In the

United States Court of Appeals

for the Seventh Circuit

____________________ 

No. 20-3134 

MATT DINERSTEIN, individually and

on behalf of all others similarly situated,

Plaintiff-Appellant, 

v.

GOOGLE, LLC; UNIVERSITY OF CHICAGO;

and UNIVERSITY OF CHICAGO MEDICAL CENTER; 

Defendants-Appellees. 

____________________ 

Appeal from the United States District Court for the

Northern District of Illinois, Eastern Division.

No. 19 C 4311 — Rebecca R. Pallmeyer, Chief Judge. 

____________________ 

ARGUED SEPTEMBER 17, 2021 — DECIDED JULY 11, 2023 

____________________ 

Before SYKES, Chief Judge, and FLAUM and KIRSCH, Circuit 

Judges. 

SYKES, Chief Judge. This class-action lawsuit arises from a 

research collaboration between Google and the University of 

Chicago together with its affiliated Medical Center. (We will

refer to the latter two as “the University” unless the context 
2 No. 20-3134 

requires otherwise.) Harnessing the power of artificial 

intelligence, the research partners aspired to develop software capable of anticipating patients’ future healthcare

needs. If successful, the software promised to reduce medical complications, eliminate unnecessary hospital stays, and, 

ultimately, improve patients’ healthcare outcomes. 

As an initial step in the research effort, the University delivered several years of anonymized patient medical records

to Google, thus supplying it with the information needed to 

“train” the software’s algorithms. A Data Use Agreement

governed the transfer. Restricting Google’s use of the records to a list of specific research-related activities, the 

agreement expressly prohibited the company from attempting to identify any patient whose records were disclosed. 

The anonymized electronic records subject to the agreement included those of Matt Dinerstein, twice an inpatient at 

the hospital during the period covered by the records disclosure. Dinerstein sued Google and the University on behalf of 

himself and a class of other patients whose anonymized 

records were disclosed. He alleged several theories of liability. He first claimed that the University had breached either 

an express or an implied contract traceable to a privacy 

notice he received and an authorization he signed upon each 

admission to the Medical Center. Alternatively, he asserted a 

claim for unjust enrichment. Citing the same notice and 

authorization, he also alleged that the University had reneged on its promise of patient confidentiality and therefore 

violated the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILL. COMP. STAT. 505/1 et seq. Against

Google, he asserted claims for unjust enrichment and tortious interference with his contract with the University. 
No. 20-3134 3 

Finally, he brought a privacy claim against all defendants 

based on allegations of intrusion upon seclusion. 

The district judge dismissed the consumer-fraud claim 

for lack of standing and the rest of the suit for failure to state 

a claim. We agree with her decision to dismiss the case, but 

our analysis begins and ends with standing. Dinerstein has 

not adequately alleged standing to pursue any of his claims. 

To sue in federal court, a plaintiff must plausibly allege (and 

later prove) that he has suffered an injury in fact that is

concrete and particularized, actual or imminent, and traceable to the defendant’s conduct. The injuries Dinerstein

alleges lack plausibility, concreteness, or imminence (or 

some combination of the three). Because the complaint fails 

to plausibly allege an injury in fact, we affirm but modify the 

judgment to reflect a jurisdictional dismissal for lack of 

standing.

I. Background

Our factual account is drawn from Dinerstein’s amended 

complaint. We begin with a description of his inpatient stays 

at the University Medical Center—and more particularly, 

the paperwork he received at the start of each admission. 

Dinerstein alleges that he was first admitted to the Medical 

Center on June 4, 2015, and was discharged three days later. 

He was then readmitted on June 25, this time for a two-night 

stay. Upon each admission Dinerstein received a Notice of 

Privacy Practices detailing the University’s confidentiality 

obligations and the circumstances in which it might use or 

disclose patient medical information. Relevant here, the 

notice stated that the University would obtain “written 

permission” for the sale of such information. Patient permission was not required, however, for the University to use or 
4 No. 20-3134 

share the information in limited research-related circumstances. In addition to the notice, Dinerstein received and 

signed an Admission and Outpatient Agreement and Authorization. By doing so he affirmed that he understood that 

his medical information might be shared for approved 

research purposes and that if so, he would “not be entitled to 

any compensation.” He further acknowledged that “all 

efforts” would “be made to protect [his] privacy” and that 

“any use of [his] medical information” would comply with 

both the notice and “federal and state laws.” 

During Dinerstein’s two hospital stays, the University 

compiled records of his vital readings, medical procedures, 

prescriptions, test results, and diagnoses. The records also

contained demographic information. After each discharge 

from the hospital, the Medical Center maintained electronic 

copies of his patient records.

Approximately two years after Dinerstein’s hospital visits, Google announced that it had partnered with the University to research new healthcare technology. With the help of 

machine learning, the research partners aspired to develop 

predictive modeling software that would improve the ability 

of medical providers to forecast their patients’ medical needs 

and, in turn, to tailor subsequent medical care. As described 

in promotional statements, the project had the potential to 

prevent medical complications, reduce hospital visits, and 

improve overall health and well-being.1

1 Matt Wood, UChicago Medicine Collaborates with Google to Use Machine 

Learning for Better Health Care, UCHICAGO MEDICINE (May 17, 2017), 

https://www.uchicagomedicine.org/forefront/research-and-discoveriesarticles/uchicago-medicine-collaborates-with-google-to-use-machinelearning-for-better-health-care. 
No. 20-3134 5 

To reliably predict medical outcomes, the models needed 

extensive information from which to learn. The University 

thus agreed to transfer to Google a large set of anonymized 

patient medical records. A Data Use Agreement executed by 

the partners in December 2016 governed the transfer. While 

most of the agreement’s provisions are irrelevant for our 

purposes, a few deserve mention. First, the agreement 

contemplated that before disclosure the University would 

strip the patient records of all direct identifying information 

except the dates of medical events and services. Second, the 

agreement delineated the records’ authorized uses. In particular, Google was permitted to use the records only to

identify key medical information, to develop predictive 

models, and to assess the models’ efficacy. It could neither 

disclose information from within the records nor use the

records in contravention of federal law. Most importantly, 

the agreement strictly prohibited Google from using the 

records “to identify any individual.” Third, if the parties’ 

research efforts proved successful, the agreement granted 

the University a perpetual license to use the predictive 

models for its own “internal non-commercial research

purposes.” 

