Ramirez v. LasikMD USA INC.

1
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF CALIFORNIA
JUAN RAMIREZ, individually and on
behalf of all others similarly situated,
Plaintiffs,
v.
LASIKMD USA, INC., et al.,
Defendants.
Case No.: 24-cv-2221-CAB-DDL
ORDER ON MOTION TO DISMISS
[Doc. No. 23]
Plaintiff Juan Ramirez, individually and on behalf of all others similarly situated,
filed his first amended complaint against defendant VGC Group LP1 (“VGC”) for
violations of the Electronic Communications Privacy Act (“ECPA”); the California
Invasion of Privacy Act (“CIPA”); and Invasion of Privacy under California’s Constitution.
[Doc. No. 13.] Defendant VGC moves to dismiss pursuant to Fed. R. Civ. P. 12(b)(2) and
12(b)(6). [Doc. No. 23.] The matter has been fully briefed. [Plaintiff’s Opposition at Doc.
No. 24; Defendant’s Reply at Doc. No. 25.] 	The Court finds the matter suitable for
determination on the papers. 	CivLR 7.1(d)(1). 	For the following reasons, Defendant’s
motion is GRANTED IN PART and DENIED IN PART.
1 VGC is the only remaining defendant is this matter and brings this motion.
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 1 of 8

2
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
I. 	BACKGROUND
Plaintiff alleges the following facts, which are assumed to be true for the purposes
of this motion. 	Am. Fam. Ass’n, Inc. v. City & Cnty. of San Francisco, 277 F.3d 1114,
1120 (9th Cir. 2002).
VGC operates the website us.lasikmd.com (the “Website”). Through this Website
Plaintiff scheduled medical consultations and appointments for a medical procedure,
specifically laser vision correction. 	[Doc. No. 13, at ¶¶ 6–14.] 	Plaintiff disclosed
confidential, 	protected, 	and 	individually 	identifiable 	health 	information 	in 	his
communications with the Website. [Id.]
Plaintiff never consented, agreed, authorized, or otherwise permitted the disclosure
of his confidential, protected, and individually identifiable medical information to any third
party. [Id. at ¶ 44.] Plaintiff was never provided with any written notice that VGC would
disclose his confidential, protected, and individually identifiable medical information to
any third party, nor was he provided with any means of opting out of such disclosures.
[Id.]
Unknown to Plaintiff, the Website hosted code for the Facebook Tracking Pixel.
Through this tracking code, the confidential medical information Plaintiff communicated
to the Website was concurrently transmitted to Facebook, a third party. [Id. at ¶¶ 19, 20,
27, 31, 32.] 	Plaintiff had an active Facebook account at the time and transmissions of
Plaintiff’s medical communications with the Website also disclosed his personally
identifiable information, including his unique Facebook ID. 	[Id. at ¶¶ 5, 33.] 	Facebook
then used this information to personalize advertising to him and he received such targeted
advertisements. [Id. at ¶¶ 7, 23.] Plaintiff did not consent to Facebook’s access to and use
of his personal medical information. [Id. at ¶ 45.]
Plaintiff asserts that unauthorized transmission by VGC of his personally identifiable
health information to Facebook, a third party, violated the ECPA, CIPA and was an
invasion of his privacy under the California Constitution. VGC moves to dismiss all three
counts for lack of Article III standing and failure to state a claim.
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 2 of 8

3
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
II. 	DISCUSSION
A. 	Plaintiff Has Article III Standing for His ECPA and CIPA Claims
Standing is an essential part of the case-or-controversy requirement of Article III.
Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). 	To satisfy Article III’s standing
requirements, a plaintiff must show (1) he has suffered an injury in fact that is (a) concrete
and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury
is fairly traceable to the challenged actions of the defendant; and (3) it is likely, as opposed
to merely speculative, that the injury will be redressed by a favorable decision. Id. at 560–
61. 	“At the pleading stage, general factual allegations of injury resulting from the
defendant’s conduct may suffice.” 	Id. at 561. 	In a class action seeking equitable relief,
standing is satisfied if at least one named plaintiff meets the requirements. Bates v. United
Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007).
VGC argues that Plaintiff has not demonstrated injury in fact for Article III standing
because the alleged harm to his right to privacy is a generalized interest in controlling
information concerning his person which is insufficient, citing 	TransUnion LLC v.
Ramirez, 594 U.S. 413 (2021). The Court disagrees.
Plaintiff alleges that he used the Website to schedule medical appointments which
resulted in the unauthorized tracking technology disclosing his personally identifiable,
confidential medical information to Facebook and he received targeted advertisements as
a result. The unauthorized disclosure of personally identifiable, confidential medical
information is a sufficiently concrete and particularized harm for standing. 	Id. at 425
(“Various intangible harms can also be concrete. Chief among them are injuries with a
close relationship to harms traditionally recognized as providing a basis for lawsuits in
American courts. 	Those include, for example, reputational harms, disclosure of private
information, and intrusion upon seclusion.” (internal citation omitted)). 	Defendant’s
motion to dismiss for lack of Article III standing as to this ECPA and CIPA claims is
DENIED.
///
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 3 of 8

