{"id":2933,"date":"2026-05-13T17:37:52","date_gmt":"2026-05-13T21:37:52","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2933"},"modified":"2026-05-13T17:37:53","modified_gmt":"2026-05-13T21:37:53","slug":"wisconsin-federal-court-remands-privacy-class-action-lawsuit-based-on-lack-of-no-injury-from-google-analytics-data-tracking","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2026\/05\/13\/wisconsin-federal-court-remands-privacy-class-action-lawsuit-based-on-lack-of-no-injury-from-google-analytics-data-tracking\/","title":{"rendered":"Wisconsin Federal Court Remands Privacy Class Action Lawsuit Based On Lack Of No Injury From Google Analytics Data Tracking"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Bernadette M. Coyle, and Andrew P. Quay<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/em><\/strong> On May 1, 2026, in Brahm, et al. v. Hospital Sisters Health System, et al., No. 23-CV-444, 2026 U.S. Dist. LEXIS 96866 (W.D. Wis. May 1, 2026), Judge William M. Conley of the U.S. District Court for the Western District of Wisconsin remanded <\/a>a putative class action to state court after finding that Plaintiffs lacked Article III standing to pursue claims that healthcare defendants\u2019 use of Google Analytics on patient portals resulted in unauthorized disclosure of protected health information (\u201cPHI\u201d) to Google.\u00a0 Id. at *2-3.\u00a0 The Court held that Plaintiffs\u2019 lack of evidence of actual harm, together with their theory of future harm, was insufficient to confer standing.\u00a0 Id. at *3.\u00a0 The decision reinforces the growing trend among federal courts requiring proof that disclosed data was actually used to identify individuals, not merely that such identification was theoretically possible.<\/em><\/p>\n\n\n\n

Case Background<\/strong><\/p>\n\n\n\n

The Defendant healthcare companies operate public websites and authenticated MyChart patient portals as \u201cMyHSHS\u201d and \u201cMyPrevea,\u201d which allow patients to log in with a username and password to access their medical records, schedule appointments, and pay bills.  Id.<\/em> at *4.  Between at least 2016 and 2023, Defendants deployed Google Analytics tracking technology on their public websites, within patient portals on their websites, and on MyPrevea\u2019s login page and app.  Id.<\/em> at *6.  Whenever a user visits Defendants\u2019 websites or portals, Google Analytics gathers information about the user\u2019s interactions and shares certain transmissions with Google.  Id.<\/em> at *7.<\/p>\n\n\n\n

Plaintiffs asserted that Google Analytics routinely disclosed patients\u2019 identities and protected health care information to third-party websites like Google without the patients\u2019 knowledge or consent.  Id.<\/em> at *1.  Plaintiffs alleged that they began seeing Facebook advertisements related to their specific medical conditions after visiting Defendants\u2019 portals or websites.  Id.<\/em> at *5.  However, Plaintiffs also searched about their medical conditions or treatment online and have had their personal information involuntarily exposed to third parties by entities unrelated to the litigation.  Id.<\/em>  None of the Plaintiffs had ever tried or intended to sell their PHI, nor did they claim to have suffered any out-of-pocket expenses as a result of Defendants\u2019 allegedly wrongful disclosures.  Id. <\/em>at *10.  Nonetheless, they sought actual damages based on the alleged \u201cdiminished sales value of their PHI,\u201d as well as statutory and nominal damages.  Id.<\/em><\/p>\n\n\n\n

Plaintiffs alleged claims for violation of federal and state wiretapping statutes, as well as Wisconsin common and statutory laws for breach of duty of confidentiality, breach of implied contract to protect privacy, public disclosure of private facts, and unjust enrichment.  Id.<\/em> at *3.  Plaintiffs moved to certify four subclasses, while Defendants moved for summary judgment as to all claims.  Id. <\/em> <\/p>\n\n\n\n

The Court\u2019s Opinion<\/strong><\/p>\n\n\n\n

The Court addressed the \u201cthreshold question\u201d of Article III standing on its own initiative, noting that Defendants\u2019 summary judgment motion called Plaintiffs\u2019 standing into question and standing \u201cis jurisdictional and cannot be waived\u201d and must be \u201csecured at each stage of the litigation.\u201d  Id.<\/em> at *12.  While the Court had previously allowed the original named Plaintiff to proceed past the motion to dismiss stage because it found her allegations of injury sufficient at the pleading stage, the Court explained that with a full record at the summary judgment stage, Plaintiffs failed to present sufficient evidence of a concrete injury-in-fact on multiple grounds.  Id.<\/em> <\/p>\n\n\n\n

