1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 JANE DOE, et al., Case No. 23-cv-00059-WHO (VKD)

8 Plaintiffs, ORDER RE JANUARY 24, 2025 9 v. DISCOVERY DISPUTES

10 FULLSTORY, INC., et al., Re: Dkt. Nos. 186, 187 Defendants. 11

12 13 Plaintiff Jane Doe II1 and defendant Meta Platforms, Inc. (“Meta”)2 ask the Court to 14 resolve several disputes regarding the scope of plaintiff’s document discovery of Meta. Dkt. Nos. 15 186, 187. The Court held a hearing on these disputes on February 4, 2025. Dkt. No. 189. 16 The Court resolves these disputes as explained below. 17 I. BACKGROUND 18 In this action, plaintiff alleges that she is a former user of Hey Favor (“Favor”), a 19 “combination telemedicine company and direct-to-consumer pharmacy.” Dkt. 133 ¶ 1. According 20 to plaintiff, Favor installed Meta’s Pixels and software development kit (“SDK”) on its platform 21 (i.e. its website and mobile application), which then permitted Meta to obtain her and others’ 22 “health data and other highly sensitive information,” including prescription information, answers 23 to health-related questions, medication side effects, allergies, age, and weight. Id. ¶¶ 1, 13, 130. 24 Plaintiff asserts the following claims against Meta: (1) violation of common law privacy rights— 25

26 1 There is a pending motion for dismissal without prejudice of Jane Doe I’s individual claims. Dkt. No. 174. 27 1 intrusion upon seclusion; (2) unjust enrichment; and (3) violations of the California Invasion of 2 Privacy Act (“CIPA”) §§ 631 and 632. Id. (claims 1-4). She seeks to represent a nationwide class 3 of “[a]ll natural persons in the United States who used the Favor Platform and whose 4 communications and/or data were intercepted by [Meta].” Id. ¶ 180. 5 At issue in these discovery disputes are the following Requests for Production of 6 Documents (“RFPs”) addressed to Meta: 7 RFP 1 (as modified): Documents and communications with government regulators relating to (1) its collection, transmittal, 8 disclosure, or use of Favor User Data,3 and (2) its collection, 9 transmittal, disclosure, or use of health or medical data.

10 RFP 11: Documents and Communications Relating to: (1) which personnel or teams have access to data, or derivatives thereof, 11 collected through Your Tracking Technology; (2) the purposes for which personnel or teams have access to data, or derivatives thereof, 12 collected through Your Tracking Technology; (3) how data, or 13 derivatives thereof, collected through Your Tracking Technology may be and are used; and (4) any controls, systems, processes, or 14 rules in place to prevent the use of data, or derivatives thereof, collected through Your Tracking Technology. 15 RFP 27: All Documents and Communications, Including reports 16 and presentations, that discuss, compare, estimate, quantify, or 17 analyze: (1) Your use or potential uses of Favor User Data; or (2) Your use or potential use of health or medical data. 18 19 Dkt. No. 186-1; Dkt. No. 187-1. In addition, the parties disagree about the scope of the undefined 20 term “health or medical data,” used in these and other requests. Dkt. No. 187. 21 II. LEGAL STANDARD 22 A party may obtain discovery “regarding any non-privileged matter that is relevant to any 23 party’s claim or defense and proportional to the needs of the case, considering the importance of 24 the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant 25 3 Plaintiff defines “Favor User Data” as “information relating to a Favor User, including their 26 medical conditions, prescriptions, appointments, specific treatment, messages to health care providers, purchase history, order information or confirmation, checkout information or 27 confirmation, intake results, questionnaire answers or responses, User Identifiers, and personally 1 information, the parties’ resources, the importance of the discovery in resolving the issues, and 2 whether the burden or expense of the proposed discovery outweighs its likely benefit.” Fed. R. 3 Civ. P. 26(b)(1). 4 III. DISCUSSION 5 A. RFP 11 – Access, Purpose, Use, Control of Data 6 RFP 11 asks Meta to produce “documents and communications relating to” four categories 7 of information regarding “data” collected by Meta through its Pixel and SDK (and possibly via 8 other means)4: (1) who may access the data or “derivatives thereof”; (2) for what purposes; 9 (3) how that data/derivatives thereof “may be and are used”; and (4) controls or similar measures 10 to prevent use of the data. Plaintiff does not explain why she requires discovery of this scope, 11 except to say that documents regarding these matters are “unlikely to be application or website 12 specific.” Dkt. No. 186 at 2. Meta objects that this request is overbroad as it seeks information 13 regarding Meta’s “tracking technology” generally and is not tailored to the user data at issue in 14 this case, which is user data Meta received from Favor. Id. at 4. 15 The Court agrees with Meta that RFP 11 is overbroad in several respects. First, the request 16 is not limited to the user data (or even the kind of user data) at issue in the case—i.e. user data 17 from the Favor platform. Second, the request is not limited to the specific means by which 18 plaintiff alleges Meta collected user data from the Favor platform—i.e. the SDK and the Pixel. 19 Third, the request is not limited to the purposes for which relevant data was used but includes any 20 purposes for which it “may” be used. Fourth, to the extent the request encompasses documents 21 and communications “relating to” these four categories of information, it seeks discovery that is 22 not proportional to the needs of the case.5 23 4 The parties advised that they disagree about plaintiff’s definition of “Tracking Technology,” but 24 that this dispute is not presently at issue. Dkt. No. 189.

