tort laws;
`(g) Whether Plaintiffs and Class members are entitled to declaratory and/or
`injunctive relief to enjoin the unlawful conduct alleged herein; and
`(h) Whether Plaintiffs and Class members have sustained damages as a result of
`Defendant’s conduct and if so, what is the appropriate measure of damages
`or restitution.
`49.
`Plaintiffs’ claims are typical of the claims of the members of the Class as all
`members are similarly affected by Defendant’s wrongful conduct. Plaintiffs have no interests
`antagonistic to the interests of the other members of the Class. Plaintiffs and all members of the
`Class have sustained economic injury arising out of Defendant’s violations of common and
`statutory law as alleged herein.
`50.
`Plaintiffs are adequate representatives of the Class because their interests do not
`conflict with the interests of Class members they seek to represent, they have retained counsel
`competent and experienced in prosecuting class actions, and they intend to prosecute this action
`vigorously. The interests of Class members will be fairly and adequately protected by Plaintiffs
`and their counsel.
`51.
`The class mechanism is superior to other available means for the fair and efficient
`adjudication of the claims of Plaintiffs and Class members. Each individual Class member may
`lack the resources to undergo the burden and expense of individual prosecution of the complex and
`extensive litigation necessary to establish Defendant’s liability. Individualized litigation increases
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`14
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 16 of 20
`
`
`
`the delay and expense to all parties and multiplies the burden on the judicial system presented by
`the complex legal and factual issues of this case. Individualized litigation also presents a potential
`for inconsistent or contradictory judgments. In contrast, the class action device presents far fewer
`management difficulties and provides the benefits of single adjudication, economy of scale, and
`comprehensive supervision by a single court on the issue of Defendant’s liability. Class treatment
`of the liability issues will ensure that all claims are consistently adjudicated.
`52.
`Plaintiffs reserve the right to revise the foregoing class allegations and definitions
`based on facts learned and legal developments following additional investigation, discovery, or
`otherwise.
`
`COUNT I
`Violation Of The California Invasion Of Privacy Act (“CIPA”),
`California Penal Code § 631
`Plaintiffs repeat the allegations contained in the paragraphs above as if fully set
`
`53.
`forth herein.
`54.
`Plaintiffs bring this Count individually and on behalf of the members of the Class.
`55.
`The California Invasion of Privacy Act (“CIPA”) is codified at Cal. Penal Code §§
`630 to 638. The Act begins with its statement of purpose.
`
`
`The Legislature hereby declares that advances in science and
`technology have led to the development of new devices and
`techniques for the purpose of eavesdropping upon private
`communications and that the invasion of privacy resulting from the
`continual and increasing use of such devices and techniques has
`created a serious threat to the free exercise of personal liberties and
`cannot be tolerated in a free and civilized society.
`
`
`Cal. Penal Code § 630.
`56.
`California penal Code § 631(a) provides, in pertinent part:
`
`
`Any person who, by means of any machine, instrument, or
`contrivance, or in any other manner … willfully and without the
`consent of all parties to the communication, or in any unauthorized
`manner, reads, or attempts to read, or to learn the contents or
`meaning of any message, report, or communication while the same is
`in transit or passing over any wire, line, or cable, or is being sent
`from, or received at any place within this state; or who uses, or
`attempts to use, in any manner, or for any purpose, or to
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`15
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 17 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`communicate in any way, any information so obtained, or who aids,
`agrees with, employs, or conspires with any person or persons to
`unlawfully do, or permit, or cause to be done any of the acts or
`things mentioned above in this section, is punishable by a fine not
`exceeding two thousand five hundred dollars ($2,500).
`57.
`A defendant must show it had the consent of all parties to a communication.
`58.
`At all relevant times, Defendant aided, agreed with, and conspired with Facebook to
`track and intercept Plaintiffs’ and Class members’ internet communications while accessing
`www.questdiagnostics.com and www.myquest.questdiagnostics.com. They intercepted these
`communications without authorization and consent from Plaintiffs and Class members.
`59.
`Defendant, when aiding and assisting Facebook’s eavesdropping, intended to help
`Facebook learn some meaning of the content in the URLs and the content the visitor requested.
`60.
`The following items constitute “machine[s], instrument[s], or contrivance[s]” under
`the CIPA, and even if they do not, the Facebook Tracking Pixel falls under the broad catch-all
`category of “any other manner”:
`a. The computer codes and programs Facebook used to track Plaintiffs’ and the Class
`members’ communications while they were navigating the General Website and Patient-
`Protected Website;
`b. The Plaintiffs’ and Class member’s browsers;
`c. The Plaintiffs’ and Class members’ computing and mobile devices;
`d. Facebook’s web and ad servers;
`e. The web and ad-servers from which Facebook tracked and intercepted the Plaintiffs’ and
`Class members’ communications while they were using a web browser to access or
`navigate the General Website and Patient-Protected Website;
`f. The computer codes and programs used by Facebook to effectuate its tracking and
`interception of the Plaintiffs’ and Class members’ communications while they were using
`a browser to visit Defendant’s website; and
`g. The plan Facebook carried out to effectuate its tracking and interception of the Plaintiffs’
`and Class members’ communications while they were using a web browser or mobile
`application to visit Defendant’s websites.
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`16
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 18 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`61.
`Plaintiffs and Class members have suffered loss by reason of these violations,
`including, but not limited to, violations of their rights of privacy and loss of value in their
`personally-identifiable information.
`62.
`Pursuant to California Penal Code § 637.2, Plaintiffs and Class members have been
`injured by the violation of California Penal Code § 631 and each seek damages for the greater of
`$5,000 or three times the actual amount of damages, as well as injunctive relief.
`COUNT II
`Violations Of The California Invasion Of Privacy Act (“CMIA”),
`California Civ. Code § 56.05, Et Seq.
`Plaintiffs repeat the allegations contained in the paragraphs above as if fully set
`
`63.
`forth herein.
`64.
`The strictures of the Confidentiality of Medical Information Act (“CMIA”) apply to,
`among others, “[a]ny business organized for the purpose of maintaining medical information … in
`order to make the information available to an individual or to a provider of health care at the
`request of the individual or a provider of health care, for purposes of allowing the individual to
`manage his or her information, or for the diagnosis and treatment of the individual.” Cal. Civ.
`Code § 56.06(a).
`65.
`By administering medica

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket