1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 JOHN DOES 1-5, et al., Case No. 23-cv-02865-EMC

8 Plaintiffs, ORDER RE PLAINTIFFS’ MOTION 9 v. FOR PRELIMINARY APPROVAL

10 KAISER FOUNDATION HEALTH PLAN, INC., et al., Docket No. 345 11 Defendants. 12 13 14 Plaintiffs are individuals who have filed a class action against three Kaiser entities1 15 (collectively, “Kaiser”). Plaintiffs allege that Kaiser violated their privacy rights, and those of 16 others similarly situated, in violation of various federal and state laws. According to Plaintiffs,

17 unbeknownst to Plaintiffs and other Kaiser Plan Members, Kaiser has installed code from multiple third parties throughout the Kaiser 18 website and mobile applications that allows third party companies, including but not limited to Quantum Metric, Twitter, Adobe, 19 Microsoft Bing, . . . Google[,] [and Dynatrace] (collectively, “Third Party Wiretappers”) to intercept the content of Plaintiffs and Class 20 Members’ patient status, identifying information, medical topics researched, choices made, information shared and communications 21 with their medical providers, including personally identifiable medical information, Protected Health Information (“PHI”) that 22 Kaiser was required to protect under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d-6, 23 and other confidential information and communications, when that information is in transit. 24 25 CAC ¶ 4. 26 Now pending before the Court is Plaintiffs’ motion for preliminary approval of a class 27 1 action settlement. The settlement is between Plaintiffs and only one Kaiser entity: KFHP. The 2 parties have stipulated to a dismissal of the other two Kaiser entities. See Docket No. 347 3 (stipulation). The dismissal of those two entities would be without prejudice but would convert to 4 a dismissal with prejudice once, in essence, there is final approval of the class action settlement 5 and a final judgment. 6 Objections have been filed with respect to the motion for preliminary approval. One set of 7 objectors is represented by the three law firms: Labaton, Milberg, and Bryson. The firms also 8 represent thousands of other Kaiser plan members. The other set of objectors is represented by the 9 Potter firm. Potter also represents thousands of other Kaiser plan members. For convenience, the 10 first set of objectors shall hereinafter be referred to as the Labaton Objectors and the second set as 11 the Potter Objectors.2 12 Having considered both the parties and the Objectors’ submissions, as well as the oral 13 argument of counsel, the Court hereby rules as follows. 14 I. DISCUSSION 15 A. Settlement Terms 16 Here, the parties have agreed to a gross settlement fund of $46 million (which could 17 increase up to $47.5 million) for a settlement class of approximately 13.1 million people. The net 18 settlement fund is expected to be about $27.48 million once deductions are taken for, e.g., 19 attorneys’ fees, litigation expenses, settlement administration fees, and incentive awards. If there 20 is a claims rate of 5-10% (as anticipated by the settlement administrator), the payout to each 21 claiming class member would be about $20.98-$41.95. Each class member has already benefited 22 from Plaintiffs’ litigation of this case because, after Plaintiffs moved for a preliminary injunction, 23 “Kaiser disabled, deleted, or modified the internet technologies provided by Adobe, Bing, Google, 24 Twitter, and Quantum Metric” and further migrated “Dynatrace technology to the on-premises 25 deployment model offered by Dynatrace”; in addition, Kaiser implemented consent banners on its 26 2 The Potter Objectors did not timely file their brief. Nor did the Potter Objectors provide any 27 explanation as to why they failed to timely file. Their attorneys have been well aware of this 1 website and apps. Docket No. 374 (Pls. Supp. Br. at 7-8). 2 B. Judicial Review of Proposed Class Action Settlement 3 Under Federal Rule of Civil Procedure 23(e), a court may approve a proposed settlement 4 of a class action if it is fair, reasonable, and adequate. See Fed. R. Civ. P. 23(e)(2) (listing factors 5 for a court to consider); Hanlon v. Chrysler Corp.,

, 1026 (9th Cir. 1998) (same). 6 The Court has considered the factors identified in Rule 23(e)(2) and Hanlon. It finds that the 7 proposed settlement falls within the range of reasonableness such that notice of the proposed 8 settlement should be given to the class.3 The risk of continuing litigation is significant. As 9 indicated by the Court’s order granting in part Kaiser’s motion to dismiss the first amended 10 complaint, it is not clear that Kaiser allowed the code on its website and apps for the benefit of the 11 third parties (as opposed to itself). The parties have also pointed to additional risks in the opening 12 brief, including the following: 13 • Individuals could be subject to arbitration (such as the named California plaintiff). 14 See Mot. at 12. 15 • For the nationwide claims, choice of law could be a problem. See Mot. at 12. 16 • Privacy breach case law is still developing (e.g., damages methodologies). See 17 Mot. at 13 n.11. 18 • Not all claims would necessarily survive – e.g., in its order granting in part the 19 motion to dismiss the first amended complaint, the Court dismissed Plaintiffs’ 20 claims for violations of the Electronic Communications Privacy Act, the California 21 Invasion of Privacy Act, and the California Confidentiality of Medical Information 22 Act. See Mot. at 13. 23 • If claims with statutory damages were dismissed, then there might only be nominal 24 damages or damages could be too individualized. See Mot. at 12-13. 25 Notably, Objectors do not make any contention that the relief provided for by the proposed 26