25 5 Plaintiff’s present effort to obtain general discovery of Meta’s “tracking technology” and its uses contrasts with her earlier representations regarding the distinct scope of discovery required for this 26 action. See, e.g., Dkt. No. 78 at 8:6-8 (distinguishing Favor action from other actions involving use of Meta’s business tools as involving “different users of different platforms who had different 27 data collected through different combinations of tracking technology during different time 1 Meta proposes to search for and produce: “documents regarding (1) the personnel or teams 2 who had access to user data received via the Meta Pixel or SDK from Favor; (2) the purposes for 3 which personnel or teams had access to user data received via the Meta Pixel and SDK from 4 Favor; (3) the purposes for which user data received via the Meta Pixel or SDK from Favor was 5 used; and (4) the controls, systems, processes, or rules that Meta had in place to prevent the use of 6 user data received via the Meta Pixel or SDK from Favor during the Relevant Time Period.6 Id. at 7 4. The Court agrees that Meta’s proposal is reasonable. While plaintiff may be correct that 8 responsive documents are unlikely to be platform-specific, the Court does not understand Meta to 9 suggest it will limit its production in the manner plaintiff fears. For example, while Meta proposes 10 to produce documents regarding personnel or teams who had access to user data received from 11 Favor, it does not propose that its responsive production will be limited to personnel or teams who 12 only had access to user data received from the Favor platform—i.e. the same personnel or teams 13 likely also had access to user data received from other platforms. On the other hand, it would be 14 unreasonable to require Meta to search for responsive documents relating to any data, from any 15 platform, via any “tracking technology,” received for any purpose, and put to any use. 16 For this reason, the Court adopts Meta’s proposal, as construed by the Court, regarding 17 production of documents responsive to RFP 11. 18 B. RFP 27 – Potential Uses 19 RFP 27 asks Meta to produce documents regarding actual and potential uses of Favor User 20 Data, and actual and potential uses of other “health or medical data.” 21 Plaintiff argues that discovery of potential uses of Favor User Data will reveal information 22 about Meta’s capability for using this data, which is relevant to Meta’s twenty-first7 affirmative 23 defense. Id. at 2. That defense asserts that because Meta was a party to the communications at 24

25 to different mobile applications, websites, transactions, and underlying data.”).

26 6 Plaintiff defines “Relevant Time Period” as “the period from 2016 to the present.” Dkt. No. 186- 1. 27 1 issue in plaintiff’s CIPA claims, no interception occurred. See id. (citing Dkt. No. 139 and Javier 2 v. Assurance IQ,

, 900 (N.D. Cal. 2023)). Meta responds that “potential uses” 3 of the Favor User Data have nothing to do with its affirmative defense. As Meta explained at the 4 hearing, this defense does not rely on a theory that Meta provided services indistinguishable from 5 a “tape recorder,” but rather that Meta (and not plaintiff or other Favor users) was the only 6 relevant party to the communications at issue. The Court agrees with Meta that documents 7 reflecting “potential uses” of Favor User Data are not relevant to Meta’s twenty-first affirmative 8 defense. 9 Plaintiff argues that “potential uses” of Favor User Data are also relevant to quantifying the 10 value of the data for assessing unjust enrichment or damages on behalf of the putative class.

