Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 1 of 20
`
`
`
`BURSOR & FISHER, P.A.
`L. Timothy Fisher (State Bar No. 191626)
`1990 North California Blvd., Suite 940
`Walnut Creek, CA 94596
`Telephone: (925) 300-4455
`Facsimile: (925) 407-2700
`E-mail: ltfisher@bursor.com
`
`
`Attorney for Plaintiffs
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`EASTERN DISTRICT OF CALIFORNIA
`
`
`
`Case No.
`
`
`CLASS ACTION COMPLAINT
`
`
`JURY TRIAL DEMANDED
`
`
`
`
`
`
`
`
`
`
`
`
`ANGELA COLE and BEATRICE ROCHE,
`individually and on behalf of all others similarly
`situated,
`
`
` Plaintiffs,
`
`
`
`v.
`
`
`QUEST DIAGNOSTICS, INC.,
`
`
` Defendant.
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 2 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Plaintiffs Angela Cole and Beatrice Roche (“Plaintiffs”), on behalf of themselves and all
`other persons similarly situated, by and through their attorneys, make the following allegations
`pursuant to the investigation of their counsel and based upon information and belief, except as to
`allegations specifically pertaining to themselves and their counsel, which are based on personal
`knowledge.
`
`NATURE OF ACTION
`1.
`This is a class action suit brought on behalf of all persons who have visited
`questdiagnostics.com (General Website) or myquest.questdiagnostics.com (Patient Protected
`Website).
`2.
`Quest Diagnostics, Inc. (“Defendant” or “Quest Diagnostics”) describes itself as
`“the world’s leading provider of diagnostic information services,”1 providing “the world’s largest
`database of clinical lab results,” and “annually serv[ing] one in three adult Americans and half the
`physicians and hospitals in the United States.”2
`3.
`Defendant aids, employs, agrees with, and conspires with Facebook to eavesdrop on
`communications sent and received by Plaintiffs and Class members, including communications
`containing protected medical information. Plaintiffs bring this action for legal and equitable
`remedies resulting from these illegal actions.
`
`THE PARTIES
`4.
`Plaintiff Angela Cole is domiciled in Encino, California. In August 2019, Plaintiff
`Cole ordered a diagnostic test from Defendant through her primary care physician. To access those
`results, Plaintiff Cole navigated to the General Website, which redirected her to the Patient
`Protected Website, where she created an account. Once Defendant completed the diagnostic test,
`Plaintiff Cole checked her results through the Patient-Protected Website. Although Plaintiff Cole
`did not know it at the time, Plaintiff Cole is informed and believes Defendant assisted Facebook
`with tracking her through the Facebook Tracking Pixel while she was navigating the General
`Website and Patient-Protected Website.
`
`1 QUEST DIAGNOSTICS, ABOUT US, https://www.questdiagnostics.com/our-company/about-us
`2 QUEST DIAGNOSTICS, COMPANY INFORMATION, https://newsroom.questdiagnostics.com/company-
`information.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`1
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 3 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`5.
`Plaintiff Beatrice Roche is domiciled in Chowchilla, California. Approximately
`four months ago, Plaintiff Roche ordered a diagnostic test from Defendant through her primary
`care physician. To access those results, Plaintiff Roche navigated to the General Website, which
`redirected her to the Patient Protected Website, where she created an account. Once Defendant
`completed the diagnostic test, Plaintiff Roche checked her results through the Patient-Protected
`Website. Although Plaintiff Roche did not know it at the time, Plaintiff Roche is informed and
`believes Defendant assisted Facebook with tracking her through the Facebook Tracking Pixel while
`she was navigating the General Website and Patient-Protected Website.
`6.
`Defendant is a Delaware corporation with its principal place of business in
`Secaucus, New Jersey. Defendant develops, owns, and operates the General Website and the
`Patient-Protected Website, which is used throughout California and the United States.
`
`JURISDICTION AND VENUE
`7.