27 3 In so ruling, the Court is not holding, e.g., that the attorneys’ fees sought is appropriate and 1 settlement is unreasonable as a substantive matter – e.g., that the gross settlement fund is too low. 2 Rather, Objectors’ main challenge is to the definition of the class; Objectors seek to be excluded 3 from the class. Objectors also contend that, if they are included within the definition of the class, 4 then they should be permitted to do “mass opt-outs”; for example, individuals represented by the 5 same counsel should be able to opt out by their attorney submitting an opt out that covers all of 6 them in one fell swoop. Finally, Objectors suggest that California Kaiser plan members have 7 better claims compared to non-California plan members and that the allocation of the settlement 8 fund should reflect this. 9 C. Settlement Class Definition 10 The definition of the settlement class in the case at bar takes into account this Court’s 11 rulings in In re 23andMe, Inc. Customer Data Sec. Breach Litig., No. 24-md-03098-EMC, 2024

(N.D. Cal. Dec. 4, 2024). There, the Court held that the settlement class 13 definition should be “modified to exclude those 23andMe customers who have chosen to exercise 14 their right to arbitrate, whether by making a mere demand for arbitration or by filing a formal 15 complaint with the arbitral forum (but not, e.g., simply threatening to arbitrate).”

at *43 16 (conditioning preliminary approval on a modification to the settlement class definition); see also 17 id. at *41 (indicating that those in arbitration cannot “be included in a certified class given 18 potential concerns about typicality/adequacy”).4 19 Here, the parties have agreed to a settlement class definition that recognizes exclusion of 20 those in arbitration but only on certain terms. Essentially, the settlement class definition provides 21 that, if an individual did not perfect their arbitration request, they are included in the settlement 22 class.

23 “Perfected Arbitration Claim” means the Claim of a current or former Kaiser Permanente member who completed either of the 24 following on or before the filing of the Motion for Preliminary Approval of the Settlement: 25 (a) Preparing and serving an individual demand for arbitration 26

27 4 In addition, there may be concerns of lack of commonality under Rule 23(a) and predominance pursuant to Rules 7 and 8 of the Rules for Kaiser Permanente 1 Member Arbitrations of the Office of the Independent Administrator (the “Rules”); and the claimant or their 2 counsel has paid the $150 filing fee required by Rule 12 or submitted a filing fee waiver pursuant to Rule 13; or 3 (b) Where the current or former Kaiser Permanente member was 4 included on a Demand for Arbitration on behalf of 25 or more claimants that was prepared and served pursuant to 5 Rules 7 and 8 of the Rules, the Demand complies with Rule 4(a) of the Supplemental Rules Governing Mass Arbitrations 6 (the “Supplemental Rules”) and the claimant or their counsel has paid the $150 filing fee required by Supplemental Rule 5 7 and Rule 12

8 for claims that refer to, relate to, or are otherwise based on any act, omission, practice, or conduct alleged or at issue in the Consolidated 9 Class Action Complaint. 10 Sett. Agmt. ¶ 1.11 (emphasis added). 11 As an initial matter, the Court notes that – though not entirely clear – Objectors seem to 12 argue that something less than a formal demand for arbitration (or a formal filing of an arbitration 13 complaint) should be good enough to take someone out of the settlement class definition. See 14 Labaton Opp’n at 3 (asking for exclusion of “all individuals who have attempted to arbitrate or 15 provided notice of their intent to arbitrate”). But in 23andMe, this Court essentially rejected that 16 position, stating that “the settlement class definition agreed to by the parties must be modified to 17 exclude those 23andMe customers who have chosen to exercise their right to arbitrate, whether by 18 making a mere demand for arbitration or by filing a formal complaint with the arbitral forum (but 19 not, e.g., simply threatening to arbitrate).” 23andMe,

