Class Action Defense

May 19, 2026May 19, 2026 by Gerald L. Maatman, Jr.

California Supreme Court Rules That A Smash-And-Grab Hardware Theft, With No Access To Sensitive Records, Does Not Automatically Result In Multi-Million Or Billion Dollar Liability Under California Privacy Laws

By Gerald L. Maatman, Jr., Jennifer A. Riley, Ryan T. Garippo, and Jamar D. Davis

Duane Morris Takeaways: On May 14, 2026, in J.M. v. Illuminate Education, Inc., No. S286699, 2026 Cal. LEXIS 2657 (May 14, 2026), the California Supreme Court held that the California Court of Appeal decision to deny a demurrer was improper for an incorrect application of privacy laws. This decision emphasizes why defendants should confirm whether a plaintiff sufficiently pled a cause of action that aligns with the remedies that he or she seeks to recover. Further, the opinion clarifies that injury under the Confidentiality of Medical Information Act, Cal. Civ. Code § 56, et seq. (“CMIA”) depends on whether the company subjects medical information to a substantial risk of unauthorized use or access, not whether the unauthorized user actually views sensitive data.

Case Background

Illuminate Education, Inc. (“Illuminate”) is a technology company that helps educators determine the academic progression of an individual student, as well as their areas of potential improvement. The company uses data from individual students, including medical data, to make these determinations. Illuminate provided its services to the Ventura County Office of Education, under which Plaintiff (a minor) was a student. Plaintiff provided his medical information to the Ventura County Office of Education, which then provided Plaintiff’s health data to Illuminate.

In 2022, Illuminate became aware of suspicious activity related to its systems. Illuminate promptly initiated an investigation. The investigation confirmed an unauthorized user gained access to Illuminate’s records, including students’ medical information. Illuminate sent a notice to the guardians of the affected students, including Plaintiff, informing them of the scope of the potential disclosure. The notice made it clear that Illuminate found no evidence that the unauthorized user (or users) was successful in actual or attempted misuse of the data.

After the breach, Plaintiff alleges that he received several mail solicitations at an address provided to only the Ventura County Office of Education. As a result, Plaintiff filed a class action lawsuit alleging that Illuminate, as health care provider, negligently managed the students’ medical records under the CMIA and failed to expediently disclose the data breach to those affected under the Customer Records Act, Cal. Civ. Code § 1798.80, et seq. (“CRA”).

The trial court sustained Illuminate’s demurrer, without leave to amend, after Plaintiff twice failed to cure deficiencies in his pleadings. The Court of Appeal reversed that decision, holding that the trial court abused its discretion by sustaining the demurrer, because Plaintiff may have been able to cure the defects in his complaint if a different legal analysis was applied.

Following that decision, the California Supreme Court set out to resolve the disagreement.

The California Supreme Court’s Decision

The California Supreme Court’s analysis hinges on its statutory interpretation, involving the plain reading of the statutes and their legislative histories. Generally, this analysis fell into three distinct categories.

First, Justice Goodwin Liu, writing for the California Supreme Court, reasoned that Plaintiff failed to establish a valid claim under CMIA because he could not allege that Illuminate was a “provider of health care” under California Civil Code section 56.06. Relying on the text of section 56.06, the Supreme Court explained there are two ways for a business to qualify as a “provider of health care”: (1) a covered business maintains medical records to make the information available to either an individual or a health care provider upon request of the individual or provider; or (2) a covered business makes medical information available for an individual or a health care provider upon request to allow an individual to manage their information, or to help diagnose or treat the individual.

The Supreme Court also confirmed this interpretation by relying on the legislative history of the statutes. The Supreme Court observed that the legislative history confirmed that the legislature was concerned with situations where diabetics used a data platform to record glucose levels, or where people with hypertension used platforms to track their blood pressure. Relying on the legislative history, the Supreme Court observed that Plaintiff never alleged that Illuminate created a repository of student records that allowed the students to create their own records, or to access and share those records at their discretion. Instead, Plaintiff asserted that Illuminate stored medical information to help educators monitor, evaluate, and address student needs. As a result, Illuminate was not a “provider of health care,” because it did not make medical records available upon request of the individual or provider.

The Supreme Court also quickly addressed Plaintiff’s inability to satisfy the alternative method for determining whether Illuminate is a “provider of health care” because Plaintiff never alleged that Illuminate “provides medical information to health care providers or individuals for diagnosis and treatment of an individual.” Illuminate Education, 2026 Cal. LEXIS 2657, at *12. As a result, and after quickly dispensing with a few other arguments, the Supreme Court concluded that Illuminate was not a “provider of health care” under the CMIA.

Second, in addition to analyzing whether Illuminate was a “provider of health care,” the Supreme Court also determined whether Plaintiff had alleged sufficient injury to state a claim under the CMIA. The Supreme Court disagreed with Illuminate’s argument that injury requires an unauthorized person to view medical data, and ruled that a plaintiff alleges injury by claiming that the medical information was exposed to “a significant risk of unauthorized access or use.” Id. at *29.

The CMIA requires covered entities to “preserve[] the confidentiality” of medical information. Cal. Civ. Code § 56.101(a). The Supreme Court stated that “confidentiality” requires “keeping information private or secret” and clarified that this obligation applies regardless of whether an unauthorized party actually views the data. Illuminate Education, 2026 Cal. LEXIS 2657, at *26. (“[W]e reject the rule that no breach of confidentiality has occurred until medical information is actually viewed by an unauthorized person.”). Instead, the determination of whether a covered entity failed to preserve the confidentiality of data depends on a factor-based analysis that considers the “form, duration, and extent of the data breach, as well as any mitigation efforts by the covered entity.” Id. at *30. Thus, a plaintiff need not allege that his or her data was “actually viewed” by a third party, because that person is “unlikely to know what an unauthorized party has done with their data unless they suffer actual damage” and instead “[a]ll relevant circumstances must be considered” when determining whether confidentiality was breached. Id.