`This Court has jurisdiction over this action pursuant to 28 U.S.C. § 1332(d)(2)(A) as
`modified by the Class Action Fairness Act of 2005, because at least one member of the Class, as
`defined below, is a citizen of a different state than Defendant, there are more than 100 members of
`the Class, and the aggregate amount in controversy exceeds $5,000,000 exclusive of interests and
`costs.
`
`8.
`This Court has personal jurisdiction over Defendant because Quest Diagnostics
`assisted Facebook with intercepting Plaintiffs’ communications in this District.
`9.
`Venue is proper in this District pursuant to 28 U.S.C. § 1391 because Defendant
`transacts business in this District and a substantial part of the events or omissions giving rise to the
`claim occurred in this District.
`//
`//
`//
`//
`//
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`2
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 4 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`A.
`
`FACTUAL ALLEGATIONS COMMON TO ALL CLAIMS
`Facebook’s Platform and its Business Tools
`10.
`Facebook describes itself as a “real identity platform,”3 meaning users are allowed
`only one account and must share “the name they go by in everyday life.”4 To that end, when
`creating an account, users must provide their first and last name, along with their birthday and
`gender.5
`11.
`In 2021, Facebook generated $117 billion in revenue.6 Roughly 97% of that came
`from selling advertising space.7
`12.
`Facebook sells advertising space by highlighting its ability to target users.8
`Facebook can target users so effectively because it surveils user activity both on and off its site.9
`This allows Facebook to make inferences about users beyond what they explicitly disclose, like
`their “interests,” “behavior,” and “connections.”10 Facebook compiles this information into a
`generalized dataset called “Core Audiences,” which advertisers use to apply highly specific filters
`and parameters for their targeted advertisements.11
`13.
`Advertisers can also build “Custom Audiences.”12 Custom Audiences enables
`advertisers to reach “people who have already shown interest in [their] business, whether they’re
`
`
`3 Sam Schechner and Jeff Horwitz, How Many Users Does Facebook Have? The Company
`Struggles to Figure It Out, WALL. ST. J. (Oct. 21, 2021).
`4 FACEBOOK, COMMUNITY STANDARDS, PART IV INTEGRITY AND AUTHENTICITY,
`https://www.facebook.com/communitystandards/integrity_authenticity.
`5 FACEBOOK, SIGN UP, https://www.facebook.com/
`6 FACEBOOK, META REPORTS FOURTH QUARTER AND FULL YEAR 2021 RESULTS,
`https://investor.fb.com/investor-news/press-release-details/2022/Meta-Reports-Fourth-Quarter-and-
`Full-Year-2021-Results/default.aspx
`7 Id.
`8 FACEBOOK, WHY ADVERTISE ON FACEBOOK,
`https://www.facebook.com/business/help/205029060038706.
`9 FACEBOOK, ABOUT FACEBOOK PIXEL,
`https://www.facebook.com/business/help/742478679120153?id=1205376682832142.
`10 FACEBOOK, AD TARGETING: HELP YOUR ADS FIND THE PEOPLE WHO WILL LOVE YOUR BUSINESS,
`https://www.facebook.com/business/ads/ad-targeting.
`11 FACEBOOK, EASIER, MORE EFFECTIVE WAYS TO REACH THE RIGHT PEOPLE ON FACEBOOK,
`https://www.facebook.com/business/news/Core-Audiences.
`12 FACEBOOK, ABOUT CUSTOM AUDIENCES,
`https://www.facebook.com/business/help/744354708981227?id=2469097953376494.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`3
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 5 of 20
`
`
`
`loyal customers or people who have used [their] app or visited [their] website.”13 With Custom
`Audiences, advertisers can target existing customers directly, and they can also build a “Lookalike
`Audiences,” which “leverages information such as demographics, interests, and behavior from your
`source audience to find new people who share similar qualities.”14 Unlike Core Audiences,
`advertisers can build Custom Audiences and Lookalike Audiences only if they first supply Facebook
`with the underlying data. They can do so through two mechanisms: by manually uploading contact
`information for customers, or by utilizing Facebook’s “Business Tools.”15
`14.
