like to reserve five minutes for rebuttal i could hear my pleas court j barnes on behalf of the plaintiff's runners i'd like to start this morning with paragraph one hundred eighty eight of the plaintiff's complaint and imagine that this morning i had picked up a telephone and called the cleveland clinic and said yes it is this a cleveland clinic great i would like information about intestine transplants ok you can read that to me now ok thanks and then they read what information they had about intestine transplants and i hung up or that i had called and this is in paragraph one hundred sixty one my own provider shawnee mission hospital and said i'd like information about your center for pain medicine fact kind of the crux of the problem for you that that is the crux of the problem and i'd say if you think of this like an onion there's four layers to the onion and the first layer is totality of circumstances the second layer is other countervailing privacy promises of facebook's partners of which facebook is aware the third layer now we're getting closer and closer here is what were facebook's other promises and facebook's most private prominent privacy promise says your privacy is very important so that's like a bland that's like saying our food is good for you but you don't have to pay any attention to whether it's you know what's in it you know or you have an allergy you need to tell us it's just like pablum to say your privacy is important to us thank you for calling me that's what you're on a very specific promise of anything but your honor it's more than that because facebook then says we will make all important disclosures that you need so that you can make informed decisions well that that's where you see the crux of the problem is what people agree to and so if you go and look at facebook's actual promise ok the disclosure upon which they were a lie first you have to put it in context of when and where it is ok it is on sign up at facebook compared to the circumstances of this conduct which is far away from facebook it says we collect information when you visit or use third party websites and apps that use our services but it does not specify the who what when where why or how of this case and the law of this circuit your honor is that the totality of circumstances matters in every single case when it comes to consent the most recent case now facebook cited the district court case from here from this but in fail phobe or versus management technology consultants this court explained that in every case the scope of consent must be determined upon the facts of the situation in which the person gave consent and then if you look at fia fell and the blood saw case those cases stand for the proposition that in some circumstances the totality of circumstances are such that even over an express consent is not enough and what we submit is that that this is one of those cases but even if it was not facebook's disclosure which is buried does not get to the specifics of the conduct alleged here where was there and i may be misremembering this but i thought the reason i opted to choose  don't want this is no your honor there is no opt out that is not present in the can point we are here on a motion to dismiss facebook asserts that there is an opt out from targeted advertising but there is no opt out from the tracking on medical websites so for example the case from which they take their test which we think is one of the elements of this is perkins versus linked in we think it's an incomplete test but  it was only in light of the exact disclosures the proximity of the disclosures the wrongful conduct and the fact that there was an opt out provision and if you read perkins the disclosures and the plaintiff's choice in that case occurred exactly when the conduct was happening and the plaintiff had not just one opportunity to opt out but they had two opportunities to opt out and i would even express it that way because the plaintiffs in that case had to opt in but in this case none of those things are present the activity occurs far away from the defendant's website the activity occurs far away in time from the defendant's web site and there's no opt out right counsel does it matter that the information involved is not protected health care information of a personal kind like your own you know social security number and your weight in your blood pressure it's  more generic than that does that make any difference well i think the district court erred in making that determination well i'm asking you that's a yes or no question doesn't matter and yes whatever your answer it's mine ok we i think we prevail either way we assert that hipaa applies because the information is received or created by a hospital it relates to these individual plaintiffs health and they're individually identifiable but put hipaa to the side because the test for consent under this circuit if you look at the cases that we've cited there are binding circuit precedents is this considering the totality of circumstances would a reasonable consumer have understood and in fact affirmative consented to the precise conduct here and what is the conduct facebook is violating the promises in the first very first paragraph of its privacy policy it's violating the promises of into teas that are health care organizations that it calls its own partners that's really your beef it's with medical providers that ought not be putting this stuff on facebook where it can be shared all that is and so obviously they've been dismissed for lack of personal jurisdiction they can be sued elsewhere presumably but it strikes me that this is if there's a problem it isn't with facebook it's with health care providers we would agree on your assessment of the health care provider problem but facebook cannot in its first paragraph the very first one say your privacy is important will make important disclosures so you can make informed decisions are likely to happen this is very important to me but i'm going to ask you hard questions and so i  promise hold on i'm at the very same time that facebook is actively participating and known express privacy promises to the plaintiffs