Third, for the CRA claim, the Supreme Court ruled that Plaintiff did not state a cause of action against Illuminate because Plaintiff was not a customer within the meaning of the statute. To bring suit under the CRA, a plaintiff must establish that he or she is a “customer” within the meaning of the statute. Boorstein v. CBS Interactive, Inc., 222 Cal. App. 4th 456, 467 (2013). A customer is “an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.” Cal. Civ. Code § 1798.80(c). Here, the Supreme Court found that Plaintiff never alleged that he provided any personal information to Illuminate to purchase or lease a product, or obtain a service from Illuminate. The Supreme Court observed that the Ventura County Office of Education purchased Illuminate’s services and provided the student information, not Plaintiff. Moreover, the Supreme Court disregarded Plaintiff’s argument that he was the “ultimate” customer of Illuminate because the CRA “does not authorize suit by all consumers or beneficiaries; it authorizes a civil action for an injured ’customer.’” Id. at *32.

In the end, the Supreme Court reversed the judgment of the Court of Appeal and remanded the matter for further proceedings.

Implications For Companies

This decision emphasizes the importance of ensuring that a plaintiff has sufficiently pled all causes of action asserted. When the CMIA or CRA are involved, companies must consider whether they are, in fact, a covered entity in order to determine whether they are subject to the statutes’ reach.

Further, to assert injury under the CMIA for a data breach claim, the analysis hinges on the risk of unauthorized use, not what an unauthorized user is able to do with the data. Thus, it is imperative that companies take all reasonable steps to retain the confidentiality of sensitive records, making an extra effort to ensure that hardware is secure.

For CRA claims, companies need to pay special attention to which entities solicit or contract for their services as attention to these details can potentially thwart a potential CRA claim.

In short, organizations that use such medical data, and operate in California, should take note of this decision because it impacts their defenses both positively and negatively going forward.

May 19, 2026May 19, 2026 by Gerald L. Maatman, Jr.

Announcing The New Duane Morris Higher Education Class Action Review – 2026!

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaway: We are proud to announce the release of the first-ever Higher Education Class Action Review – 2026, a comprehensive examination of the rapidly evolving world of litigation involving colleges and universities.

Class action lawsuits against colleges and universities have multiplied in both frequency and complexity over the last several decades. What began as isolated disputes involving admissions practices or employment discrimination has evolved into a broad spectrum of high-stakes litigation touching nearly every aspect of institutional operations. Institutions now confront class claims involving tuition and fee refunds, antitrust allegations, Title IX compliance, financial aid practices, student privacy, labor and employment disputes, disability accommodations, consumer protection statutes, data breaches, and the use of emerging educational technologies.

The COVID-19 pandemic accelerated many of these trends, producing an unprecedented wave of litigation that tested the contractual, fiduciary, and ethical obligations universities owe to students, faculty, and employees alike. At the same time, plaintiffs’ attorneys increasingly recognized that educational institutions possess the precise characteristics that make them attractive targets for aggregate litigation: substantial assets, expansive data systems, and policies affecting large populations.

As a result, colleges and universities now operate in an environment where a single institutional decision can trigger nationwide claims involving thousands of individuals and expose institutions to extraordinary legal and reputational risk.

Yet higher education remains unlike any other industry. Universities occupy a unique legal and cultural space shaped by academic freedom, shared governance, nonprofit missions, constitutional obligations, and public trust. Courts are often tasked with balancing these longstanding traditions against modern doctrines of consumer protection, employment law, privacy regulation, and mass tort procedure.

The Higher Education Class Action Review – 2026 explores the procedural frameworks governing class certification, the substantive legal theories most frequently asserted against educational institutions, and the strategic considerations that shape litigation outcomes. Designed for attorneys, university counsel, administrators, policymakers, academics, and risk management professionals, the book provides a detailed roadmap for understanding the rapidly expanding role of class action litigation in education.

The Higher Education Class Action Review – 2026 offers readers a timely and authoritative guide to one of the most consequential developments in modern education law. Get your eBook copy today!

Stay tuned to the Class Action Weekly Wire for more news and information about the Higher Education Class Action Review – 2026.

May 15, 2026May 15, 2026 by Gerald L. Maatman, Jr.

Third Circuit Holds That Unauthorized Collection Of Credit Card Information Via Session Replay Code Confers Article III Standing, Creating Split Of Authority

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways: On May 11, 2026, in In Re BPS Direct, LLC; Cabela’s, LLC Wiretapping Litigation, No. 23-3235, 2026 WL 1280969 (3d Cir. May 11, 2026), the U.S. Court of Appeals for the Third Circuit reversed a federal district court’s dismissal of a class action alleging that defendants’ use of session replay code, a form of website analytics technology, violated federal and state privacy laws. The Third Circuit held that two plaintiffs who made purchases on the defendants’ websites had standing to sue because the session replay code collected their credit card information without consent, an alleged injury the Third Circuit deemed analogous to the common law tort intrusion upon seclusion. Id. at *6-7.

This ruling is significant in that it shows that in class actions seeking millions (or billions) in dollars in statutory damages under federal and state data privacy laws for alleged use of session replay code, the Third Circuit has distinguished itself from California District Courts, which have held that there is no reasonable expectation of privacy in credit card information collected by session replay code. Companies operating in the Third Circuit should take note as the legal risk of session replay code has meaningfully shifted in that jurisdiction.

Background

Many companies embed their websites with session replay code and other similar software such as Google Analytics and the Meta Pixel in order to perform website analytics and/or targeted advertising. All of these various technologies capture users’ browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers’ servers. Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human. In addition, session replay code (unlike other website analytics and advertising technologies) is typically alleged to record and store “videos” of “all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, [and] text entries,” so that the session replay provider can provide that information back to the company “in a format that [the company] can use for its business purposes.” Id. at *1, 5. Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products. Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided. In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.

In In re BPS Direct, LLC, eight named plaintiffs sued the defendant retailers, alleging that session replay code embedded on their websites captured users’ interactions, including “mouse clicks and movements, keystrokes, search terms, substantive information inputted …, pages and content viewed …, scroll movement[s], and copy and paste actions.” Id. at *2. Plaintiffs asserted claims under the federal Wiretap Act, 18 U.S.C. § 2510 et seq., and the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq., along with several state and common law causes of action. Id.