`As Facebook puts it, the Business Tools “help website owners and publishers, app
`developers and business partners, including advertisers and others, integrate with Facebook,
`understand and measure their products and services, and better reach and serve people who might be
`interested in their products and services.”16 Put more succinctly, Facebook’s Business Tools are bits
`of code that advertisers can integrate into their website, mobile applications, and servers, thereby
`enabling Facebook to intercept and collect user activity on those platforms.
`15.
`The Business Tools are automatically configured to capture certain data, like when a
`user visits a webpage, that webpage’s Universal Resource Locator (“URL”) and metadata, or when
`a user downloads a mobile application or makes a purchase.17 Facebook’s Business Tools can also
`track other events. Facebook offers a menu of “standard events” from which advertisers can
`
`
`13 FACEBOOK, AD TARGETING, HELP YOUR ADS FIND THE PEOPLE WHO WILL LOVE YOUR BUSINESS,
`https://www.facebook.com/business/ads/ad-targeting.
`14 Facebook, About Lookalike Audiences,
`https://www.facebook.com/business/help/164749007013531?id=401668390442328.
`15 FACEBOOK, CREATE A CUSTOMER LIST CUSTOM AUDIENCE,
`https://www.facebook.com/business/help/170456843145568?id=2469097953376494; Facebook,
`Create a Website Custom Audience,
`https://www.facebook.com/business/help/1474662202748341?id=2469097953376494.
`16 FACEBOOK, THE FACEBOOK BUSINESS TOOLS,
`https://www.facebook.com/help/331509497253087.
`17 See FACEBOOK, FACEBOOK PIXEL, ACCURATE EVENT TRACKING, ADVANCED,
`https://developers.facebook.com/docs/facebook-pixel/advanced/; see also FACEBOOK, BEST
`PRACTICES FOR FACEBOOK PIXEL SETUP,
`https://www.facebook.com/business/help/218844828315224?id=1205376682832142; FACEBOOK,
`APP EVENTS API, https://developers.facebook.com/docs/marketing-api/app-event-api/.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`4
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 6 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`choose, including what content a visitor views or purchases.18 Advertisers can even create their
`own tracking parameters by building a “custom event.”19
`16.
`One such Business Tool is the Facebook Tracking Pixel. Facebook offers this piece
`of code to advertisers, like Quest Diagnostics, to integrate into their website. As the name implies,
`the Facebook Tracking Pixel “tracks the people and type of actions they take.”20 When a user
`accesses a website hosting the Facebook Tracking Pixel, Facebook’s software script surreptitiously
`directs the user’s browser to send a separate message to Facebook’s servers. This second, secret
`transmission contains the original GET request sent to the host website, along with additional data
`that the Pixel is configured to collect. This transmission is initiated by Facebook code and
`concurrent with the communications with the host website. Two sets of code are thus
`automatically run as part of the browser’s attempt to load and read Defendant’s websites—
`Defendant’s own code, and Facebook’s embedded code.
`17.
`An example illustrates the point. Take an individual who navigates to Defendant’s
`website and clicks on a tab for allergy information. When that tab is clicked, the individual’s
`browser sends a GET request to Defendant’s server requesting that server to load the particular
`webpage. Because Quest Diagnostics utilizes the Facebook Tracking Pixel, Facebook’s embedded
`code, written in JavaScript, sends secret instructions back to the individual’s browser, without
`alerting the individual that this is happening. Facebook causes the browser to secretly duplicate the
`communication with Quest Diagnostics, transmitting it to Facebook’s servers, alongside additional
`information that transcribes the communication’s content and the individual’s identity.
`18.
`After collecting and intercepting this information, Facebook processes it, analyzes
`it, and assimilates it into datasets like Core Audiences and Custom Audiences.
`
`
`
`
`18 FACEBOOK, SPECIFICATIONS FOR FACEBOOK PIXEL STANDARD EVENTS,
`https://www.facebook.com/business/help/402791146561655?id=1205376682832142.