, at *43 20 (emphasis added). The Court thus rejects Objectors’ contention here. 21 That being said, the Court agrees with Objectors that the settlement class definition as 22 phrased inappropriately includes the requirement that a class member must have paid the filing 23 fee. The 23andMe settlement class definition did not include that requirement, and the Court sees 24 no reason to impose such a requirement. If an individual chose arbitration with Kaiser and then 25 (for whatever reason) did not pay the filing fee, then the arbitration would go no further. That 26 would not necessarily then give the person the right to jump back into litigation. Requiring 27 payment of the arbitration filing fee would be particularly problematic in this case where the 1 allowed a consolidated demand for arbitration with payment of only $150 total. 2 This leaves the Court with one final issue regarding the settlement class definition: should 3 the Labaton clients and some of the Potter clients be excluded from the settlement class definition 4 because they did demand arbitration even if they subsequently abandoned arbitration by initiating 5 lawsuits in state court? The Labaton clients have filed a class action lawsuit in state court, 6 asserting not clarification and enforcement of arbitration, but the same substantive privacy claims 7 against Kaiser asserted in the instant case. Likewise, nearly all the Potter clients (with the 8 exception of a small number of individuals who are still actively pursuing arbitration) have joined 9 one of five mass actions filed in state court, asserting substantive claims similar to those asserted 10 in the instant case. Labaton and Potter argue that their clients who have filed suit should still be 11 excluded from the class even though they are no longer actively pursuing arbitration. Labaton and 12 Potter suggest that they were forced to file lawsuits on their clients’ behalf because, even though 13 the clients wanted to arbitrate, Kaiser improperly had the arbitral rules changed once the mass 14 arbitrations were initiated. Thus, Labaton and Potter essentially argue that, as an equitable matter, 15 their clients should be counted as arbitrating individuals and thus categorically excluded from the 16 defined class herein. But even if the Labaton and Potter clients were “forced” to file lawsuits,5 the 17 Court in 23andMe did not exclude those in arbitration because of equitable reasons; rather, it did 18 so because of Rule 23’s requirements on, e.g., typicality and adequacy where such putative class 19 members would be litigating in two independent fora. Because the Labaton and Potter clients are 20 all now in litigation and have effectively withdrawn from arbitration (at least for purposes of this 21 Court’s adjudication of the class definition for purposes of the present proposed settlement), the 22 Rule 23 concerns that drove the exclusion in 23andMe no longer apply. 23 Therefore, so long as the settlement class definition is modified so that exclusion extends 24 only to those who have demanded or initiated arbitration and are still in the arbitration track, and 25 not to those who are now in the state court litigation track, the Court would be inclined to grant 26 5 In the case filed by the Labaton clients (Guevara), the complaint did not contain any allegations 27 about asking for a return to arbitration because of inappropriate conduct by Kaiser. Although the 1 preliminary approval. The Labaton and Potter clients would fall within the settlement class 2 definition by virtue of having, at least for purposes of the current motion before this Court, 3 effectively abandoned arbitration by filing and joining a suit in state court. 4 D. Mass Opt-Outs 5 In 23andMe, the Court already indicated that it would not permit mass opt-outs. See 6 23andMe, Inc.

, at *84 (not permitting en masse objections; citing 7 in support In re CenturyLink Sales Pracs. & Sec. Litig., MDL No. 17-2795 (MJD/KMM), 2020

, at *9-10 (D. Minn. June 29, 2020), where court explained that “‘the 9 requirement that a class member must individually sign is vital, because it ensures that the class 10 member is individually consenting to opt out, and avoids a third party or lawyer representing that 11 they have that class member's authority, without the class member making an informed, individual 12 decision’”). 13 The Court acknowledges that, in a decision that issued subsequently, Judge Freeman 14 allowed for mass opt-outs. Specifically, she accepted a mass opt-out from the Labaton firm, 15 which claimed to represent approximately 69,500 individuals.

16 Here, Labaton has represented under oath that each of the Arbitration Claimants did make an individualized decision to retain 17 Labaton's legal services and to opt out from the Class in order to pursue claims in arbitration. The Court sees no reason why the 18 Arbitration Claimants may not act through their attorneys in executing those requests to opt out of the Class. As the Court noted 19 at the hearing, should it turn out that any of the Arbitration Claimants did not so retain and authorize Labaton, those individuals 20 would have a malpractice remedy. And for any opt-out claimant who does not have an arbitration agreement with Google, Labaton 21 has confirmed that its representation will cover their pursuit of their claims in other judicial forums. In short, the Court rejects Google's 22 argument that accepting these opt-outs presents a due process issue. 23 In re Google Assistant Priv. Litig., No. 5:19-cv-04286-BLF,