at 11 3. Meta responds that it has already agreed to search for documents regarding the value of the 12 Favor User Data Meta received in response to RFP 26, and that it should not additionally be 13 required to search for documents regarding “potential uses” of that data untethered to discussions 14 of value. Id. at 5. On the present record, the Court is not persuaded that documents regarding 15 “potential uses” of Favor User Data are relevant to plaintiff’s unjust enrichment claim or her 16 damages. Plaintiff’s unjust enrichment claim refers to benefits Meta actually received from user 17 data that Meta “intercepted, stored, and used . . . for [its] own gain . . . including highly valuable 18 data for analytics, advertisement, and improvement of their platforms, algorithms, and advertising 19 services.” Dkt. No. 133 ¶ 209. With respect to her other claims, plaintiff argues that documents 20 discussing potential uses of Favor User Data “can be used to independently and objectively 21 quantify the value of this data through expert testimony.” Dkt. No. 186 at 3. It is not entirely 22 clear how plaintiff or her expert expect “potential uses” of Favor User Data to inform her damages 23 theories for these other claims, particularly when many of plaintiff’s damages theories appear to 24 depend on actual receipt and actual use of the data. See, e.g., id. ¶ 203 (disgorgement of profits), 25 ¶ 224 (statutory damages). While plaintiff also seeks “damages that will reasonably compensate 26 Plaintiffs and Class members for the harm to their privacy interests,” id. ¶ 203; see also id. ¶¶ 162- 27 163, she cites no authority for the proposition that compensatory damages may be calculated, in 1 in this action. The relevance of the discovery plaintiff seeks in RFP 27 is even more attenuated 2 with respect to “potential uses” of any “health or medical data,” beyond the Favor User Data at 3 issue in this case. 4 For these reasons, on this record the Court concludes that Meta need not produce 5 documents regarding “potential uses” of Favor User Data or other “health or medical data” in 6 response to RFP 27. 7 C. RFP 1 – Government and Regulatory Investigations 8 As modified by plaintiff, RFP 1 asks Meta to produce communications exchanged with 9 government regulators regarding Meta’s “collection, transmittal, disclosure, or use” of Favor User 10 Data or other “health or medical data.” Plaintiff argues that these documents are relevant to show 11 that Meta was on notice of concerns by regulators about its practices concerning user data, and to 12 show what actions, if any, it took as a result of inquiries by such regulators. Dkt. No. 187 at 3. 13 Meta responds that it should only be required to produce communications exchanged with “any 14 U.S. regulatory body or government agency in response to an investigation or inquiry regarding 15 the collection, transmittal, disclosure, or use of Health or Medical Data received via the Pixel or 16 SDK from Favor.” Id. at 5. Meta objects to producing documents concerning communications 17 with foreign regulators or concerning investigations unrelated to user data obtained from Favor. 18 Id. 19 This dispute is difficult to fully resolve on the record presented. While the Court agrees 20 with Meta that plaintiff’s request for responsive documents concerning any “health or medical 21 data” and any domestic or foreign regulatory agency is too broad, the scope of production Meta 22 proposes is unreasonably constrained. Rather, discovery is appropriately limited to 23 communications Meta exchanged with regulatory agencies, whether in the U.S. or elsewhere, 24 concerning the same kinds of data as the Favor User Data at issue here and the same practices at 25 issue here, as opposed to any and all “health or medical data” and any all “tracking technology” 26 and uses thereof. See, e.g., In re Toyota Motor Corp. Sec. Litig., No. 10-cv-0922 DSF AJWX, 27

, at *16 (C.D. Cal. Mar. 12, 2012) (permitting discovery of domestic and 1 complaint). 2 With this guidance, the Court expects the parties to agree on a more precise description of 3 the data and practices that should define the scope of Meta’s obligations with respect to RFP 1. 4 D. Definition of “Health or Medical Data” 5 The parties agree that the phrase “health or medical data,” as used in plaintiff’s requests, 6 should encompass “information that relates to the past, present, or future, physical or mental 7 health condition of an individual, the provision of health care to an individual, or the past, present, 8 or future payment for the provision of health care to an individual.” See Dkt. No 187 at 1, 4. 9 Plaintiff contends that relevant information within the scope of this definition need not be 10 “accompanied by an individual’s name or other forms of personally identifying information.”

11 at 1. Meta contends that relevant information within the scope of this definition must “identify an 12 individual” or that at least there must be a “reasonable basis to believe it can be used to identify an 13 individual.” Id. at 4. 14 As the parties recognize, the Court is being asked to resolve this disagreement without 15 regard to the context of any particular discovery request. Neither party explains what the phrase 16 they agree upon—“information that relates to the [medical condition or healthcare] of an 17 individual”—means, and neither explains what their respective further qualifications of that phrase 18 include or exclude. The Court agrees with plaintiff that it makes little sense to exclude from the 19 definition information that is, in fact, associated with a unique individual simply because that 20 individual’s name or other identifying information does not accompany the information when 21 Meta receives it. But the Court does not understand Meta’s proposal to be so limited. If Meta can 22 associate a piece of information with a unique identifier, such as a cookie or a Facebook ID, that 23 can be used by Meta to link the information with an individual (whether Meta does so or not), then 24 such information might be considered information of an individual and within the scope of the 25 agreed definition. If such linkage is not possible, then the Court fails to see how it can be 26 information “of an individual.” 27 Again, with this guidance, the Court expects the parties to agree on appropriate parameters 1 IV. CONCLUSION 2 During the hearing, the parties advised that they will be able to make progress with 3 discovery in this matter once the foregoing disputes are resolved. Now that they have been 4 || resolved, the Court expects the parties to conduct discovery in an expeditious manner that permits 5 them to meet the substantial completion deadline of June 6, 2025. 6 IT IS SO ORDERED. 7 Dated: February 12, 2025 <8 8 Virginia K. DeMarchi 9 United States Magistrate Judge 10 11 12

13

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28