`19 FACEBOOK, ABOUT STANDARD AND CUSTOM WEBSITE EVENTS,
`https://www.facebook.com/business/help/964258670337005?id=1205376682832142; see also
`FACEBOOK, APP EVENTS API, https://developers.facebook.com/docs/marketing-api/app-event-api/.
`20 FACEBOOK, RETARGETING, https://www.facebook.com/business/goals/retargeting.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`5
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 7 of 20
`
`
`
`B.
`
`Quest Diagnostics and the Facebook Tracking Pixel
`19.
`Defendant owns and operates www.questdiagnostics.com (“General Website”) and
`www.myquest.diagnostics.com (“Patient-Protected Website”).
`20.
` The General Website is exactly that: generally available to all internet users. Here,
`users can browse articles, read publications, and access Defendant’s other services and products.
`Figure 1
`
`21.
`The Patient-Protected Website is a password-protected platform that Defendant
`offers to patients who seek to review test results, schedule appointments, or pay bills.
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`6
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 8 of 20
`
`
`
` Figure 2
`
`22. When operating the Patient-Protected Website, Defendant is a “business organized
`for the purpose of maintaining medical information … in order to make the information available
`to an individual or to a provider of health care at the request of the individual or a provider of
`health care, for the purposes of allowing the individual to manage his or her information, or for the
`diagnosis and treatment of the individual[.]” Cal. Civ. Code § 56.06(a).
`23.
`Defendant integrates the Facebook Tracking Pixel into both websites.
`Figure 3 (General Website)
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`7
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 9 of 20
`
`Figure 4 (Patient-Protected Website)21
`
`24.
`For both websites, Defendant’s Pixels intercept and transmit PageView information.
`Figures 5 & 6
`
`
`
`
`
`
`
`25.
`PageView transmits the URL accessed.
`26.
`For the Patient-Protected Website, PageView discloses information “regarding a
`patient’s medical history, mental or physical condition, or treatment” because it transmits
`
`
`21 Figure 4, unlike Figure 3, shows a spinning wheel next to the “PageView” event. This signifies
`that the Pixel has yet to capture and transmit any data. That’s because Defendant removed the
`Pixel from its Patient-Protected Website sometime after December 2021. Before Defendant did
`that, however, Plaintiffs’ counsel recorded a URL transmission sent to Facebook. This URL
`transmission, once entered into a browser, allows Plaintiffs’ counsel to reconstruct what
`communications Defendant previously aided Facebook with eavesdropping upon. The only
`difference is that, because Defendant removed the Pixel, it no longer registers a completed
`interception. In short, the spinning wheel has no significance.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 10 of 20
`
`
`
`information showing, at a minimum, that a patient has received and is accessing test results. Cal.
`Civ. Code. § 56.05(j).
`27.
`For the General Website, Defendant’s Pixel also intercepts and transmits
`ButtonClick and Microdata information.
`Figures 7 & 8
`
`28.
`Quest Diagnostics transmitted PageView, Microdata and Button Click data so
`Facebook could learn the contents and meaning of a user’s electronic communication. By
`integrating and configuring the Pixel into its websites, Defendant aided, employed, agreed with,
`and conspired with Facebook to eavesdrop on these communications.
`29.
`Defendant’s Pixels also intercept and collect personally identifiable information.
`30.
`A user who accesses either website while logged into Facebook will transmit the
`c_user cookie to Facebook, which contains that user’s unencrypted Facebook ID. When accessing
`the General Website, for example, Facebook received eight cookies, seven of which are visible
`here:
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`9
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 11 of 20
`
`
`
`Figure 9
`
`31. When a visitor’s browser has recently logged out of an account, Facebook compels
`the visitor’s browser to send a smaller set of cookies.22
`Figure 10
`
`32.
`The fr cookie contains, at least, an encrypted Facebook ID and browser identifier. 23
`The _fbp cookie contains, at least, an unencrypted value that uniquely identifies a browser. 24 The
`datr cookies also identifies a browser. Facebook, at a minimum, uses the fr and _fbp cookies to
`identify users. 25
`33.