about a sensitive subject it is like an agreement to you could have a consent that someone pushes you correct and say i push you but i'm not going to hurt you but then my partner stands behind you and i push you and i know my partner is behind you having a your safety and you fall down facebook cannot promise privacy on one hand and then conspire with its partners on the other hand to boston prop it doesn't say everything you put here will be kept private it just says generically this concept is important it says facebook sets a standard for itself that is going to make important a cyclo zhorzh so you can make informed decisions and those things that are important disclosures and informed so that you can make informed decision those are questions of fact to be determined upon by a jury and in fact finder based on a reasonable reading of the contract the plaintiffs believe that that that paragraph means that facebook is going to tell them those things that a reasonable consumer would find important and we think it's important to know that facebook could be tracking their communications with health care providers who express lee promise to keep them private that also goes to the good faith and fair dealing issues that the district court did not address at all and we have a claim that this conduct is entirely inconsistent with the first paragraph of that of that issue of that privacy policy your honor and let me go back to my original example if i could because the e c p a the internet and facebook did not a race one hundred years more than that of common law on consent and the fact is that the electronic communications privacy act was passed in designed specifically to give electronic communications that occurred by computer the same protections that were already afforded to oral and wire communications that apply that happened by telephone and so if you take yourself back in time and ask if in one thousand nine hundred five some media company the new york times to which you subscribed it had something hidden in the contract with the new york times that said by the way we're going to track every phone call you have including phone calls you make with medical providers would that be sufficient consent to say that the plaintiffs had consented to this third party tracking their communications with their health care providers we think not your honour's and i reserve the remainder facebook and i wanted to point the court to where plaintiff is reading from because plaintiff repeatedly takes that language from facebook statement of rights and responsibilities out of conduct to ninety you exactly around are your two steps ahead of me so it says your privacy is very important to us we designed our data policy to make important disclosures about how you can use facebook to share with others and how we collect and can use your content and information we encourage you to read the data policy and to use it to help you make informed decisions so facebook is not saying in a vacuum your privacy is important to us and we will keep everything private what it is saying is that your privacy is important to us and we want you to make an informed decision so please go read our data policy the statement of rights and responsibilities goes on to say that by using facebook you agree that your data can be collected and used in accordance with that data policy it says go read the data policy and that's where we're going to tell you what we're going to do with your data so then as judge cavalia found below if you then go to the data policy it covers the precise conduct that's at issue here and so the question before this court is whether somebody a reasonable person reading the data policy would understand that the kinds of search terms and the kinds of communications that the plaintiffs are alleging in their complaint would have been received by facebook so what facebook says in the da policy is we collect information when you visit or use third party websites and apps that use her services this includes information about the websites and apps you visit and information the developer and publisher of the app or website provides to you or us then and this response to plaintiff's point about this happening far away from facebook facebook says facebook receives information about you and your activities on and off facebook from third party partners and says we use this information to improve our advertising and measurement systems so we can show you relevant ads on and off our services and then finally it says well not finally there are many more disclosures but most relevant lee and finally it says we want our advertising to be as relevant and interesting as the other information you find on our services with this in mind we use all of the information we have about you to show you relevant ads ok so it says we use all of this information it then directs people to the cookie policy it says we use cookies and similar technologies to provide and support our services read our cookie policy to learn more now the plaintiffs are alleging in their complaint as judge cavalia noted that the data policy the cookie policy and the statement of rights and responsibilities are valid contract so now we go to the cookie policy and it says we may also work with an advertiser it's marketing partners to show you an ad on or off facebook services or show you an ad based on the websites you visit or the apps you use all across the internet and the mobile ecosystem so facebook is describing exactly what the plaintiffs are claiming it did in this case it's saying when you go to websites that are on or off facebook we're going to collect information about your activities we're going to look at the websites that you visit all across the internet and the mobile ecosystem and use all of the information that we have about you to show you relevant advertising that's precisely what the plaintiffs are claiming happened here if this were true if the information would your answer be different in terms of the scope of consent it wouldn't be different in terms of the scope of couple reasons why hipaa still would not apply in that situation the first is that hipaa does