The plaintiffs fell into two groups. Two plaintiffs made purchases on the defendants’ websites and entered his or her “name, address, and payment and billing information” into text fields. Id. The remaining six plaintiffs browsed the websites without making purchases and did not enter any personally identifying information while browsing the websites. Id.

Defendants moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). The District Court granted the motion, dismissing the non-purchasing plaintiffs’ claims with prejudice, finding that, after two attempts, they could not establish concrete harm “because they did not make purchases on the Websites or engage in any activity prompting their browsers to send highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards.” 705 F. Supp. 3d 333, 367 (E.D. Pa. 2023). The claims of the two purchasing plaintiffs were dismissed without prejudice. Id. Rather than amend, those two plaintiffs filed a notice of intent to stand on their allegations, and all eight plaintiffs appealed. 2026 WL 1280969, at *2-3.

The Third Circuit’s Decision

The Third Circuit reversed the dismissal of the purchasing plaintiffs’ claims and modified the dismissal of the non-purchasing plaintiffs’ claims from with prejudice to without prejudice. Id. at *1.

The Third Circuit analyzed standing under two analogous common law torts: (1) public disclosure of private facts, and (2) intrusion upon seclusion. It held that none of the plaintiffs had standing under the first theory. As to the non-purchasing plaintiffs, their browsing data was neither sensitive nor personally identifiable. As to the purchasing plaintiffs, their information was not publicly disclosed. Id. at *4-5.

The Third Circuit held that only the two purchasing plaintiffs had standing under the intrusion upon seclusion theory. Id. at *3. Under that common law tort, “[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Id. at *5 (citing Restatement (Second) of Torts § 652B (1977)). The Third Circuit concluded that the two purchasing plaintiffs had entered “personal or sensitive” information – specifically their “complete credit card or debit card numbers” – when making purchases on the defendants’ websites. Id. at *7. The Third Circuit reasoned that “[j]ust as media consumption is sensitive and historically private, so is a person’s complete credit card or debit card number.” Id.

Accordingly, the Third Circuit held that these two plaintiffs had standing based on their allegations that defendants embedded session replay code in their websites, allowing third-party adtech providers to “surreptitiously record their billing and payment information absent consent.” Id.

Implications For Companies

This ruling puts the Third Circuit at odds with California District Courts, which have reached the opposite conclusion in two session replay cases. See Thomas v. Papa Johns Int’l, Inc., 2024 WL 2060140, at *5 (S.D. Cal. May 8, 2024) (plaintiff’s “name, address, credit card number(s), and billing information” collected via session replay is “not information over which society is prepared to recognize a reasonable expectation of privacy”); Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 525 (C.D. Cal. 2021) (collection via session replay of a website user’s “payment card information, including card number, expiration date, and CCV code” without consent was insufficient to constitute an invasion of privacy).

In the Third Circuit, session replay is no longer just an analytics tool – it carries significant legal risk for website operators. Companies facing session replay class actions in the Third Circuit should shift their litigation strategy accordingly and consider moving beyond standing arguments, including demonstrating that plaintiffs cannot meet their burden of proof on the elements of the claims asserted.

Given the volume of session replay and similar litigation pending nationwide and the significant statutory damages at stake, this decision warrants close attention from any company whose website uses session replay code or similar technologies.

May 15, 2026May 15, 2026 by Class Action Defense

The Class Action Weekly Wire – Episode 148: Class Action Litigation In The Energy Industry

Duane Morris Takeaway: This week’s episode features Duane Morris partners Jerry Maatman and Brad Thompson with their discussion of Duane Morris’ Energy, Oil, & Gas Class Action Review, highlighting several trends and developments shaping class action litigation in this industry.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Welcome to our listeners! Thank you for being here for our weekly podcast, the Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and I’m pleased that joining me today is my colleague and partner, Brad Thompson, who is a head of the Duane Morris Energy Industry Group. Welcome to our podcast today, Brad.

Brad Thompson: Thanks, Jerry. Happy to be here.

Jerry: Today on the podcast, we’re discussing the publication of a new desk reference in our brand-new e-book, The Duane Morris Energy, Oil, & Gas Class Action Review. Listeners can find the e-book on our blog, the Duane Morris Class Action Defense Blog. Brad, can you tell our listeners a bit about the review?

Brad: Sure thing, Jerry. So, Duane Morris has now released the fifth in a series of industry-focused class action publications, and this particular publication analyzes key-related rulings and developments from 2025 and significant legal decisions and trends that are impacting the class action space in the energy industry for 2026. We hope that companies and employers will benefit from this resource in compliance with these ever-evolving laws and standards.

Jerry: It seems the global energy landscape in 2025 underwent a significant transformation. Oil and gas companies, of course, continue to play a foundational role in industrial development and economic growth, but they’re ever increasingly coming under scrutiny from regulators, investors, consumers, and plaintiffs’ lawyers. How do you see, Brad, the tide turning in the class action space in this industry?

Brad: Yeah, Jerry, we certainly live in interesting times, to put it mildly, and this is an especially important topic right now. The litigation environment around energy companies has changed dramatically over the last several years, both in terms of its scope and complexity, and I think one thing that stands out today is that these lawsuits are no longer limited to what were traditional disputes over, maybe, contracts, like supply agreements or perhaps kind of isolated contamination events, or explosions, and those sorts of lawsuits.

And I think, Jerry, as demand for energy generally continues to rise globally, and those commodity prices continue to climb, I think we should expect that energy companies will find their earnings increasingly subject to class action attention and attacks, and so these cases are becoming broader, more ambitious, and historically, many energy-related lawsuits that focused on, again, those more localized environmental issues, or perhaps royalty disputes or commercial disagreements are expanding.

What we saw in 2025 is that plaintiffs are advancing claims that are tied to more long-term environmental impacts, these alleged failures to disclose climate-related risks. Of course, these just broader theories about corporate responsibility in general, and in many respects, I think these suits are attempting to address issues that more traditionally were viewed more as policy questions, particularly within the energy policy discussion and debate, rather than purely litigation questions as we’re seeing now.