`If a visitor has never created an account, at least two cookies are transmitted.
`Figure 11
`
`34. Without a corresponding Facebook ID, the fr cookie contains, at least, an abbreviated
`and encrypted value that identifies the browser. The _fbp cookie contains, at least, an unencrypted
`value that uniquely identifies a browser. Facebook uses both for targeted advertising.
`
`22 Not pictured here and in the preceding image is the _fbp cookie, which is transmitted as a first-
`party cookie.
`23 DATA PROTECTION COMMISSIONER, FACEBOOK IRELAND LTD, REPORT OF RE-AUDIT (Sept. 21,
`2012), http://www.europe-v-facebook.org/ODPC_Review.pdf.
`24 FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`25 FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`10
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 12 of 20
`
`
`
`35.
`The fr cookie expires after 90 days unless the visitor’s browser logs back into
`Facebook.26 If that happens, the time resets, and another 90 days begins to accrue.27
`36.
`The _fbp cookie expires after 90 days unless the visitor’s browser accesses the same
`website.28 If that happens, the time resets, and another 90 days begins to accrue.29
`37.
`The Facebook Tracking Pixel uses both first- and third-party cookies. A first-party
`cookie is “created by the website the user is visiting”—i.e., Quest Diagnostics.30 A third-party cookie
`is “created by a website with a domain name other than the one the user is currently visiting”—i.e.,
`Facebook.31 The _fbp cookie is always transmitted as a first-party cookie. A duplicate _fbp cookie
`is sometimes sent as a third-party cookie, depending on whether the browser has recently logged into
`Facebook.
`38.
`Facebook, at a minimum, uses the fr, _fbp, and c_user cookies to link to Facebook
`IDs and corresponding Facebook profiles.
`39.
`Defendant uses these cookies to pair event data with personally identifiable
`information so it can later retarget patients on Facebook.
`40.
`Quest Diagnostics expressly warrants that it will never conspire with a third-party to
`intercept usage data paired with personally identifiable information.
`
`
`26 See FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`27 Confirmable through developer tools.
`28 See FACEBOOK, COOKIES & OTHER STORAGE TECHNOLOGIES,
`https://www.facebook.com/policy/cookies/.
`29 Also confirmable through developer tools.
`30 PC MAG, FIRST-PARTY COOKIES, https://www.pcmag.com/encyclopedia/term/first-party-cookie.
`This is confirmable by using developer tools to inspect a website’s cookies and track network
`activity.
`31 PC MAG, THIRD-PARTY COOKIES, https://www.pcmag.com/encyclopedia/term/third-party-cookie.
`This is also confirmable by tracking network activity.
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`11
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 13 of 20
`
`
`
`Figures 12 & 13
`
`41.
`By warranting as much, Defendant has failed to receive consent from visitors to
`intercept their communications.
`42.
` Facebook confirms that it eavesdrops on communications between Defendant and
`visitors.
`Figures 14 & 15
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`12
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 14 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CLASS ACTION ALLEGATIONS
`43.
`Plaintiffs bring this action as a class action under Federal Rule of Civil Procedure 23
`on behalf of a Class consisting of all persons in California who have navigated and accessed
`questdiagnostics.com (the “General Website”) and/or myquest.questdiagnostics.com (the “Patient-
`Protected Website”).
`44.
`Excluded from the Class is Defendant, the officers and directors of the Defendant at
`all relevant times, members of their immediate families and their legal representatives, heirs,
`successors or assigns and any entity in which either Defendant has or had a controlling interest.
`45.
`Plaintiffs are members of the Class they seek to represent.
`46.
`The Class is so numerous that joinder of all members is impractical. Although
`Plaintiffs do not yet know the exact size of the Class, upon information and belief, the Class
`includes more than one million members.
`47.