not have a private right of action hipaa is a government statute that regulates healthcare providers and health plans and so that wrote that raises two respective problems for  s hit the gloss on this case the first is that no court has ever applied help us players have certainly not cited any such case to import the consent standard into another kind of case so this is an ordinary contract consent case and the players are saying but no you should put this gloss on it because of hipaa but hipaa doesn't have a part of a private right of action and so the u s supreme court said in the astra case that we cited in our briefs that were a statute doesn't have a private right of action you can't just bring a case on another theory and that case it was a contract theory and import the standard from the statute to create the potential for liability where there otherwise would be none because then you're this yet in the absence of a private right of action yes the other except  moving to this case yes you're on a hypothetical if it's hip information would control the reasonable expectations of privacy given in the disclosures on facebook would i know you're on i don't you think that  no your honor but that is why facebook tells hipaa providers don't give us have protected information that's not in the record but i just want to be clear that facebook tells companies like the health care defendants in this case don't give us that personal information and it's important to think about if the planets are going to talk about the totality of circumstances here it's important also to look at the face of the health care companies disclosures they say two things right first they say we will share information about your browsing habits they say that is not personal they say if you are typing terms into a search engine that's not personal it's not protected by hipaa and we may share it with third party companies and you should go look at those third party companies privacy policies to see what protections they offer so facebook is not bound by the health care companies promises but those health care company promises did incorporate facebook standards second of all the health care companies said we will not share your p r i but as the court has i think recognized this is not and it's worth sort of looking at the you are l's in this case are reproduced in the record at page  believe one ninety six and those u r l show exactly why this is not protected health information under hippa and i think that that my opponents argument made that pretty clear if you look at  language of those who are else all they indicate is that somebody was interested in information about right it could be for any reason their cousin or their friend or there are high school news newspaper article but if honor's point that their beef is with the health care companies because facebook was a passive recipient of this information if it was disclosed in violation of hip but the beef is not with facebook that they would be with the health care companies but you want to go on i'm sorry i i am not a user so this may be an ignorant question but reading the data policy there's a section called how can i manage or delete information about me and there's pointing to something called the activity log don't opt out that is not an opt out from all data collection but their facebook offers many ways of going in and restricting the ability but it's not in the data policy itself or is  that provision in the data policy itself a method of opting out of what the plaintiffs are complaining it is a method for restricting the information that exists after you after you've already been to the website as as detailed in the complaint in our briefs in this case under the data policy the way it worked was that facebook received the refer head either simultaneously or shortly after plaintiffs went to the website and typed in these terms so the activity log is a way of looking at what you've done after and making changes to what's available it's not it would not i believe prevent facebook from receiving that information directly from the planet's browsers in the first instance but the the facebook's help pages which are linked from the from the data policy do present a number of other ways of controlling your mean i i believe that the date this data policy this touch the complaint explains the very limited information if any i believe no information is collected when you're logged out of facebook the district court had had noted that there are a number of other ways of protecting your your information and i but there's no there's no general opt out provision to say no facebook you cannot collect information there are ways to restrict the dissemination or the use of information with her after i mean there are other ways off of facebook there of course cookie blockers of the kind described in the third circuit's decision there are a number of other mechanisms that somebody can use but that's precisely why facebook is so clear about this i mean the plaintiffs come in and they say that our visits to these websites are is information that is private and sensitive to us and we understand we appreciate that these disclosures need to talk to be of people each of whom believes that different kinds of things are private and sensitive so these plaintiffs are saying a lot i asked for information about cancer and i believe that that's sensitive somebody else might think that the shopping habits are sensitive or the fact that they were visiting a disease divorce lawyers website is sensitive or seeking parenting and bias is sensitive and because everybody thinks different things are sensitive and facebook has to offer disclosures that will enable millions of people to make meaningful and informed decisions about the use of their data facebook has to say look we are receiving information about your activities on and off facebook across the internet in the mobile ecosystem and using all of that information to serve you to serve you ads and so that is why these these terms in other words are not general and they're not vague they are categorical they're saying we're receiving this information and