4
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
B. 	Plaintiff States a Claim for ECPA and CIPA Violations
VGC argues, should the Court find Plaintiff has Article III standing, each of the
asserted causes of action should still be dismissed pursuant to Fed. R. Civ. P. 12(b)(6).
Under Rule 12(b)(6), a party may bring a motion to dismiss for failure to state a
claim upon which relief can be granted. When evaluating a Rule 12(b)(6) motion, a court
must accept all material allegations in the complaint, as well as reasonable inference to be
drawn from them, as true and construe them in the light most favorable to the non-moving
party. 	Doe v. United States, 419 F.3d 1058, 1062 (9th Cir. 2005). 	A court may dismiss
“based on the lack of cognizable legal theory or the absence of sufficient facts alleged
under a cognizable legal theory.” 	Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699
(9th Cir. 1988). Although a complaint need contain only “a short and plain statement of
the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), to survive
a motion to dismiss it “must contain sufficient factual matter, accepted as true, to ‘state a
claim to relief that is plausible on its face.’” 	Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)
(quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). 	A complaint must
include 	something 	more 	than 	“an 	unadorned, 	the-defendant-unlawfully-harmed-me
accusation” or “‘labels and conclusions’ or ‘a formulaic recitation of the elements of a
cause of action[.]’” Id. (quoting Twombly, 550 U.S. at 555). 	Determining whether a
complaint will survive a motion to dismiss for failure to state a claim is a “context-specific
task that requires the reviewing court to draw on its judicial experience and common
sense.” Id. at 679.
An ECPA claim requires a showing that the defendant (1) intentionally (2)
intercepted, endeavored to intercept or procured another person to intercept or endeavor to
intercept (3) the contents of (4) an electronic communication, (5) using a device. 18 U.S.C.
§§ 2510 et seq. 	Similarly, CIPA prohibits any person from using electronic means to learn
the contents or meaning of any communication without consent or in an unauthorized
manner. Cal. Pen. Code § 631(a). Under both the ECPA and CIPA, it is not unlawful for
a person to intercept an electronic communication where such person is a party to the
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 4 of 8

5
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
communication so long as such interception is not for the purpose of committing any
criminal or tortious act—often referred to as the party exemption. 18 U.S.C. § 2511(2)(d);
see In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 607 (9th Cir. 2020)
(“[Both the ECPA and CIPA] contain an exemption from liability for a person who is a
‘party’ to the communication[.]”). “Courts perform the same analysis for both the [ECPA]
and CIPA regarding party exemption.” Id.
VGC contends that as the intended recipient of Plaintiff’s communications on the
Website the party exemption applies and Plaintiff’s claims under the ECPA and CIPA
necessarily fail. Plaintiff however argues that the party exemption is inapplicable because
VGC intercepted his communications with criminal or tortious intent. 	18 U.S.C.
§ 2511(2)(d) (Consent is not a defense where the communication is intercepted for the
purpose of committing any criminal or tortious act in violation of the Constitution or laws
of the United States or of any State.) 2
To come within this tort or crime exception to the party exception, a plaintiff must
plead 	sufficient 	facts 	to 	support 	an 	inference 	that 	the 	offender 	intercepted 	the
communication for the purpose of a tortious or criminal act that is independent of the
intentional act of recording or interception itself. Pena v. GameStop, Inc., 670 F. Supp. 3d
1112, 1119–20 (S.D. Cal. 2023) (citing In re Google Cookie Placement Consumer Priv.
Litig., 806 F.3d 125, 145 (3d Cir. 2015)).
Generally, interceptions fall within the tort or crime exception only where the
primary motivation or a determining factor in the interceptor’s actions has been to injure
plaintiff tortiously. 	R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 901 (C.D. Cal. 2024).
Much like the defendant in Walgreen, VGC argues that any interception of Plaintiff’s
2 VGC also asserts that Plaintiff consented to Facebook/Meta collecting the information he communicated
to VGC as part of the Facebook/Meta terms of use agreement. [See Doc. No. 23-1 at 27–29.] VGC argues
this is a complete defense. Plaintiff however claims he did not consent to his medical information being
shared and that he was not provided notice that his confidential communications were being accessed by
Facebook Pixel. [Doc. No. 24 at 23.] For purposes of this motion, the Court accepts Plaintiff’s statements
as true. Consent at this juncture is at best a disputed fact.
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 5 of 8