Jerry: In my practice of defending companies and class actions for over four decades, what I’m seeing is a migration of very talented plaintiffs’ lawyers that follow the money, and the cases increase in size, they’re worth more, and what I saw in 2025 was a migration of these talented lawyers into the energy space, such that, we’re seeing kind of new theories, new lawyers in the space, and much bigger cases. What is your sense in terms of your dealing with your clients in the industry space in terms of that phenomenon?

Brad: Yeah, I think we should expect that migration, to use your term, will continue, and judges are increasingly confronting questions that are extraordinarily complex, both from a legal perspective, but also from a scientific perspective. You know, by way of example, how should liability be apportioned for something like environmental effects that may have developed over many decades involved a very complicated chain of title, countless entities and numerous individuals. In those scenarios, what type of climate risk disclosure is legally sufficient? To what extent can private litigation be used as some kind of mechanism to potentially drive systemic or policy change in such a global industry? These are certainly not easy questions, and courts across jurisdictions are certainly approaching them differently.

Jerry: In terms of the analytics that we study, we saw in 2025 as compared to 2024, a growth by about 10-15% in the filings of class actions nationwide. Is it your sense in the oil and gas industry that we’re going to see an increase in the activity in terms of the filing of class action lawsuits that challenge the industry?

Brad: Yeah, going back to your earlier point, Jerry, about kind of following the money, I think, again, you know, we live in interesting global times, and these energy industry issues will continue to be at the forefront of geopolitical focus. And so, first of all, there’s going to be kind of inherently a heightened public awareness surrounding climate and environmental issues – so oil and gas companies will certainly be at the center of that focus. And moreover, investors, regulators are increasingly demanding more transparency regarding sustainability practices, things like climate-related risk, exposure. Plaintiff firms are becoming increasingly sophisticated in identifying large-scale theories that can support class treatment, or at least class theories with increasingly larger damage model theories, so at the same time, scientific modeling and data analytics have become much more advanced – which plaintiffs often use to support their causation theories and damages models. So, you know, whether these new and emerging theories ultimately succeed, certainly another question, but they are shaping litigation strategy in 2026.

Jerry: Talking about the defense side of the V in these cases, given that the stakes are so enormous, what do you see in terms of selection of defense and how defenses are crafted and engineered in the industry?

Brad: Sure. The outcome of a class action can be significant, potentially devastating for a company – not only financially, but reputationally, operationally. And that’s why corporate defendants have to approach these cases from a broader vantage point, not just in a litigation vacuum. A successful defense strategy today has to be thoughtful, multifaceted. It’s probably no longer enough to just narrowly focus on a single procedural issue or an isolated factual dispute, and companies to have coordinated strategies that involve not just litigation defense, but also regulatory compliance, internal governance, public disclosures, there’s insurance considerations, and sometimes crisis management response type considerations as well, so I think early case assessment is critical, because that key class certification decision can dramatically alter the trajectory of these cases.

Jerry: I’ve always thought the M.O. of the plaintiffs’ bar was to find the client, file the lawsuit, certify it, and then monetize it. And that class certification, obviously, is the holy grail when it comes to class actions, and that once a case is certified, it has weight, the plaintiffs’ attorney has leverage. So, in terms of the oil and gas and energy industry, what are your thoughts with respect to the importance of class certification?

Brad: Oh, extremely important. These energy-related cases, as you know, Jerry, often involve highly individualized facts. There’s a variety of regulatory frameworks, both at the state and the federal level, and multifaceted, complicated causation-type questions and issues. And so those issues can create significant hurdles for plaintiffs that are trying to establish those key factors, like commonality and predominance under those class action standards.

Jerry: It sounds like, then, from a holistic defense perspective, that these sorts of complexities certainly require careful planning, engagement of experts to assist very early on in the litigation, and that these lawsuits are basically shaping the future of energy law more broadly.

Brad: Yeah, Jerry, I think that’s exactly what’s happening, and these cases are going to influence, and are already influencing, how energy companies think about things like risk management, environmental disclosures, governance structures, and their long-term business planning. And we’re also seeing litigation become a part of just this broader energy transition conversation globally. And as our world moves towards more energy from all sources, which of course includes alternative or renewable energy sources, traditional energy companies are also navigating these enormous legal and commercial pressures simultaneously.

Jerry: Well, that brings us back conveniently to close the loop in terms of the purpose behind this resource, and why it’s so timely for clients in the energy space.

Brad: Yeah, exactly. I mean, the goal here was to create a practical and comprehensive desk reference guide for corporate counsel, energy industry professionals that are facing these increasingly complex challenges, and we wanted to provide a clear understanding of the various legal theories that are driving the current litigation and class action climate, and the broader implications for the future of energy law.

Jerry: Well, I concur. The field is rapidly evolving, so companies can be helped by a resource like this from both a strategic and practical sense. Listeners, of course, can download a copy for free of the e-book on the Class Action Defense Blog. Well, thank you, Brad, for being here today, and thank you, loyal listeners, for tuning in.

Brad: Thanks so much for having me, Jerry. It was great to be here. Really appreciate it.

May 13, 2026May 13, 2026 by Gerald L. Maatman, Jr.

Wisconsin Federal Court Remands Privacy Class Action Lawsuit Based On Lack Of No Injury From Google Analytics Data Tracking

By Gerald L. Maatman, Jr., Bernadette M. Coyle, and Andrew P. Quay

Duane Morris Takeaways: On May 1, 2026, in Brahm, et al. v. Hospital Sisters Health System, et al., No. 23-CV-444, 2026 U.S. Dist. LEXIS 96866 (W.D. Wis. May 1, 2026), Judge William M. Conley of the U.S. District Court for the Western District of Wisconsin remanded a putative class action to state court after finding that Plaintiffs lacked Article III standing to pursue claims that healthcare defendants’ use of Google Analytics on patient portals resulted in unauthorized disclosure of protected health information (“PHI”) to Google. Id. at *2-3. The Court held that Plaintiffs’ lack of evidence of actual harm, together with their theory of future harm, was insufficient to confer standing. Id. at *3. The decision reinforces the growing trend among federal courts requiring proof that disclosed data was actually used to identify individuals, not merely that such identification was theoretically possible.