The batch of medical records covered by the Data Use 

Agreement spanned several years. Specifically, the agreement directed the University to transfer to Google anonymized records generated from all inpatient, outpatient, and 

emergency adult-patient encounters between January 1, 

2010, and June 30, 2016. Both of Dinerstein’s overnight stays 

occurred in June 2015, so his medical records were included 

in the set disclosed to Google. Dinerstein alleges that the 

University never obtained his consent—written or other-
6 No. 20-3134 

wise—for the third-party record disclosure. Nor did Google 

seek permission to use his records.

Dinerstein filed suit against the University and Google

seeking damages and injunctive relief on behalf of himself 

and a class of patients whose anonymized records were 

disclosed. He raised seven claims for relief. Against the 

University he alleged claims for breach of an express or an 

implied contract premised on the notice he received and the 

authorization he signed upon each admission to the Medical 

Center. More to the point, Dinerstein alleged that in exchange for his payment and personal medical information, 

the University had agreed to protect and secure his information. By sharing it with Google, the University had failed 

to uphold its end of the bargain. As an alternative to his 

contract claims, Dinerstein sought damages for unjust

enrichment. He also alleged a claim for violation of the 

Illinois Consumer Fraud and Deceptive Business Practices 

Act. This statutory claim rested on the alleged broken promises, which Dinerstein asserted the University never intended to keep in the first place. 

Turning to Google, Dinerstein alleged that the company

had tortiously interfered with his contract with the University. He also asserted a claim for unjust enrichment based on 

the company’s receipt of valuable patient medical records. 

Finally, Dinerstein brought a tort claim against Google and 

the University for invasion of privacy. More specifically, he 

alleged that they had intruded upon his seclusion by sending and receiving his sensitive medical information.

Relevant to this last theory of liability, Dinerstein claimed

that while he was an inpatient at the Medical Center, he had 

used a smartphone with geolocation capabilities. Because he 
No. 20-3134 7 

had also downloaded various Google apps, he alleged that 

the phone granted the company access to his precise location 

during every moment of his hospital stays. He further 

alleged that if Google compared his location data with the 

insufficiently anonymized patient records, it could easily 

ascertain his identity and uncover “intimate private details” 

in his medical histories. And he alleged that Google could do 

the same thing with other class members’ geolocation data.

The defendants moved to dismiss under Rules 12(b)(1) 

and (6) of the Federal Rules of Civil Procedure. They argued

that Dinerstein had not alleged a concrete injury to support 

Article III standing and, alternatively, that he had not stated 

a cognizable claim. The judge granted the motion, agreeing 

primarily with the latter argument and dismissing the

complaint in its entirety. 

On the standing issue, the judge construed Dinerstein’s

allegations about a lost benefit of the bargain as sufficient to 

support standing to sue on the contract (and contractalternative) theories against both the University and Google. 

Dinerstein v. Google, LLC, 484 F. Supp. 3d 561, 574 (N.D. Ill. 

2020). She also reasoned that the allegations about an invasion of privacy—in the form of a wrongful disclosure of his 

private medical information—supported Dinerstein’s standing to sue for intrusion upon seclusion. Id. at 575. But the

judge dismissed the consumer-fraud claim for lack of standing because “[a] claim under [the Illinois Consumer Fraud 

and Deceptive Business Practices Act] requires a showing of 

actual damages,” which Dinerstein had not alleged. Id. at 579 

(citing 815 ILL. COMP. STAT. 505/10a(a)). 

Moving on, the judge dismissed the claims for breach of 

contract—express or implied—for failure to state a cogniza-
8 No. 20-3134 

ble claim because Dinerstein had not adequately pleaded 

economic damages, a required element under Illinois law. Id. 

at 590–93; FED. R. CIV. P. 12(b)(6). Next, the judge noted but 

chose not to decide the question whether Dinerstein’s claim

for tortious interference with contract necessarily fell with 

the other contract claims. Instead, she held that the claim

failed for a separate reason: Dinerstein had not sufficiently

pleaded that Google had intentionally caused the University’s

breach of contract. Id. at 593. (Intent is necessary to state a 

claim of tortious interference with contract in Illinois. HPI 

Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 545 N.E.2d 

672, 676 (Ill. 1989).) 

Turning to the privacy claim, the judge observed that 

Dinerstein had recharacterized his original intrusion-uponseclusion claim as a novel tort claim for breach of medical 

confidentiality, a theory not yet recognized in Illinois. The 

judge thought it unlikely that the Illinois Supreme Court 

would recognize such a claim, so she declined to permit 

Dinerstein to pursue it in federal court. That left only the 

unjust-enrichment claims. Because unjust enrichment is not 

an independent cause of action in Illinois, the judge dismissed those claims as well. Dinerstein appealed.

II. Discussion

The dismissal order rests partly on a failure to allege

Article III standing but mostly on the judge’s conclusion that 

Dinerstein failed to state a claim upon which relief can be 

granted. Our review of either basis for dismissal is de novo. 

Nowlin v. Pritzker, 34 F.4th 629, 632 (7th Cir. 2022). The 

parties primarily focus on whether the amended complaint 

satisfies the statutory and common-law pleading requirements particular to each claim. But the threshold question is 
No. 20-3134 9 

standing, which “is jurisdictional and cannot be waived.” 

Nettles v. Midland Funding LLC, 983 F.3d 896, 899 (7th Cir. 

2020). 

Standing doctrine traces its origins to Article III of the 

Constitution, which grants federal courts the power to 

resolve “Cases” and “Controversies.” U.S. CONST. art. III, § 2.

The doctrine’s elements are well established and familiar. To 

sue in federal court, a plaintiff must have suffered (1) a 

concrete, particularized, and actual or imminent injury (an 

“injury in fact”) (2) that is fairly traceable to the defendant 

and (3) that is likely to be redressed by a favorable judicial 

decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992).