6
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
medical information that was passed on to Facebook through the use of Facebook Tracking
Pixel was for commercial purposes and therefore neither criminal nor tortious. However,
“the mere existence of [a] lawful purpose alone does not sanitize an interception that was
also made for an illegitimate purpose.” 	Gaige v. Exer Holding Co., LLC, Case No. 2:24-
cv-06099-AH, 2025 WL 559719, at *5 (C.D. Cal. March 2, 2025) (quoting 	In re
DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 515 (S.D.N.Y. 2001)).
As the court concluded in Walgreen, this Court finds that even where a defendant is
arguably motivated by monetary gain, the tort or crime exception may apply. 	See 733 F.
Supp. 3d at 901-02 (having stated a claim for invasion of privacy the court concludes the
complaint pleads tortious intent). Plaintiff has adequately alleged that VGC intentionally
transferred Plaintiff’s confidential, personally identifiable health information without
Plaintiff’s knowledge and consent, stating a claim for invasion of privacy and a violation
of the Health Insurance Portability and Accountability Act (“HIPAA”). [See Doc. No. 13
at ¶ 91; see also Gaige, 2025 WL 559719 at *5 (knowing disclosure of individually
identifiable health information to another person in violation of HIPAA may satisfy the
crime-tort exception).
For pleading purposes at this motion to dismiss stage, the complaint sufficiently
alleges an illegitimate purpose that was at least a determining factor for VGC’s action. The
motion to dismiss the ECPA and CIPA claims is DENIED.
C. 	Plaintiff Fails to Establish Standing for his Invasion of Privacy in
Violation of the California Constitution
To state a claim for invasion of privacy under the California Constitution, a plaintiff
must plead (1) the nature of any intrusion upon reasonable expectation of privacy, and (2)
the offensiveness or seriousness of the intrusion, including any justification and other
relevant interests. 	Gaige, 2025 WL 559719 at *7. 	A cause of action for invasion of
privacy must be sufficiently serious in nature, scope, and actual or potential impact to
constitute an egregious breach of the social norms underlying the privacy right. Hegger v.
Facebook, Inc., 509 F. Supp. 3d 1182, 1193 (N.D. Cal 2020).
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 6 of 8

7
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Plaintiff alleges he used the Website to schedule medical treatments, and these
communications were disclosed to a third party without his consent, which led him to
receive targeted advertisements. The allegations that his private medical communications
were disclosed without his authorization to a third party is sufficient to state a claim for
invasion of privacy. 	See Gaige, 2025 WL 559719, at *8 (allegations that defendant used
his personal health information for targeted advertising is enough to survive a motion to
dismiss on the issue of whether this conduct is highly offensive).
VGC contends that even if Plaintiff adequately alleged past conduct by VGC that
caused him injury, he still lacks standing on his constitutional invasion of privacy count,
because he is limited to a claim for injunctive relief which is prospective. “A plaintiff must
show standing with respect to each form of relief sought.” Ellis v. Costco Wholesale Corp.
657 F.3d 970, 978 (9th Cir. 2011). To establish standing for prospective injunctive relief,
a plaintiff may not rely solely on past exposure to illegal conduct. O’Shea v. Littleton, 414
U.S. 488, 495–96 (1974).
VGC argues that the Plaintiff has not demonstrated he is subject to the likelihood of
actual and imminent future injury from VGC. See Hodgers-Durgin v. de La Vina, 199 F.3d
1037, 1044–45 (9th Cir. 1999) (in a class action a named plaintiff must show that he himself
is subject to a likelihood of future injury). Specifically, VGC argues Plaintiff has not pled
sufficient facts to support a claim that VGC is continuing to share his private data or that
he even intends to visit the Website in the future. Therefore, VGC contends Plaintiff does
not have standing for this claim. The Court agrees.
Plaintiff’s counter argument is that the Facebook Tracking Pixel used to intercept
his communications can be installed on any webpage and continue to intercept his sensitive
health information, so Meta still retains the information he disclosed to VGC without
authorization and may continue to use it. 	He relies on Matera v. Google Inc., 2016 WL
5339806, *19 (N.D. Cal. Sept. 23, 2016), where the plaintiff alleged real and immediate
threat of repeated injury from Google’s interception practices. But unlike Matera, where
Google was a defendant and so an injunction directed to them would prevent future harm,
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 7 of 8

8
24-cv-2221-CAB-DDL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Facebook/Meta are not defendants in this litigation. Whether Facebook/Meta continue to
use Plaintiff’s sensitive health information or employ the Facebook Tracking Pixel on other
webpages, such future conduct is not controlled by VGC. Plaintiff has not alleged that he
will continue to use the VGC website or alleged that VGC is continuing to make
unauthorized disclosures of his personally identifiable medical information. Plaintiff has
therefore not demonstrated that he has an actual and imminent claim of future harm from
VGC. The motion to dismiss Plaintiff’s claim for invasion of privacy in violation of the
California Constitution for lack of standing is GRANTED.
III. 	CONCLUSION
For the reasons stated above, VGC’s motion to dismiss Plaintiff’s claims for ECPA
and CIPA violations for lack of Article III standing and failure to state a claim is DENIED.
VGC’s motion to dismiss Plaintiff’s claim for an invasion of his privacy under the
California Constitution for lack of standing is GRANTED.
VGC is ordered to file an answer to the remaining claims of the complaint by
February 23, 2026.
It is SO ORDERED.
Dated: January 26, 2026
Case 3:24-cv-02221-CAB-DDL Document 26 Filed 01/26/26 PageID.<pageID>
Page 8 of 8