Case Background

The Defendant healthcare companies operate public websites and authenticated MyChart patient portals as “MyHSHS” and “MyPrevea,” which allow patients to log in with a username and password to access their medical records, schedule appointments, and pay bills. Id. at *4. Between at least 2016 and 2023, Defendants deployed Google Analytics tracking technology on their public websites, within patient portals on their websites, and on MyPrevea’s login page and app. Id. at *6. Whenever a user visits Defendants’ websites or portals, Google Analytics gathers information about the user’s interactions and shares certain transmissions with Google. Id. at *7.

Plaintiffs asserted that Google Analytics routinely disclosed patients’ identities and protected health care information to third-party websites like Google without the patients’ knowledge or consent. Id. at *1. Plaintiffs alleged that they began seeing Facebook advertisements related to their specific medical conditions after visiting Defendants’ portals or websites. Id. at *5. However, Plaintiffs also searched about their medical conditions or treatment online and have had their personal information involuntarily exposed to third parties by entities unrelated to the litigation. Id. None of the Plaintiffs had ever tried or intended to sell their PHI, nor did they claim to have suffered any out-of-pocket expenses as a result of Defendants’ allegedly wrongful disclosures. Id. at *10. Nonetheless, they sought actual damages based on the alleged “diminished sales value of their PHI,” as well as statutory and nominal damages. Id.

Plaintiffs alleged claims for violation of federal and state wiretapping statutes, as well as Wisconsin common and statutory laws for breach of duty of confidentiality, breach of implied contract to protect privacy, public disclosure of private facts, and unjust enrichment. Id. at *3. Plaintiffs moved to certify four subclasses, while Defendants moved for summary judgment as to all claims. Id.

The Court’s Opinion

The Court addressed the “threshold question” of Article III standing on its own initiative, noting that Defendants’ summary judgment motion called Plaintiffs’ standing into question and standing “is jurisdictional and cannot be waived” and must be “secured at each stage of the litigation.” Id. at *12. While the Court had previously allowed the original named Plaintiff to proceed past the motion to dismiss stage because it found her allegations of injury sufficient at the pleading stage, the Court explained that with a full record at the summary judgment stage, Plaintiffs failed to present sufficient evidence of a concrete injury-in-fact on multiple grounds. Id.

First, as to Plaintiffs’ tort claims for invasion of privacy and breach of fiduciary duty, the Court found no evidence from which a reasonable jury could conclude that their patient identity or PHI was actually disclosed to Google, disclosed by Google, or used by Google inappropriately. Id. at *17. Plaintiffs’ evidence did not establish that any of the disclosed anonymous information was actually used by Google or another third party to identify them. Id.

Despite Plaintiffs’ expert opining that Google’s systems had the “technical capability and documented practice” of linking information to specific individuals, the Court determined that the capabilities of Google’s systems were insufficient to demonstrate what it actually did. Id. at *19. Further, Plaintiffs failed to proffer evidence showing that Defendants caused Plaintiffs’ PHI to be shared, as opposed to other third parties or Plaintiffs themselves through their own voluntary internet disclosures. Id. at *20.

Relying on the Seventh Circuit’s decision in Dinerstein v. Google, LLC, 73 F.4th 502 (7th Cir. 2023), the Court emphasized that Plaintiffs “must still present sufficient evidence that Google Analytics actually worked as allegedly intended, which they have failed to do in this case,” and therefore, Plaintiffs failed to show a concrete injury to support standing under Article III. 2026 U.S. Dist. LEXIS 96866, at *23. The risk of Google or other third parties identifying Plaintiffs at a later date by leveraging the data obtained from Defendants was “not sufficiently imminent to obtain relief in federal court.” Id.

Second, as to the breach of implied contract claim, the Court found that Plaintiffs lacked standing because their asserted pecuniary harm based on the diminished sales value of their PHI or nominal damages, without any actual harm, was an injury in law and not an injury-in-fact as required by Article III. Id. at *24-25.

Third, Plaintiffs alternatively asserted unjust enrichment, arguing that Defendants retained without compensation Plaintiffs’ PHI and then disclosed this information to third parties for Defendants’ own gain. Id. at *26. However, the Court found that without any evidence of improper disclosure, Plaintiffs’ alleged pecuniary injury was “simply speculative and insufficient to confer standing.” Id. at *27.

Fourth, the wiretapping claims likewise failed. Although Plaintiffs sought statutory damages, the Court held that a statutory violation on its own does not confer standing without an underlying concrete, particularized injury. Id. at *28 (citing TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021)).

Having found that Plaintiffs lacked standing as to all claims, the Court remanded the case to Wisconsin state court for further proceedings. Id.

Implications For Companies

Brahm reinforces that plaintiffs challenging tracking technology must present actual evidence identifying what allegedly private information was disclosed and cannot rely on abstract and speculative alleged injuries to confer Article III standing. Asserting an Article III standing defense remains an effective defense that companies should consider throughout litigation, balanced against the prospect of the case continuing in state court.

May 12, 2026May 12, 2026 by Gerald L. Maatman, Jr.

Announcing The First Edition Of The Insurance Class Action Review – 2026!

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaway: The rise of class action litigation has fundamentally transformed the modern legal landscape, and we are proud to announce the publication of the Insurance Class Action Review – 2026, a comprehensive new resource examining the evolving risks, trends, and defense strategies shaping class action litigation across the insurance sector.

The class action mechanism is unparalleled among procedural rules in terms of its impact on the American legal system. Its ability to exponentially expand the potential damages associated with a single claim has elevated class litigation into one of the most consequential forces confronting corporate defendants. In many instances, the mere threat of class certification can alter litigation strategy, settlement dynamics, and business operations on a massive scale.