“[A]t the pleading stage, the plaintiff must clearly ... allege 

facts demonstrating each element.” Spokeo, Inc. v. Robins, 

578 U.S. 330, 338 (2016) (quotation marks omitted). Moreover, “standing is not dispensed in gross; rather, plaintiffs 

must demonstrate standing for each claim that they press 

and for each form of relief that they seek.” TransUnion LLC v. 

Ramirez, 141 S. Ct. 2190, 2208 (2021). 

Like many of our recent cases concerning Article III 

standing, this one hinges on the injury-in-fact element, and 

in particular, the concreteness and imminence requirements.

While the concreteness requirement examines the substance 

of a plaintiff’s asserted injury, the imminence requirement 

measures its likelihood. In other words, to provide a basis to 

sue in federal court, an injury must exist “in both a qualitative and [a] temporal sense.” Whitmore v. Arkansas, 495 U.S. 

149, 155 (1990). 

Starting with the qualitative aspect, “[a] concrete injury

must be de facto; that is, it must actually exist.” Spokeo, 

578 U.S. at 340 (quotation marks omitted). Endorsing the 
10 No. 20-3134 

term’s “usual meaning,” the Supreme Court has described a 

concrete injury as one that is “real[] and not abstract.” Id. 

(quotation marks omitted). Both tangible and intangible 

harms may fit the bill, even if tangible harms like “physical 

or monetary injur[ies]” are perhaps more intuitively concrete. TransUnion, 141 S. Ct. at 2204. As the Court has explained, our task—especially when the plaintiff asserts an

intangible harm—is to assess whether the alleged injury has

“a close relationship to a harm traditionally recognized as 

providing a basis for a lawsuit in American courts.” Id.

(quotation marks omitted). The inquiry asks whether the 

plaintiff has “identified a close historical or common-law 

analogue” for his asserted injury. Id. Put another way, when 

reviewing a plaintiff’s alleged injury for concreteness,

“[h]istory and tradition remain our ever-present guides.” 

Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 938 (7th Cir. 

2022). 

Imminence is more of an “elastic concept.” Lujan, 

504 U.S. at 564 n.2. While it lacks a precise framework, the 

basic function of the imminence requirement “is to ensure 

that the alleged injury is not too speculative for Article III 

purposes.” Id. Accordingly, a plaintiff who has not suffered 

a past harm cannot simply rest on allegations that he may 

suffer some “possible future injury,” Whitmore, 495 U.S. at 

158, “at some indefinite future time,” Lujan, 504 U.S. at 564 

n.2. His threatened injury instead must be “certainly impending” to satisfy Article III. Id. And importantly, while an 

imminent risk of future harm may suffice to support standing to sue for prospective relief (i.e., an injunction), a claim for

damages requires a concrete harm that has in fact occurred. 

TransUnion, 141 S. Ct. at 2210–11. 
No. 20-3134 11 

With these fundamental standing principles in mind, we 

turn to the claims presented in this case. At the outset, 

however, we note that Dinerstein omitted from his opening 

brief any discussion about the claims for unjust enrichment 

or breach of an implied contract. By doing so, he abandoned 

these claims on appeal, and we need not consider them. See 

White v. United States, 8 F.4th 547, 552 (7th Cir. 2021); see also 

FED. R. APP. P. 28(a)(8)(A) (requiring that the appellant’s 

brief include his “contentions and the reasons for them”). 

What remains is the privacy claim, the claim for breach of an 

express contract, the consumer-fraud claim, and the claim 

for tortious interference with contract. We address each in 

turn.

A. Privacy Claim

We begin with the alleged breach of privacy because the 

asserted injury underlying this claim is common to all claims 

that remain live on appeal. In other words, our resolution of 

the standing issue on this claim necessarily resolves portions 

of others, streamlining our discussion of the claims that 

follow. 

Before diving into the standing analysis, we must discern 

what, exactly, Dinerstein’s privacy claim is. His complaint 

characterizes the defendants’ conduct as a common-law

intrusion upon seclusion, which is potentially actionable 

when the alleged tortfeasor “intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another.” 

RESTATEMENT (SECOND) OF TORTS § 652(B) (AM. LAW INST. 

1977) [hereinafter RESTATEMENT]. The Illinois Supreme Court 

has adopted this definition of the tort, describing the purpose of the seclusion right as “protecting a person from 

another’s prying into their physical boundaries or affairs.” 
12 No. 20-3134 

W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 

183 N.E.3d 47, 58 (Ill. 2021); see also Lovgren v. Citizens First 

Nat’l Bank, 534 N.E.2d 987, 988–89 (Ill. 1989). 

Apparently accepting that neither defendant’s conduct 

fits the elements of this tort, Dinerstein abandoned his 

intrusion-upon-seclusion theory below, as the district judge 

noted. Dinerstein, 484 F. Supp. 3d at 594. In his response to

the defendants’ motion to dismiss, Dinerstein reframed his 

privacy claim as a breach of medical confidentiality, a novel 

cause of action that posits a common-law duty of medical 

providers to maintain patient confidentiality. Several states 

have recognized some variety of this tort. See, e.g., Lawson v. 

Halpern-Reiss, 212 A.3d 1213, 1219 (Vt. 2019); Byrne v. Avery 

Ctr. for Obstetrics & Gynecology, P.C., 175 A.3d 1, 17 (Conn. 

2018); McCormick v. England, 494 S.E.2d 431, 437 (S.C. Ct. 

App. 1997). But Illinois is not one of them. Dinerstein therefore invited the district judge, sitting in diversity, to hold 

that the Illinois Supreme Court would recognize the tort 

under Illinois law. See Zahn v. N. Am. Power & Gas, LLC, 

815 F.3d 1082, 1087 (7th Cir. 2016) ([W]e must use our own 

best judgment to estimate how the [Illinois] Supreme Court 

would rule as to its law.” (quotation marks omitted)). As 

we’ve noted, the judge declined that invitation. Dinerstein, 

484 F. Supp. 3d at 595. 

More importantly for our purposes, however, Dinerstein 

has chosen to stick with the new version of his privacy claim 

on appeal. He premises his privacy-related challenges

exclusively on the novel medical-confidentiality theory. 