First<\/em>, as to Plaintiffs\u2019 tort claims for invasion of privacy and breach of fiduciary duty, the Court found no evidence from which a reasonable jury could conclude that their patient identity or PHI was actually disclosed to Google, disclosed by Google, or used by Google inappropriately.  Id. <\/em>at *17.  Plaintiffs\u2019 evidence did not establish that any of the disclosed anonymous information was actually used by Google or another third party to identify them.  Id. <\/em> <\/p>\n\n\n\n

Despite Plaintiffs\u2019 expert opining that Google\u2019s systems had the \u201ctechnical capability and documented practice\u201d of linking information to specific individuals, the Court determined that the capabilities of Google\u2019s systems were insufficient to demonstrate what it actually did.  Id. <\/em>at *19.  Further, Plaintiffs failed to proffer evidence showing that Defendants caused Plaintiffs\u2019 PHI to be shared, as opposed to other third parties or Plaintiffs themselves through their own voluntary internet disclosures.  Id. <\/em>at *20. <\/p>\n\n\n\n

Relying on the Seventh Circuit\u2019s decision in Dinerstein v. Google, LLC<\/em>, 73 F.4th 502 (7th Cir. 2023), the Court emphasized that Plaintiffs \u201cmust still present sufficient evidence that Google Analytics actually worked as allegedly intended, which they have failed to do in this case,\u201d and therefore, Plaintiffs failed to show a concrete injury to support standing under Article III.  2026 U.S. Dist. LEXIS 96866, at *23.  The risk of Google or other third parties identifying Plaintiffs at a later date by leveraging the data obtained from Defendants was \u201cnot sufficiently imminent to obtain relief in federal court.\u201d  Id.<\/em><\/p>\n\n\n\n

Second<\/em>, as to the breach of implied contract claim, the Court found that Plaintiffs lacked standing because their asserted pecuniary harm based on the diminished sales value of their PHI or nominal damages, without any actual harm, was an injury in law and not an injury-in-fact as required by Article III.  Id. <\/em>at *24-25.<\/p>\n\n\n\n

Third<\/em>, Plaintiffs alternatively asserted unjust enrichment, arguing that Defendants retained without compensation Plaintiffs\u2019 PHI and then disclosed this information to third parties for Defendants\u2019 own gain.  Id. <\/em>at *26.  However, the Court found that without any evidence of improper disclosure, Plaintiffs\u2019 alleged pecuniary injury was \u201csimply speculative and insufficient to confer standing.\u201d  Id. <\/em>at *27.<\/p>\n\n\n\n

Fourth<\/em>, the wiretapping claims likewise failed.  Although Plaintiffs sought statutory damages, the Court held that a statutory violation on its own does not confer standing without an underlying concrete, particularized injury.  Id. <\/em>at *28 (citing TransUnion LLC v. Ramirez<\/em>, 594 U.S. 413, 427 (2021)).<\/p>\n\n\n\n

Having found that Plaintiffs lacked standing as to all claims, the Court remanded the case to Wisconsin state court for further proceedings.  Id.<\/em><\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

Brahm<\/em> reinforces that plaintiffs challenging tracking technology must present actual evidence identifying what allegedly private information was disclosed and cannot rely on abstract and speculative alleged injuries to confer Article III standing.  Asserting an Article III standing defense remains an effective defense that companies should consider throughout litigation, balanced against the prospect of the case continuing in state court.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Bernadette M. Coyle, and Andrew P. Quay Duane Morris Takeaways: On May 1, 2026, in Brahm, et al. v. Hospital Sisters Health System, et al., No. 23-CV-444, 2026 U.S. Dist. LEXIS 96866 (W.D. Wis. May 1, 2026), Judge William M. Conley of the U.S. District Court for the Western District … <\/p>\n

Continue reading “Wisconsin Federal Court Remands Privacy Class Action Lawsuit Based On Lack Of No Injury From Google Analytics Data Tracking”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,137,147],"class_list":["post-2933","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":137,"user_id":720,"is_guest":0,"slug":"bcoyle","display_name":"Bernadette Coyle","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/04\/coylebernadette-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":147,"user_id":742,"is_guest":0,"slug":"aquay","display_name":"Andrew P. Quay","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2026\/03\/quayandrew-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2933","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2933"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2933\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2933"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2933"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2933"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2933"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}