For insurers, these risks have become increasingly complex and far-reaching. Class action litigation now touches nearly every aspect of the insurance business, from premium calculations and claims handling practices to cybersecurity breaches, artificial intelligence underwriting models, and climate-related coverage disputes. As insurers continue to collect and process enormous volumes of consumer data while operating under overlapping contractual, statutory, and regulatory frameworks, they face unprecedented exposure to collective litigation. The Insurance Class Action Review – 2026 was developed to help legal and business leaders navigate this rapidly changing environment. The book also examines how broader societal and economic forces are reshaping litigation risk. Digital transformation has dramatically increased the amount of sensitive consumer information maintained by insurers, while catastrophic weather events, inflationary pressures, and shifting healthcare and labor markets have intensified scrutiny of claims practices and pricing models.

Looking ahead, the future of insurance class action litigation will likely be shaped by forces extending well beyond traditional coverage disputes. Artificial intelligence, digital surveillance technologies, climate risk, ESG initiatives, and expanding state consumer protection regimes are already redefining the contours of collective litigation. As these developments continue, class actions will remain a central mechanism through which courts, consumers, regulators, and the insurance industry negotiate questions of fairness, transparency, and economic responsibility.

Because the stakes in class litigation are often existential, corporate defendants must approach these cases from a broad vantage point with thoughtful, proactive, and multi-faceted defense strategies. We developed the Insurance Class Action Review – 2026 eBook as a one-of-a-kind resource to help insurers, corporate counsel, risk professionals, and litigators better understand the rapidly evolving class action landscape and prepare for the challenges ahead. Get your copy today!

May 7, 2026May 7, 2026 by Class Action Defense

The Class Action Weekly Wire – Episode 147: Class Action Litigation In The Transportation, Automotive, and Logistics Industry

Duane Morris Takeaway: This week’s episode features Duane Morris partners Jerry Maatman and Alyson Walker Lotman and associate Jamar Davis with their discussion of Duane Morris’ Transportation, Automotive, & Logistics Class Action Review, highlighting several trends and developments shaping class action litigation in this industry.

Episode Transcript

Jerry Maatman: Welcome to our loyal blog listeners. Thank you for being here for our weekly podcast, The Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and joining me today are my colleagues Alyson Walker Lotman and Jamar Davis, who are both members of the Duane Morris Transportation, Automotive, and Logistics Industry Group. Thank you so much for both being here on our podcast.

Alyson Walker Lotman: Thank you, Jerry. Happy to be here.

Jamar Davis: Thanks for having me, Jerry.

Jerry: Today on the podcast, we are discussing publication of a brand-new e-book and desk reference, the Duane Morris Transportation, Automative, And Logistics Class Action Review. Listeners can find our e-book on our blog at the Duane Morris Class Action Defense Blog. Jamar, can you tell our listeners a little bit about this new offering and desk reference?

Jamar: Absolutely, Jerry. Duane Morris released the fourth in a series of industry-focused class action publications, the Transportation, Automotive, And Logistics Class Action Review – 2026. The publication analyzes the key related rulings and developments in 2025 and the significant legal decisions and trends impacting class action litigation in this industry for 2026. We hope that companies and employers will benefit from this resource and compliance with these evolving laws and standards.

Jerry: Well, class action litigation certainly seems to be on the rise across all industries. What’s driving this trend here?

Alyson: It was really a mix of old and new risks. You still have product liability and labor issues, but now they’re intersecting with technology, supply chains, and regulatory shifts. Overall, four themes stood out: product liability and recalls, data and antitrust claims, labor misclassification, and supply chain disputes. Automotive companies are still dealing with defect and recall cases, but courts are more open to economic loss claims now. Plaintiffs don’t always need physical injury – allegations of pre-sale knowledge of defects can be enough. And newer technologies like ADAS, EV batteries, and connected systems are driving the next wave of litigation risk.

Jerry: That’s exceedingly interesting, a lot going on in this space, and it certainly gives a clean perspective on the vast array of claims we’re seeing in class actions in this particular industry. Jamar, what did the analytics and data show in 2025?

Jamar: We’re seeing more antitrust and data access cases as these industries digitize. The CDK Global case is a great example: a $630 million settlement over restricting dealership data and inflating software prices. These cases focus on control of platforms and data, and that’s likely to expand as vehicles become more software-driven labor issues with misclassification claims and logistics and delivery networks also led to multi-million dollar settlements in 2025. These cases continue to test the line between contractor and employee status with real implications for companies.

Jerry: Certainly, for the plaintiffs’ bar, certification is the Holy Grail, and the most important moment in these lawsuits. In terms of getting these cases certified as class actions, we saw an increasingly consistent and enhanced certification rate across the board in 2025 as compared to prior years. Procedurally, are courts granting class certification for claims against these defendants at a higher rate?

Alyson: So, Jerry, courts are tightening class certification standards, especially around predominance, ascertainability , and standing. That matters here because individualized issues like vehicle use or contract differences can make class treatment harder.

Jerry: Well, as we mentioned before, the rate of class actions being filed each year seems to keep going up. What are the filing numbers like for the transportation and logistics space?

Jamar: Jerry, they’ve been fairly steady. Transportation and warehouse filings rose slightly to 1,393 in 2025, from 1,304 in 2024, but still below the 2021 peak of 2,514.

Jerry: Well, thank you for those analytics. Before we wrap up, any final thoughts on where this trend is heading?

Alyson: So, I think we’ll continue to see growth in the number of class actions, particularly as regulations evolve and technology becomes even more integrated into operations.

Jamar: I agree with Alyson, and with continued growth comes the ability for a plaintiffs’ lawyer to try and monetize the filings into settlement dollars. Businesses need to adapt accordingly.

Jerry: Well, it’s certainly been the case and justified by our analysis and the data over the last several years, and settlement dollars have been increasing, and our sense is don’t look for any downward trend in settlement numbers in the near future.

Well, thanks, Alyson and Jamar, for being here today, and thank you, loyal listeners, for tuning in. Please stop by our blog for a free copy of the Transportation, Automotive, And Logistics Class Action Review e-book.