`The Class is ascertainable because the Class Members can be identified by objective
`criteria – all individuals who have had their activity intercepted by Facebook while navigating
`questdiagnostics.com and/or myquest.questdiagnostics.com. Individual notice can be provided to
`Class Members “who can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B).
`48.
`There are numerous questions of law and fact common to the Class which
`predominate over any individual actions or issues, including but not limited to:
`(a) Whether Quest Diagnostics represented to Class members that it would not
`collect sensitive, confidential or protected information;
`(b) Whether Quest Diagnostics gave the Class members a reasonable
`expectation of privacy that their communications were not being intercepted,
`received, or collected by Facebook when they accessed and viewed medical
`records through myquest.questdiagnostics.com;
`(c) Whether Quest Diagnostics in fact assisted, conspired with, or otherwise
`aided Facebook with intercepting, receiving, or collecting communications
`from Class members when Class members communicated generally with
`Quest Diagnostics or were viewing protected health information;
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`13
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 15 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`(d) Whether Defendant assistance with intercepting, receiving, or collecting
`communications between Quest Diagnostics and Class members violated
`state and federal privacy laws;
`(e) Whether Defendant’s assistance with intercepting, receiving, or collecting
`communications between Quest Diagnostics and Class members violated
`anti-wiretapping laws;
`(f) Whether Defendant’s assistance with intercepting, receiving, or collecting
`communications between Quest Diagnostics and Class members violated
`any other state and federal tort laws;
`(g) Whether Plaintiffs and Class members are entitled to declaratory and/or
`injunctive relief to enjoin the unlawful conduct alleged herein; and
`(h) Whether Plaintiffs and Class members have sustained damages as a result of
`Defendant’s conduct and if so, what is the appropriate measure of damages
`or restitution.
`49.
`Plaintiffs’ claims are typical of the claims of the members of the Class as all
`members are similarly affected by Defendant’s wrongful conduct. Plaintiffs have no interests
`antagonistic to the interests of the other members of the Class. Plaintiffs and all members of the
`Class have sustained economic injury arising out of Defendant’s violations of common and
`statutory law as alleged herein.
`50.
`Plaintiffs are adequate representatives of the Class because their interests do not
`conflict with the interests of Class members they seek to represent, they have retained counsel
`competent and experienced in prosecuting class actions, and they intend to prosecute this action
`vigorously. The interests of Class members will be fairly and adequately protected by Plaintiffs
`and their counsel.
`51.
`The class mechanism is superior to other available means for the fair and efficient
`adjudication of the claims of Plaintiffs and Class members. Each individual Class member may
`lack the resources to undergo the burden and expense of individual prosecution of the complex and
`extensive litigation necessary to establish Defendant’s liability. Individualized litigation increases
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`14
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 16 of 20
`
`
`
`the delay and expense to all parties and multiplies the burden on the judicial system presented by
`the complex legal and factual issues of this case. Individualized litigation also presents a potential
`for inconsistent or contradictory judgments. In contrast, the class action device presents far fewer
`management difficulties and provides the benefits of single adjudication, economy of scale, and
`comprehensive supervision by a single court on the issue of Defendant’s liability. Class treatment
`of the liability issues will ensure that all claims are consistently adjudicated.
`52.
`Plaintiffs reserve the right to revise the foregoing class allegations and definitions
`based on facts learned and legal developments following additional investigation, discovery, or
`otherwise.
`
`COUNT I
`Violation Of The California Invasion Of Privacy Act (“CIPA”),
`California Penal Code § 631
`Plaintiffs repeat the allegations contained in the paragraphs above as if fully set
`
`53.
`forth herein.
`54.
`Plaintiffs bring this Count individually and on behalf of the members of the Class.
`55.
`The California Invasion of Privacy Act (“CIPA”) is codified at Cal. Penal Code §§
`630 to 638. The Act begins with its statement of purpose.
`
`
`The Legislature hereby declares that advances in science and
`technology have led to the development of new devices and
`techniques for the purpose of eavesdropping upon private
`communications and that the invasion of privacy resulting from the
`continual and increasing use of such devices and techniques has
`created a serious threat to the free exercise of personal liberties and
`cannot be tolerated in a free and civilized society.