Following his lead, then, we focus our discussion of standing 

on the reframed privacy theory. 
No. 20-3134 13 

Dinerstein presents his privacy injury in two forms, one 

backward-looking and the other forward-looking. But 

considered in either direction—past or future—his asserted 

injury does not establish standing to sue.

1. Past Harm

We start with the backward-looking form of injury. Crucially, Dinerstein does not allege that Google has already 

used the disclosed patient records to discern his identity. 

Instead he focuses on the conduct of the University, arguing

that the record transfer was itself an actionable invasion of 

his medical privacy. This is so, Dinerstein asserts, regardless

of whether Google ever actually identifies him. 

By referencing a common-law privacy invasion, 

Dinerstein attempts to compare his asserted injury to a harm 

“traditionally recognized as providing a basis for lawsuits in 

American courts.” TransUnion, 141 S. Ct. at 2204. In other 

words, he engages with the proper inquiry under the 

Supreme Court’s recent standing caselaw. But as we’ve

explained, an “invasion of privacy” is not a standalone tort; 

the term “encompasse[s] four theories of wrongdoing: intrusion upon seclusion, appropriation of a person’s name or 

likeness, publicity given to private life, and publicity placing 

a person in a false light.” Pucillo v. Nat’l Credit Sys., Inc., 

66 F.4th 634, 639–40 (7th Cir. 2023) (quoting Persinger v. Sw. 

Credit Sys., L.P., 20 F.4th 1184, 1192 (7th Cir. 2021)); see also 

RESTATEMENT §§ 652A–652E. And because TransUnion 

requires us to nail down a particular common-law analogue,

we must assess whether any of the recognized privacy torts 

is sufficiently analogous to Dinerstein’s asserted injury. If 

not, no concrete harm. “No concrete harm, no standing.” 

TransUnion, 141 S. Ct. at 2214. 
14 No. 20-3134 

Of the four traditional privacy tort theories, the closest 

comparator to Dinerstein’s new theory is probably the tort of 

publicity given to private life, which occurs when someone 

“gives publicity” to a “highly offensive” matter “concerning 

the private life of another” that “is not of legitimate concern

to the public.” RESTATEMENT § 652D. Yet Dinerstein has 

identified no case in which a court has permitted a plaintiff 

to bring a public-disclosure tort premised on the dissemination of anonymized information.2 Indeed, while the relevant

caselaw is sparse, we’re skeptical that this alleged factual 

scenario would give rise to any injury at all—let alone one 

concrete enough to support Article III standing. See, e.g.,

Shulman v. Grp. W Prods., Inc., 955 P.2d 469, 489 n.12 (Cal. 

1998) (“[C]omplete lack of identification or identifiability 

would seemingly defeat a private facts claim, as there could 

be no injury ... .”); Harris ex rel. Harris v. Easton Publ’g Co., 

483 A.2d 1377, 1385 (Pa. 1984) (“Absent an ability to identify 

the complainant, there can be no communication and hence, 

no publicity.”); cf. Frobose v. Am. Sav. & Loan Ass’n, 152 F.3d 

602, 618 (7th Cir. 1998) (rejecting a false-light claim because 

the communication neither mentioned the plaintiff by name 

nor made her “readily identifiable to the public”). 

Resisting this conclusion, Dinerstein contends that the 

University’s records were insufficiently anonymized. He 

cites a presentation from the 2017 Google Cloud Next conference by Dr. Samuel Volchenboum, the University’s 

Associate Chief Research Informatics Officer. Dinerstein 

argues that Dr. Volchenboum’s presentation highlighted

2 Nor has Dinerstein identified a case in which a court has permitted a 

plaintiff to bring the novel claim of breach of medical confidentiality in 

circumstances like these.
No. 20-3134 15 

various deficiencies in the “typical de-identification process.”3 He contends that the process risks leaving identifying 

clues like the patient’s age, place of residence, and family 

relations scattered throughout the purportedly “deidentified” medical records. According to Dinerstein, such 

clues are routinely found in the treating physician’s “freetext” clinical notes. If these clues are pieced together, 

reidentification is supposedly simple. 

But Dinerstein’s complaint omits any allegations linking 

the so-called “typical de-identification process” described in 

Dr. Volchenboum’s presentation to the University’s deidentification process here. Put differently, just because some 

de-identification processes might be deficient, we cannot 

assume that the University’s process was necessarily so. To 

the contrary, the complaint acknowledges that the challenged record transfer occurred pursuant to the Data Use 

Agreement, which states that “the majority of [patient] 

identifiers will be removed,” leaving only “actual dates of 

[medical] service and events.” Dinerstein’s allegations of 

insufficient anonymization therefore do not cross the plausibility threshold. See Silha v. ACT, Inc., 807 F.3d 169, 174 (7th 

Cir. 2015) (“[T]he Twombly-Iqbal facial plausibility requirement for pleading a claim is incorporated into the standard 

for pleading subject matter jurisdiction.”). 

Moreover, Dinerstein appears to concede that the University adequately discharged its de-identification obligation. Describing a jointly authored article from the 

University and Google, the complaint states that although

3 Google Cloud Tech, Sensitive Data Management for Collaborative Research 

Clouds (Google Cloud Next '17), YOUTUBE (Mar. 9, 2017), 

https://www.youtube.com/watch?v=7Si956MXhWQ.
16 No. 20-3134 

“the [date stamps] from the University patients’ records 

were maintained,” the records otherwise had been “deidentified.” And aside from the date stamps, Dinerstein does 

not pinpoint any information within the records that he 

thinks should have been redacted and was not. Nor does he 

allege that the date stamps alone were impermissibly identifying. At most he alleges that some personally identifying 

information “may have evaded redaction”—a hypothetical

that does not support his repeated but conclusory assertions

that the University’s records were insufficiently anonymized. “Such ... bare assertion[s] of harm—unsupported by 

any concrete details”—do not suffice to allege a plausible, 

concrete injury. Nowlin, 34 F.4th at 633. 