Jamar: Thank you for having me, Jerry, and thank you, listeners.

Alyson: Thanks so much, everyone.

May 6, 2026May 6, 2026 by Justin Donoho

Data Security and Privacy Liability – Takeaways From The Sedona Conference Working Group 11 Annual Meeting in Kansas City, MO

By Justin R. Donoho

Duane Morris Takeaways: Data privacy and data breach class action litigation continue to explode. At the Sedona Conference Working Group 11 on Data Security and Privacy Liability, in Kansas City, Missouri, on May 5-6, 2025, Justin Donoho of the Duane Morris Class Action Defense Group served as a dialogue leader for two panel discussions, “Privacy and Data Security Litigation Update” and “Legislative Drafting Considerations: Lessons from Colorado’s Privacy and AI Law Intersection.” The working group meeting, which spanned two days and had over 50 participants, produced excellent dialogues on these topics and others including unique procedural aspects of data breach class actions, data privacy primer, onward transfer of consumer PII in M&A and bankruptcy contexts, privacy and data security state regulator roundtable, and application of attorney-client privilege in the cybersecurity context.

The Conference’s robust agenda featured over 30 dialogue leaders from a wide array of backgrounds, including federal and state regulators and governmental officials, data security industry experts, in-house attorneys, cyberlaw professors, plaintiffs’ attorneys, and defense attorneys. In a masterful way, the agenda provided valuable insights for participants toward this working group’s mission, which is to identify and comment on trends in data security and privacy law, in an effort to help organizations prepare for and respond to data breaches, and to assist attorneys and judicial officers in resolving questions of legal liability and damages.

Justin had the privilege of speaking about current trends in data privacy class actions and lessons from the intersection of the Colorado Privacy Act (CPA) and Colorado AI Act (CAIA) and how these lessons might guide future legislatures when drafting AI and data privacy statutes. Highlights from his presentations included two recent cases resulting in helpful precedent for defendants facing cases alleging privacy violations for their uses of website advertising technologies (adtech), including a case that disposed of a claim under the California Invasion of Privacy Act under the rule of lenity (see here), and a case that dismissed an adtech class action due to failure to allege highly offensive conduct (see here).

Finally, one of the greatest joys of participating in Sedona Conference meetings is the opportunity to draw on the wisdom of fellow presenters and other participants from around the globe. Highlights included:

Litigators from both sides of the “v.” and a neutral debating early case procedural rules and practices, choice of law, and discovery mechanisms in the context of data breach class actions, with an unprompted shoutout to the Duane Morris Class Action Review for supplying statistics.
Sedona Conference veterans discussing Sedona’s latest version of a data privacy primer and the proper level of detail to include in this document ten years in the making in order to keep it reasonably current to account for the rapid evolution of data privacy laws and related developments in artificial intelligence.
Panelists with different backgrounds discussing the law regarding when a company that has obtained personal data with consent can and cannot transfer the data in M&A and bankruptcy contexts.
A lively dialogue among some of my panelists and other participants regarding trends in decisions regarding mass arbitration protocols and whether a company’s use of website advertising technology is highly offensive to a reasonable person.
Federal and state regulators discussing enforcement priorities and issuances of advisory opinions in the contexts of data breaches, alleged data privacy violations, and concerns regarding national security.
Data breach litigators discussing factors to consider when conducting dual track investigations following a cybersecurity incident in order to segregate and maintain confidentiality over attorney work product and attorney-client communications.
A lively dialogue among some of my panelists and other participants regarding whether compliance with AI and antidiscrimination statutes should provide a safe harbor for compliance with data privacy statutes including, for example, the heavily litigated California Invasion of Privacy Act.

Thank you to the Sedona Conference Working Group 11 and its incredible team, the fellow dialogue leaders, the engaging participants, and all others who helped make this meeting in Redmond, Washington, an informative and unforgettable experience.

Finally, I want to thank to share the exciting news that I have been selected as a new steering committee member of Working Group 11. Thank you Sedona! In this role, I will help lead the identification of cutting-edge issues and oversee development of principles, guidelines, commentaries and other projects representing the work product of the Sedona Conference.

For more information on the Duane Morris Class Action Group, including its Data Privacy Class Action Review e-book, and Data Breach Class Action Review e-book, please click the links here and here.

May 5, 2026May 5, 2026 by Gerald L. Maatman, Jr.

Introducing The Energy, Oil, And Gas Class Action Review – 2026: A Guide To Litigation In A Transforming Industry

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaway: The global energy landscape in 2025 stands at a moment of profound transformation. Oil and gas companies—long the backbone of industrial development and economic growth—now operate under intensifying scrutiny from regulators, investors, and an increasingly litigious public. As markets evolve and the long-term consequences of decades of extraction become more visible, class action litigation has emerged as one of the most powerful mechanisms for accountability and redress.

It is against this backdrop that Duane Morris has published the Energy, Oil, And Gas Class Action Review – 2026. It arrives as a timely and essential resource for understanding the rapidly shifting legal terrain. This new publication examines the complex and fast-developing world of energy class action litigation, offering a comprehensive look at how both plaintiffs and defendants are adapting their strategies. The industry now operates within a landscape shaped by scientific uncertainty, geopolitical volatility, and the accelerating transition to alternative energy sources.

The Energy, Oil, And Gas Class Action Review – 2026 captures these developments in a structured, accessible format and offers practitioners, in-house counsel, and industry stakeholders a clear understanding of where litigation risk is heading.

Download your copy today and stay ahead of the curve in in this industry.

Stay tuned to the Class Action Weekly Wire for more information on the Energy, Oil, And Gas Class Action Review – 2026 coming soon!

May 4, 2026 by Gerald L. Maatman, Jr.