`
`
`Cal. Penal Code § 630.
`56.
`California penal Code § 631(a) provides, in pertinent part:
`
`
`Any person who, by means of any machine, instrument, or
`contrivance, or in any other manner … willfully and without the
`consent of all parties to the communication, or in any unauthorized
`manner, reads, or attempts to read, or to learn the contents or
`meaning of any message, report, or communication while the same is
`in transit or passing over any wire, line, or cable, or is being sent
`from, or received at any place within this state; or who uses, or
`attempts to use, in any manner, or for any purpose, or to
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`15
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 17 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`communicate in any way, any information so obtained, or who aids,
`agrees with, employs, or conspires with any person or persons to
`unlawfully do, or permit, or cause to be done any of the acts or
`things mentioned above in this section, is punishable by a fine not
`exceeding two thousand five hundred dollars ($2,500).
`57.
`A defendant must show it had the consent of all parties to a communication.
`58.
`At all relevant times, Defendant aided, agreed with, and conspired with Facebook to
`track and intercept Plaintiffs’ and Class members’ internet communications while accessing
`www.questdiagnostics.com and www.myquest.questdiagnostics.com. They intercepted these
`communications without authorization and consent from Plaintiffs and Class members.
`59.
`Defendant, when aiding and assisting Facebook’s eavesdropping, intended to help
`Facebook learn some meaning of the content in the URLs and the content the visitor requested.
`60.
`The following items constitute “machine[s], instrument[s], or contrivance[s]” under
`the CIPA, and even if they do not, the Facebook Tracking Pixel falls under the broad catch-all
`category of “any other manner”:
`a. The computer codes and programs Facebook used to track Plaintiffs’ and the Class
`members’ communications while they were navigating the General Website and Patient-
`Protected Website;
`b. The Plaintiffs’ and Class member’s browsers;
`c. The Plaintiffs’ and Class members’ computing and mobile devices;
`d. Facebook’s web and ad servers;
`e. The web and ad-servers from which Facebook tracked and intercepted the Plaintiffs’ and
`Class members’ communications while they were using a web browser to access or
`navigate the General Website and Patient-Protected Website;
`f. The computer codes and programs used by Facebook to effectuate its tracking and
`interception of the Plaintiffs’ and Class members’ communications while they were using
`a browser to visit Defendant’s website; and
`g. The plan Facebook carried out to effectuate its tracking and interception of the Plaintiffs’
`and Class members’ communications while they were using a web browser or mobile
`application to visit Defendant’s websites.
`
`CLASS ACTION COMPLAINT – JURY TRIAL DEMANDED
`
`16
`
`

`

`Case 1:22-at-00550 Document 1 Filed 07/19/22 Page 18 of 20
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`61.
`Plaintiffs and Class members have suffered loss by reason of these violations,
`including, but not limited to, violations of their rights of privacy and loss of value in their
`personally-identifiable information.
`62.
`Pursuant to California Penal Code § 637.2, Plaintiffs and Class members have been
`injured by the violation of California Penal Code § 631 and each seek damages for the greater of
`$5,000 or three times the actual amount of damages, as well as injunctive relief.
`COUNT II
`Violations Of The California Invasion Of Privacy Act (“CMIA”),
`California Civ. Code § 56.05, Et Seq.
`Plaintiffs repeat the allegations contained in the paragraphs above as if fully set
`
`63.
`forth herein.
`64.
`The strictures of the Confidentiality of Medical Information Act (“CMIA”) apply to,
`among others, “[a]ny business organized for the purpose of maintaining medical information … in
`order to make the information available to an individual or to a provider of health care at the
`request of the individual or a provider of health care, for purposes of allowing the individual to
`manage his or her information, or for the diagnosis and treatment of the individual.” Cal. Civ.
`Code § 56.06(a).
`65.
`By administering medica