2. Risk of Future Harm

That brings us to Dinerstein’s allegations of a forwardlooking privacy injury. Unlike the backward-looking injury, 

this injury turns on Google’s conduct—or more precisely, its

anticipated conduct. At bottom, Dinerstein worries that the 

date stamps contained in the transferred medical records, 

along with the geolocation and demographic data collected 

from his smartphone apps, offer Google a “perfect formulation of data points” for later reidentification. In other words, 

the record transfer created a risk that he might someday be 

reidentified. 

To the extent that Dinerstein rests his claim for damages 

on allegations of future risk, the argument is a nonstarter. In 

TransUnion the Supreme Court clarified that unless a “risk of 

future harm materializes,” a plaintiff may rely on an “imminent and substantial” risk of harm only when “pursu[ing] 

forward-looking, injunctive relief to prevent the harm from 

occurring.” 141 S. Ct. at 2210–11 (emphasis added). Or as our 
No. 20-3134 17 

court has summarized: “A plaintiff seeking money damages 

has standing to sue in federal court only for harms that have 

in fact materialized.” Pierre, 29 F.4th at 938. Because 

Dinerstein alleges no material harm arising from the alleged

risk of future reidentification, that future risk cannot support 

standing to sue for damages. 

The alleged risk does not support standing to sue for injunctive relief either, though for a different reason: the risk 

Dinerstein alleges is not sufficiently imminent. To be sure, 

Google possesses a wealth of data about most, if not all, 

Americans. Yet Dinerstein ignores that the governing Data 

Use Agreement expressly prohibited Google from using the 

transferred medical records—either by themselves or in 

tandem with data already in its possession—“to identify any 

individual.” And even if the contractual obligation doesn’t 

itself foreclose the risk of reidentification, Dinerstein has not 

alleged that Google has taken any steps to identify him. Nor, 

for that matter, does he allege that Google intends to do so. 

Without any allegations to that effect, “we cannot simply 

presume a material risk of concrete harm.” TransUnion, 

141 S. Ct. at 2212 (quoting Ramirez v. TransUnion LLC, 

951 F.3d 1008, 1040 (9th Cir. 2020) (opinion of McKeown, J.)).

The risk of future injury is thus nowhere near “certainly 

impending”; it is too speculative to satisfy the imminence 

requirement for a suit for injunctive relief in federal court.

Clapper v. Amnesty International USA, 568 U.S. 398 (2013), 

supports this holding. In Clapper attorneys and human-rights 

organizations raised constitutional challenges to § 1881a of 

the Foreign Intelligence Surveillance Act, arguing that

individuals with whom they regularly communicated were

probable targets of foreign electronic surveillance under the 
18 No. 20-3134 

Act. Id. at 406. Because of the possibility of surveillance, the 

plaintiffs claimed that their international communications 

were likely to be incidentally “acquired under § 1881a at 

some point in the future.” Id. at 407. 

The Court rejected this alleged future injury as a basis for 

standing, reasoning that it rested on multiple layers of 

“highly speculative fear.” Id. at 410. In particular, the “chain 

of contingencies”—specifically that (1) the government 

would choose to target their foreign contacts pursuant to its 

§ 1881a authority; (2) the government would succeed in both

securing the requisite authorization and intercepting the 

targeted communications; and (3) the plaintiffs would be 

parties to those communications—“d[id] not satisfy the 

requirement that threatened injury must be certainly impending.” Id. The plaintiffs had offered little more than 

speculation and assumptions—and importantly, “no specific 

facts”—that their communications would actually be acquired. Id. at 412. So too here. Dinerstein has expressed only 

a “highly speculative fear” that Google might, “at some 

point in the future,” identify him. Id. at 407, 410. 

Our decisions in Remijas v. Neiman Marcus Group, LLC, 

794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F. Chang’s China 

Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), are not to the contrary. As an initial matter, both predate TransUnion. While that

is not to say that they are no longer authoritative, it is to 

recognize that TransUnion marked a shift in the Court’s

standing jurisprudence. But even on their own terms, 

Remijas and Lewert do not help Dinerstein’s standing argument here. In both cases we held that the plaintiffs had 

sufficiently alleged a substantial risk of future harm stemming from breaches of their credit-card information. Remijas, 
No. 20-3134 19 

794 F.3d at 693–94; Lewert, 819 F.3d at 967. Motivating our 

decisions was the common-sense observation that hackers 

steal private credit-card information for a primary purpose: 

“to make fraudulent charges or assume ... consumers’ 

identities.” Remijas, 794 F.3d at 693; Lewert, 819 F.3d at 967. 

Therefore, the plaintiffs’ allegations about a substantial risk 

of future harm had “cross[ed] the line from conceivable to 

plausible.” Lewert, 819 F.3d at 968 (quoting Bell Atl. Corp. v. 

Twombly, 550 U.S. 544, 570 (2007)). 

The same cannot be said here. Absent from this case is a 

comparable indication—rooted in common sense or otherwise—that Google’s primary purpose in obtaining the 

medical records was to reidentify the University’s patients.

Indeed, the fact that Google explicitly agreed not “to identify 

any individual” is enough to rule out the contention that the 

threat of reidentification is certainly impending. Quite the 

opposite; that contention is wholly speculative and implausible. It cannot supply the basis for standing.4

B. Contract Claim

Next we assess the alleged injuries underlying 

Dinerstein’s claim for breach of an express contract, a claim

4 Even if Dinerstein’s asserted privacy injury—past or future—were 

sufficient to support standing (it is not), we see no reason to disturb the 

judge’s decision not to recognize a novel claim for breach of medical 

confidentiality. Illinois courts have not yet weighed in on the issue, and 

“it is not our role to break new ground in state law.” Roppo v. Travelers 

Com. Ins. Co., 869 F.3d 568, 596 (7th Cir. 2017) (quoting Lopardo v. Fleming 

Cos., 97 F.3d 921, 930 (7th Cir. 1996)). This is especially true with 

“[i]nnovative state law claims,” which “should be brought in state 

court.” Insolia v. Philip Morris Inc., 216 F.3d 596, 607 (7th Cir. 2000). But 

because Dinerstein lacks standing, we have no need to address this issue.
20 No. 20-3134 

he brings only against the University. Recall that Dinerstein 

roots the University’s purported contractual duty in the

Notice of Privacy Practices he received and the Admission 

and Outpatient Agreement and Authorization he signed 

each time he was admitted to the Medical Center. He argues 

that these documents contractually obligated the University 

to safeguard his medical information. In his view, transferring his medical records to Google was a flagrant breach of 

that obligation. 

