FILED
NOT FOR PUBLICATION
DEC 06 2018
UNITED STATES COURT OF APPEALS MOLLY C. DWYER, CLERK
U.S. COURT OF APPEALS
FOR THE NINTH CIRCUIT
WINSTON SMITH; et al., No. 17-16206
Plaintiffs-Appellants, D.C. No. 5:16-cv-01282-EJD
v.
MEMORANDUM*
FACEBOOK, INC.,
Defendant-Appellee,
and
AMERICAN CANCER SOCIETY, INC.;
et al.,
Defendants.
Appeal from the United States District Court
for the Northern District of California
Edward J. Davila, District Judge, Presiding
Argued and Submitted October 16, 2018
San Francisco, California
*
This disposition is not appropriate for publication and is not precedent
except as provided by Ninth Circuit Rule 36-3.
Before: THOMAS, Chief Judge, GRABER, Circuit Judge, and LASNIK,** District
Judge.
Plaintiffs, Winston Smith and two Jane Does, appeal the district court’s
dismissal of their complaint alleging that Facebook violated numerous federal and
state laws by collecting and using their browsing data from various healthcare-
related websites. We have jurisdiction pursuant to 28 U.S.C. § 1291, and we
review the district court’s dismissal de novo. Arakaki v. Lingle, 477 F.3d 1048,
1056 (9th Cir. 2007). We affirm.
I
The district court properly held that Plaintiffs consented to Facebook’s data
tracking and collection practices. In determining consent, courts consider whether
the circumstances, considered as a whole, demonstrate that a reasonable person
understood that an action would be carried out so that their acquiescence
demonstrates knowing authorization. Plaintiffs do not dispute that their acceptance
of Facebook’s Terms and Policies “constitutes a valid contract.” Those Terms and
Policies contain numerous disclosures related to information collection on third-
party websites, including: “We collect information when you visit or use third-
party websites and apps that use our Services . . . . This includes information about
**
The Honorable Robert S. Lasnik, United States District Judge for the
Western District of Washington, sitting by designation.
2
the websites and apps you visit, your use of our Services on those websites and
apps, as well as information the developer or publisher of the app or website
provides to you or us,” and “we use all of the information we have about you to
show you relevant ads.” A reasonable person viewing those disclosures would
understand that Facebook maintains the practices of (a) collecting its users’ data
from third-party sites and (b) later using the data for advertising purposes.
Knowing authorization of the practice constitutes Plaintiffs’ consent. United States
v. Staves, 383 F.3d 977, 981 (9th Cir. 2004) (noting that consent, though generally
express, may be implied where there are surrounding circumstances indicating that
an individual knowingly agreed to an action).
Plaintiffs claim that—though they gave general consent to Facebook’s data
tracking and collection practices—they did not consent to the collection of health-
related data due to its “qualitatively different” and “sensitive” nature. We do not
agree that the collected data is so different or sensitive. The data show only that
Plaintiffs searched and viewed publicly available health information that cannot, in
and of itself, reveal details of an individual’s health status or medical history.
Moreover, many other kinds of information are equally sensitive. We conclude
that the practice complained of falls within the scope of Plaintiffs’ consent to
Facebook’s Terms and Policies.
3
Finally, Plaintiffs assert that Facebook could not have gained consent
because the healthcare websites’ privacy policies promised not to share data with
third parties. But Facebook’s Terms and Policies make no such assurance, and
Facebook is not bound by promises it did not make. Therefore, we affirm the
district court’s finding that Plaintiffs consented to Facebook’s data tracking and
collection practices.
II
The district court also properly rejected Plaintiffs’ claims that the collected
data is subject to more stringent disclosure requirements under the Health
Information Portability and Accountability Act of 1996 (“HIPAA”) (codified as
amended in scattered sections of 42 U.S.C.) and California Civil Code section
1798.91 (2014). Information available on publicly accessible websites stands in
stark contrast to the personally identifiable patient records and medical histories
protected by these statutes—information that unequivocally provides a window
into an individual’s personal medical history. See, e.g., United States v. Huping
Zhou, 678 F.3d 1110, 1112 (9th Cir. 2012) (protecting disclosure of a hospital’s
patient records under HIPAA). Put simply, the connection between a person’s
browsing history and his or her own state of health is too tenuous to support
4
Plaintiffs’ contention that the disclosure requirements of HIPAA or section
1798.91 apply.
III
In sum, the district court properly dismissed the complaint. Given our
resolution of these issues, we need not reach any other issues urged by the parties.
AFFIRMED.
5