Seventh Circuit Holds That Refusing To Register An Arbitration Agreement With The AAA Is Not A “Refusal To Arbitrate” Under The FAA

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Hayley Ryan

Duane Morris Takeaways: On May 1, 2026, in Bernal et al. v. Kohl’s Corporation et al., No. 24-2806, 2026 WL 1193991 (7th Cir. May 1, 2026), the U.S. Court of Appeals for the Seventh Circuit affirmed a federal district court’s denial of a petition to compel arbitration, holding that the defendant’s refusal to register its arbitration agreement with the American Arbitration Association (“AAA”), which caused the AAA to close the arbitration proceedings, did not constitute a “refusal to arbitrate” under the Federal Arbitration Act (“FAA”). The Seventh Circuit reasoned that because the parties had delegated that procedural question to the AAA, the district court had no authority to compel arbitration.

This decision is a significant win for businesses facing mass arbitration campaigns, particularly where arbitration agreements incorporate the AAA’s Consumer Arbitration Rules. The decision offers a concrete mechanism to avoid the steep filing fees such campaigns generate.

Background

Plaintiffs purchased products through Kohl’s website in 2020 and 2022 and agreed to arbitration provisions that required all disputes to be resolved through binding arbitration before the AAA under its rules, including the AAA’s Consumer Arbitration Rules. Id. at * 1. The arbitration agreement also delegated to the arbitrator exclusive authority “to resolve any dispute related to the interpretation, applicability, enforceability or formation of” the arbitration agreement. Id.

In December 2022, Plaintiffs’ counsel initiated the pre-arbitration process by serving Kohnl’s with approximately 10,000 notices of dispute, followed by an additional 44,656 notices in April 2023. These claims alleged that Kohl’s marketing practices violated California’s consumer protection laws. Id. at *2. This is a classic mass arbitration strategy in which plaintiffs’ firms file thousands of individual demands to exploit mandatory per-claim filing fees paid by corporate defendants.

On May 22, 2023, while settlement discussions were ongoing, Kohl’s modified its terms and conditions to designate the National Arbitration and Mediation tribunal (rather than the AAA) as the arbitration forum for all claims. That same day, Plaintiffs filed formal individual demands with the AAA and paid all applicable filing fees. Id. Under AAA Consumer Arbitration Rule R-12, however, a business must register its arbitration clause and pay administrative fees for the AAA to administer consumer arbitrations. Kohl’s declined to do so. As a result, the AAA exercised its discretion to decline administration, closed the cases, and refunded Plaintiffs’ filing fees. Id. at *3.

Plaintiffs then filed suit in the U.S. District Court for the Central District of California, which was later transferred to the U.S. District Court for the Eastern District of Wisconsin pursuant to the forum selection clause, petitioning the court to compel Kohl’s to register its arbitration agreement with the AAA, pay all necessary filing fees, and proceed to arbitration. Id.

The District Court’s Ruling

The U.S. District Court for the Eastern District of Wisconsin denied the petition. Relying on Wallrich v. Samsung Elecs. Am., Inc., 106 F.4th 609 (7th Cir. 2024), the district court found that the parties had bargained for the AAA to apply and interpret its own Consumer Arbitration Rules. Id. at *3. When the AAA exercised that discretion by closing Plaintiffs’ cases upon Kohl’s non-registration, the court concluded it lacked authority to override that decision. Id.

Plaintiffs filed an interlocutory appeal, arguing that Kohl’s refusal to register its agreement constitutes a refusal to arbitration in violation of the Federal Arbitration Act (“FAA”). Id.

The Seventh Circuit’s Decision

The Seventh Circuit affirmed. Id. at *7. It held that the AAA’s exercise of discretion in closing Plaintiffs’ cases “flowed directly from the parties’ agreement granting AAA that power, leaving nothing for the district court to compel under the Federal Arbitration Act.” Id.

Under the FAA, a party seeking to compel arbitration must establish: (1) an enforceable written arbitration agreement; (2) a dispute falling within the scope of the agreement; and (3) a refusal to arbitrate. Id. at *4 (citing Wallrich, Inc., 106 F.4th at 617-18). The Seventh Circuit’s analysis centered on the third element, i.e. whether Kohl’s non-registration constituted a refusal to arbitrate. Id.

The Seventh Circuit characterized the AAA’s registration requirement as a “forum-specific procedural gateway” matter – the kind of matter parties implicitly delegate to the arbitration provider when they agree to arbitrate under its rules. Id. at *6 (citing Howsam v. Dean Witter Reynolds, Inc., 537 U.S. 79, 85–86 (2002)). Citing Howsam, 537 U.S. at 85, the Seventh Circuit reasoned that, absent contrary language in the arbitration agreement, parties who agree to AAA arbitration intend to withhold registration disputes from judicial review. Id. Because the AAA exercised its own discretion (consistent with the parties’ agreement) in closing the cases, there was “nothing for the district court to compel” under the FAA. Id. at *7.

The Seventh Circuit also relied on its prior decision in Wallrich, which held that a defendant’s failure to pay AAA fees, which resulted in termination of the arbitration, did not constitute a refusal to arbitrate where the outcome flowed from the parties’ agreed-upon procedures.

The Dissent

Judge Joshua P. Kolar dissented. In his view, Kohl’s non-registration “was a conscious step to depart from its agreement to arbitrate,” not a procedural question delegated to the AAA. Id. at *8. Judge Kolar warned that the majority’s reasoning stretches Wallrich’s holding too far and effectively converts “any bilateral agreement to arbitrate under AAA’s Consumer Rules into something of a unilateral option-to-arbitrate for business.” Id. at *9. Judge Kolar would have compelled Kohl’s to register so that the AAA could initiate proceedings. Id.

Implications for Companies

Bernal has immediate practical significance for companies facing mass arbitration exposure under AAA arbitration agreements. By simply declining to register its arbitration agreement with the AAA, a company can cause the AAA to close the proceedings without judicial recourse, at least in the Seventh Circuit. Businesses with AAA arbitration clauses in their consumer-facing agreements should assess whether this strategy is available and appropriate given their specific contractual language and forum.

That said, the dissent’s warning deserves attention. If other circuits adopt Judge Kolar’s reasoning, or if the AAA amends its rules in response, the window this decision opens may narrow. Companies should monitor developments carefully and consult counsel before relying on non-registration as a mass arbitration defense.