To support standing to bring this claim, Dinerstein asserts three injuries. The first stems from his interest in privacy—i.e., the injury we’ve already addressed and deemed 

insufficient to support standing. The second, presented in 

two forms, is pecuniary: Dinerstein contends that he overpaid

the University for his medical treatment or, alternatively, 

that the University underpaid him for the interest in his 

medical records. The third is contractual: Dinerstein contends that the University’s breach of contract is itself an 

actionable concrete injury. 

1. Pecuniary Harms

We turn first to Dinerstein’s alleged pecuniary injuries, 

which the Supreme Court has described as “traditional 

tangible harms” that “readily qualify as concrete injuries

under Article III.” TransUnion, 141 S. Ct. at 2204. Even if 

concrete, however, Dinerstein’s allegations of injury must be 

plausible “to survive dismissal for lack of standing.” Diedrich 

v. Ocwen Loan Servicing, LLC, 839 F.3d 583, 588 (7th Cir. 2016) 

(citing Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)); see also Silha, 

807 F.3d at 174. While Dinerstein alleges both an overpayment and underpayment theory of financial harm, neither is 

plausible and neither supplies a basis for standing. 
No. 20-3134 21 

Dinerstein’s overpayment theory rests on allegations that

the medical care he (more precisely, his insurer) purchased

came bundled with a promise of medical confidentiality. 

Because the University failed to deliver on that promise, he 

contends that he was deprived of the full benefit of his

bargain. Not only that, he also would not have purchased

the University’s medical treatment had he known that it 

intended to share his private health information. 

This is not the first time we’ve confronted an argument

like this one. In Remijas, 794 F.3d at 694–95, and Lewert, 

819 F.3d at 968, the plaintiffs argued that they had overpaid 

Neiman Marcus and P.F. Chang’s, respectively, because the 

companies had failed to protect their credit-card information. While we did not outright reject the plaintiffs’ 

theories, we expressed serious skepticism. We described the 

plaintiffs’ injuries in Remijas, for example, as “problematic.” 

794 F.3d at 694. And in both cases we explained that courts 

have not entertained the overpayment theory of injury

outside the product-liability context, and we saw no need to 

extend it “beyond its current scope.” Lewert, 819 F.3d at 968; 

Remijas, 794 F.3d at 695. 

Dinerstein has not alleged a defect in his medical care, 

and we again are not inclined to recognize the overpayment 

theory outside the product-liability context. (In this case that 

would require extending it “from a particular product to the 

operation of [an] entire” medical facility. Remijas, 794 F.3d at 

695.) Perhaps anticipating this doctrinal problem, Dinerstein 

tries to distinguish Remijas and Lewert, arguing that the 

overpayment theories in those cases were implausible 

because the companies had not charged an extra fee for 

credit-card transactions. In other words, the plaintiffs had
22 No. 20-3134 

not paid for credit-card data security. But this case is no 

different. It is wholly implausible—and Dinerstein alleges 

nothing to the contrary—that the University charged a 

discrete “patient-confidentiality fee.” Indeed, the fact that it 

reserved the right to share patient medical information for 

approved research purposes suggests exactly the opposite. 

So too does the fact that Dinerstein signed a release stating 

that he would “not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom.”

Dinerstein’s most helpful case is from another circuit. In 

Carlsen v. GameStop, Inc., 833 F.3d 903, 909 (8th Cir. 2016), the 

Eighth Circuit held that the plaintiff had alleged an “actual” 

financial injury “in an amount equal to the difference between the value of [what] he paid for and the value of [what] 

he received, i.e., a [digital magazine] subscription with 

compromised privacy protection.” As our decisions in 

Remijas and Lewert make clear, we’re not inclined to extend 

the overpayment theory of injury to novel contexts. Regardless, Carlsen is also distinguishable for the reason we just 

mentioned: Dinerstein’s overpayment injury is particularly 

implausible given his express agreement that his medical 

information “may be used and shared for research.” And his 

argument that he would not have paid for the University’s 

medical services had he known otherwise is similarly implausible. 

We are even more skeptical of Dinerstein’s second pecuniary theory—that the unauthorized use of his medical 

information conferred a financial benefit on the University to 

which he is entitled. This financial benefit apparently came 

in the form of the perpetual software license reserved for the 
No. 20-3134 23 

University in the Data Use Agreement. To remedy the 

University’s unjust benefit, Dinerstein suggests that the 

court could order disgorgement or “at least a reasonable 

royalty.” 

Putting aside the fact that Dinerstein agreed that he was 

not entitled to compensation for the use of his medical 

information, his asserted injury cannot supply a basis for 

standing. As an initial matter, Illinois law does not grant a 

patient a property interest in his medical records; they 

instead belong to the medical provider. Young v. Murphy, 

90 F.3d 1225, 1236 (7th Cir. 1996) (“While Illinois law permits 

a patient to inspect and copy his records ... , there is no basis 

for concluding that this grants a property interest in those 

records to the patient.”); Holtkamp Trucking Co. v. Fletcher, 

932 N.E.2d 34, 43–44 (Ill. App. Ct. 2010). 

Additionally, this standing theory is squarely foreclosed 

by our caselaw. In Silha we held “that a plaintiff’s claim of 

injury in fact cannot be based solely on a defendant’s gain; it 

must be based on a plaintiff’s loss.” 807 F.3d at 174–75. 