, at *9- 24 10 (N.D. Cal. Feb. 14, 2025). This Court respectfully disagrees. It is questionable whether a 25 malpractice suit is a real remedy: malpractice claims generally have rigorous standards (including 26 having to prove prejudice which often requires the plaintiff to demonstrate a likelihood she would 27 have prevailed in the underlying case but for the malpractice), and an individual may not be in a 1 in essence, a fiduciary duty to the class. 2 The Potter firm argues that, even aside from the mass opt-out issue, the opt-out process is 3 burdensome and confusing. It makes, for example, the following criticisms: 4 • The short-form notice is what the settlement class members will receive (the long- 5 form is available only on the settlement website), and it does not spell out the 6 details of the opt-out process in and of itself but rather requires members to refer to 7 the long-form notice. See Opp’n at 8. 8 • Settlement class members may not want to opt out online given that their personal 9 information has already been compromised. See Opp’n at 8-9. 10 • Online opt-outs are also problematic because settlement class members could be 11 discouraged from opting out if the settlement website is confusing, is slow to load, 12 or goes offline. See Opp’n at 9. 13 • The long-form notice is too long (15 pages). See Opp’n at 9. 14 • A settlement class member cannot opt out without having their unique settlement 15 ID number; it would be easier for members to opt out by using their Kaiser member 16 ID numbers instead. See Opp’n at 9. 17 These criticisms largely lack merit. For example, it makes sense to have a short-form 18 notice go out in the first instance for several reasons: (1) given the number of settlement class 19 members, it would be more expensive to send out long-form notices, at least by mail, cf. Supp. 20 Mulholand Decl. ¶ 3 (noting that to mail the short-form notice to 13.1 million settlement class 21 members would cost about $9 million); and (2) even though e-mail notice could accommodate the 22 long-form notice, it would likely be more of a deterrent to have the long-form notice in the e-mail 23 (i.e., settlement class members likely would not want to read an email of any significant length). 24 As for the means of opting out, a settlement class member can opt out by mail, not just online. To 25 the extent Potter argues that there is no need for a settlement ID number given that the class 26 members should have Kaiser member IDs, a Kaiser member ID is, in and of itself, private 27 information. Requiring disclosure of such personal health-related information on an opt-out form 1 find their unique settlement ID number, that should be easily addressable – i.e., the settlement ID 2 number can be place prominently on the notice, and the member can contact the settlement 3 administrator for help. 4 While the Court rejects Objectors’ arguments above, it emphasizes that the individualized 5 opt-out process should not be cumbersome or burdensome. In this regard, the Court does not take 6 issue with, e.g., a longer opt-out period so that Labaton and Potter can have more time to get the 7 individualized opt-outs. The individualized opt-outs should also be acceptable with either a wet- 8 ink signature or an electronic one (e.g., Docusign). If Labaton and Potter wish to collect the 9 individualized opt-outs and then give them to the settlement administrator (rather than requiring 10 each member opting out to send their form to the class action administrator or the Court), that 11 would appear to be a reasonable request. The Court orders the parties and Objectors to meet and 12 confer to determine a reasonable process for individualized opt-outs to be made. The parties 13 and/or Objectors may wish to include the settlement administrator in these discussions. 14 Finally, the Court notes that both the parties and Objectors have agreed that, should there 15 be any individuals who are excluded from the settlement class because they have demanded or 16 initiated arbitration, they should be given notice of the settlement so that they have an opportunity 17 to “opt in.”6 The Court directs the parties and Objectors to discuss the opt-in process as well. 18 E. California Plan Members 19 Finally, Objectors claim that California plan members (such as themselves) have higher- 20 value claims compared to non-California plan members, but the parties’ settlement agreement – or 21 rather, the plan of allocation established by Plaintiffs – does not recognize such. But Objectors’ 22 position fails to take into account that this Court already indicated in its prior order granting in part 23 Kaiser’s motion to dismiss that there were problems with the California claims. Given the 24 litigation risk, it is not clear that California plan members are in a stronger position compared to 25 non-California plan members. Furthermore, all class members face the same litigation risk of 26 whether Kaiser intentionally or negligently allowed third parties to use plan member information 27 1 for their own benefit (as opposed to Kaiser’s). It is also worth noting that a reallocation does not 2 || make much sense given the relatively small payouts that are expected in this case. If a given class 3 member believes that they are entitled to a higher payout, they can opt out. 4 Il. CONCLUSION 5 For the foregoing reasons, the Court is inclined to grant preliminary approval to the 6 || proposed class action settlement but that will turn on modification of the settlement class 7 definition and opt-out means, as discussed above. 8 The Court continues the hearing on preliminary approval to November 25, 2025, at 1:30 9 || p.m. The hearing will be held via Zoom. By November 13, 2025, the parties and Objectors shall 10 || file supplemental papers addressing the results of their meet and confer. (If the settlement 11 agreement, class notice, etc. are modified, such papers shall also be filed at that time.) If there are 12 || disagreements, each party or Objector shall state its last offer of compromise. The Court strongly 13 prefers a joint filing by the parties and Objectors.

IT IS SO ORDERED.

17 Dated: October 24, 2025

19 EDW. . CHEN 20 United States District Judge 21 22 23 24 25 26 27 28