this is how we are using at so  that is why they are binding on the plaintiffs here this isn't someone unusual case because the plaintiffs attached all of these agreements to their complaint and specifically alleged that they formed a valid contract in the district court noted why they did that they did that because had a breach of good faith and fair dealing claim and because they had a fraud claim and they said in their complaint that they read these policies and reliant on them they didn't allege that in a way that would satisfy ninety or twenty six or anything else for the reasons that we said in our brief but they did a legit and the district point out look you can't on the one hand say we read and relied on these policies and then say on the other hand that they're buried i mean my my opponent stood up and said well these policies are buried that's not a valid argument here because they don't say that they didn't read the policies or that they were unable to find understand the policies to the contrary they said they did find the policies they read them and they relied on them and so that  was critical to the district court's decision in this case so we believe that the district court was correct on its consent ruling we also believe that there are a number of other alternative reasons why each of the plaintiff's claims fail which are aligned in our brief and if the court has has no further questions i'm happy to see the rest of my time thank thank you your honors a couple quick points in the end or send for example says under no circumstances would ever disclose to a third party personal information about individual medical conditions or interest except when we believe in good faith that the law requires it when opposing counsel says the hospital said they do this you can read the privacy policies of the hospitals yourselves that's that's not true in this context why do the hospitals privacy policies matter for your case against facebook i love that question your honor because you think this the it's the existing state of internet privacy law is that your ordinary consumer is there's a legal fiction that they've read understood and agreed to all these privacy policies facebook is the most sophisticated internet consumer in the entire world and facebook interacts with these entities that opposing counsel and itself calls its partners and if the plaintiffs ordinary consumers are bound to know the stuff that's in these privacy policies of the websites with which they interact we think the same rule ought to be applied to facebook these possibles promise not to do it facebook knows they promise not to do it and yet facebook participates in the breach anyway and that violates the very first promise you're on to us some questions about other things you have some i think there are fact questions it's important to remember this is a motion to dismiss facebook does not have a way that you can purge the web browsing history from facebook right now about a month ago they announced in congress that they may create that tool in the future but it doesn't exist right now there is no way to opt out unlike the cases they rely upon where there was an opt out right then and there in question and evacuate was very different it was about pet supplies and tracking on amazon dot com this is about health care decisions it's about shopping for intestine transplants when opposing counsel says well maybe it is and maybe it isn't i mean if i were a journalist and i wanted to write an article about stomach transplants or heart transplants i would visit all those websites it isn't and your i sincerely private in the way that you're describing and your honor that may be true that may be a good argument on class certification motion but the for these particular point if they relate to their particular health conditions and so that's an argument for a later day not to say that these particular plaintiffs don't your hypothetical let's assume it's not protected information to your argument what how does that affect your argument well another good question because this circuits precedence the if all the norman blood saw every case is a totality of circumstances case that's true even in contract law where there is a dispute about a term of a contract they cite young vs wideawake i asked the court to read young versus white awakes recitation of california contract law where they talk about looking outside the four corners of the document so how does it change it doesn't change the result it changes the test the test is considering the totality of circumstances would a reasonable consumer have understood and in fact affirmatively consented to the precise conduct and facebook wants this court to ignore everything except for two paragraphs and everything outside those two paragraphs leads to the other result and it's important to point out to the court just house absurd the result facebook wants is if you read the next sentence of this was cited by opposing counsel that says we received information about you on and off of facebook that if this court rules in facebook's favor it is giving giving it a blank check to collect anything and everything it wants regardless of any contrary privacy promises regardless of any laws to the contrary because in my hypothetical of the phone call if the cleveland clinic took that data from the phone call and transferred it to facebook via snail mail and we sued because of that facebook would point to the exact same provision in their privacy policy and say your honour's when they signed up for face book they agreed facebook could receive data on and off facebook about them and we would say but your honour's you have to look at the totality of circumstances because that's the law in every other case and the internet and facebook did not change the common law and to rule in facebook's favor i think does violence to the intent of the e c p a which was to give computer communications the very same protections that those telephone communications had and that i talked about earlier today  counsel thank you both for your arguments the case is terribly submitted for decision and will be in recess for the morning