There, students who had taken standardized college admissions tests alleged that the testing agencies had shared their 

personal information with educational institutions. The

students had consented to information sharing, yet the

agencies had not disclosed that they had profited from what 

was really a sale of the students’ information. Id. at 171. 

While the complaint highlighted the agencies’ profits, missing was any allegation that the students had “lost anything 

of value as a result of the alleged misconduct.” Id. at 175. 

Because their claimed injury was “based solely on a gain” to 

the agencies, we held that the students had not established 

an injury in fact. Id. 
24 No. 20-3134 

So too here. Dinerstein has not alleged that the University’s use of his medical information somehow deprived him 

of its economic value. And although Dinerstein attempts to 

distinguish Silha by arguing that unlike him, the students

had consented to disclosure, nothing about our resolution of 

the case turned on consent. Silha’s controlling principle—

that a plaintiff cannot base an injury in fact solely on the 

defendant’s gain—likewise controls here. In sum, neither of 

Dinerstein’s alleged pecuniary injuries establishes standing 

to sue under Article III.

2. Breach of Contract

What’s left, then, is Dinerstein’s argument that a breach 

of contract is itself a legally cognizable injury in fact. He 

contends that common-law courts traditionally entertained 

claims for breach of contract regardless of whether the 

plaintiff alleged any harm beyond the breach itself. From 

this he infers that an allegation of a breach of contract is 

enough, without more, to support Article III standing. In his

view, our caselaw supports his interpretation, and the 

Supreme Court’s recent standing cases, namely Spokeo and 

TransUnion, do not disturb it.

Even if Dinerstein’s historical account is correct, we read 

the Court’s recent standing cases differently. In TransUnion

the Court confirmed that “an injury in law is not an injury in 

fact.” 141 S. Ct. at 2205. That statement itself might be

enough to resolve Dinerstein’s “breach-alone” standing 

theory. Yet to explain why our view diverges from 

Dinerstein’s and that of one of our sister circuits, some 

additional unpacking is warranted. 
No. 20-3134 25 

As we’ve already discussed, establishing an injury in fact 

requires a plaintiff to show that he has suffered a concrete

injury—one that is both “real” and “de facto” and that “actually exist[s].” Spokeo, 578 U.S. at 340. Refining the concreteness requirement, the Court in TransUnion emphasized the 

distinction between (1) the cause of action giving a plaintiff 

the right to sue over a defendant’s legal infraction and 

(2) the injury, if any, that he suffered as a result. 141 S. Ct. at 

2205. To sue in federal court, a plaintiff must have both; a 

suitable cause of action cannot save a plaintiff’s case if he has 

suffered no harm. In other words, only a plaintiff who has 

been “concretely harmed” by the defendant’s legal infraction

“may sue that private defendant over [it] in federal court.” 

Id. 

Applying these concepts here, Dinerstein cannot rest on 

the University’s alleged breach of contract as a discrete de 

facto injury supporting his standing to sue in federal court. It

is at most an injury in law, which we know from TransUnion 

“is not an injury in fact.” Id. (emphasis added). As one 

scholar put it: 

The logic of Spokeo—that standing cannot rest 

on violations of legal rights that do not result 

in factual harms—extends to suits alleging 

breach of contract. After all, contracts simply 

establish legal rights. By Spokeo’s reasoning, a 

plaintiff should not have standing to sue for 

breach of contract if the breach does not result 

in some additional factual harm.

F. Andrew Hessick, Standing and Contracts, 89 GEO. WASH. L.

REV. 298, 313 (2021). Slightly rephrased, Dinerstein cannot 

simply allege a bare breach of contract, “divorced from any 
26 No. 20-3134 

concrete harm, and satisfy the injury-in-fact requirement of 

Article III.” Spokeo, 578 U.S. at 341. Without an allegation

that the purported breach resulted in some concrete harm, 

we lack the “freewheeling power” to hold the University

accountable for its alleged “legal infraction[].”Casillas v. 

Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th Cir. 2019). 

Yet Dinerstein retorts that Spokeo and TransUnion are irrelevant to the standing question here because neither

addressed common-law claims like breach of contract. He 

reads the cases to answer only whether (and if so, when) 

Congress may “elevate to the status of legally cognizable” an 

injury that was “previously inadequate in law.” TransUnion, 

141 S. Ct. at 2204–05 (quoting Spokeo, 578 U.S. at 341). To be 

sure, Spokeo and TransUnion did address and decide those 

questions. But we read the standing principles expounded in 

those cases to extend beyond the statutory context. The 

Court’s opinion in TransUnion, for example, set out to answer the broader question: “What makes a harm concrete for 

purposes of Article III?” Id. at 2204. In answering that question, the Court issued important and broadly applicable 

statements, including those just mentioned, about the 

boundaries of the federal judicial power. Fairly interpreted, 

those statements apply to all asserted injuries, not just 

statutory violations. 

To give a few more examples of TransUnion’s capacious

language, the Court observed that where a “plaintiff has not 

suffered any physical, monetary, or cognizable intangible 

harm traditionally recognized as providing a basis for a 

lawsuit in American courts,” his “lawsuit may not proceed.” 

Id. at 2206. And it defended “the concrete-harm requirement” as “essential to the Constitution’s separation of 
No. 20-3134 27 

powers.” Id. at 2207. Article III does not empower federal 

courts “to publicly opine on every legal question” or to 

“exercise general legal oversight ... of private entities.” Id. at 

2203. Yet by asking us to weigh in on the University’s alleged breach of contract in the absence of any actual harm, 

Dinerstein invites us to function “not as an Article III court, 

but as a moot court,” and do exactly that. Uzuegbunam v. 

Preczewski, 141 S. Ct. 792, 804 (2021) (Roberts, C.J., dissenting). We decline the invitation. Taking up such matters “is, 

by very definition, for a court to act ultra vires.” Steel Co. v. 

Citizens for a Better Env’t, 523 U.S. 83, 102 (1998). 

These general standing principles guided the Court as it 

then considered when Congress may give a real-world 

injury “actionable legal status.” TransUnion, 141 S. Ct. at 

2205. And contrary to Dinerstein’s view, the Court’s framing 

of this more specific question also supports our reading of its 

recent caselaw. Rather than ask whether federal courts may

depart from established standing doctrine when Congress 

has attempted to define an injury, in Spokeo and TransUnion

the Court explored when a congressionally defined injury 

might satisfy the existing doctrine. The cases speak, for 

example, about Congress’s lack of authority to “erase 

Article III’s standing requirements,” Spokeo, 578 U.S. at 339 

(quotation marks omitted), and about our obligation to 

“independently decide whether a plaintiff has suffered a 

concrete harm under Article III” notwithstanding Congress’s 

creation of new statutory duties, TransUnion, 141 S. Ct. at 

2205. Simply put, Spokeo and TransUnion established “fundamental standing principles,” id. at 2207, and those principles control this case.
28 No. 20-3134 

If Spokeo and TransUnion leave any doubt about whether 

a breach of contract is itself a concrete injury, Thole v. U.S. 

Bank N.A., 140 S. Ct. 1615 (2020), resolves it. Thole involved

claims for breach of fiduciary duty under ERISA. Two 

participants in a defined-benefit retirement plan sued the 

bank contending that it had mismanaged the plan. But 

crucially, they had sustained no monetary injury from the 

mismanagement. Id. at 1618. The Supreme Court thus affirmed the Eighth Circuit’s dismissal for lack of standing and 

in so doing rejected the participants’ attempted trust-law 

analogy. “[A] defined-benefit plan,” the Court reasoned, “is 

more in the nature of a contract. The plan participants’ 

benefits are fixed and will not change, regardless of how 

well or poorly the plan is managed.” Id. at 1620 (emphasis 

added). Because the Court held that the plan participants 

nonetheless lacked standing to pursue their claims, we 

understand Thole to imply that an alleged breach of contract, 

without any corresponding actual harm, does not give rise to 

an Article III case or controversy.5 

Nor are we persuaded by Dinerstein’s argument that the 

Court’s instructions in Spokeo and TransUnion—that we must 

compare the plaintiff’s asserted injury to harms traditionally 

recognized at common law—resolves the standing question 

here. As we understand the argument, he contends that 

5 In fact, the dissent raised this precise point. Thole v. U.S. Bank N.A., 

140 S. Ct. 1615, 1630 (2020) (Sotomayor, J., dissenting) (reasoning that the 

plan participants had standing because a “breach of contract always 

creates a right of action, even when no financial harm was caused” 

(quotation marks omitted)). That the majority was not persuaded by this 

view further supports our conclusion that a breach of contract does not 

by itself confer standing to sue.
No. 20-3134 29 

because common-law courts allowed a plaintiff to vindicate 

his contractual rights without a further showing of injury, he 

need not allege anything aside from the University’s bare 

breach of contract. 

True, common-law courts historically heard contract cases and awarded nominal damages even when the breach

either “caused no loss” or “the amount of the loss [wa]s not 

proved.” RESTATEMENT (SECOND) OF CONTRACTS § 346(2) (AM.

LAW INST. 1981); see also Springer v. Cleveland Clinic Emp. 

Health Plan Total Care, 900 F.3d 284, 292–93 (6th Cir. 2018)

(Thapar, J., concurring) (“[Common-law courts] entertained 

breach-of-contract claims even when no real loss [could] be 

prove[n]. Such violations at least deserved nominal damages ... .” (internal quotation marks omitted)). Yet “[t]he 

requirements of Art[icle] III are not satisfied merely because 

a party ... has couched [his] request for forms of relief 

historically associated with courts of law in terms that have a 

familiar ring to those trained in the legal process.” Valley 

Forge Christian Coll. v. Ams. United for Separation of Church & 

State, Inc., 454 U.S. 464, 471 (1982). 

More importantly, however, Spokeo and TransUnion put 

an end to federal courts hearing claims premised on nonexistent injuries—regardless of historical pedigree.6 And the 

Court’s recently announced “historical-analogue test” does 

not suggest otherwise. That test asks whether a modern 

injury bears a “close relationship” to a harm traditionally 

6 See William Baude, Standing in the Shadow of Congress, 2016 S. CT. REV.

197, 217 (“[I]t is hard to see how nominal damages are fully consistent 

with the logic of Spokeo. The very premise of nominal damages is that 

one cannot show any ‘actual injury’ apart from the violation of the legal 

right itself.” (citing Carey v. Piphus, 435 U.S. 247, 266 (1978))).
30 No. 20-3134 

recognized by common-law courts. TransUnion, 141 S. Ct. at 

2204. It does not, however, transform into a concrete factual 

injury what the common law has historically regarded as a

legal injury. Put differently, a historical record is no talisman. It is necessary, but not sufficient, to satisfy the 

Article III concreteness requirement. 

Still, because Dinerstein views Spokeo, TransUnion, and 

Thole as inapposite, he argues that our prior decision in J.P. 

Morgan Chase Bank, N.A. v. McDonald, 760 F.3d 646 (7th Cir. 

2014), binds us. Relevant here, at issue in J.P. Morgan was 

whether a bank had standing to block an ongoing arbitration 

proceeding that two investors had initiated after losing 

approximately a quarter of their initial investment. The 

contracts governing the investors’ accounts included a 

forum-selection clause that required disputes to be brought 

in either state or federal court. Id. at 649. Seeking to enforce 

the forum-selection provision, the bank sued the investors in 

federal court. After months of litigation, the judge dismissed 

the bank’s claims for lack of standing. Id. at 650. 

Reversing the dismissal, we held that the bank had 

standing to enforce the clause. To form a bilateral contract,

each party must “take on one or more legally binding obligations,” we explained. Id. “When one party fails to honor its 

commitments, the other party to the contract suffers a legal 

injury sufficient to create standing even where that party 

seems not to have incurred monetary loss or other concrete 

harm.” Id. at 650–51. Because the bank had alleged that the 

investors had “violated the terms of th[eir] bargain” by 

selecting an improper dispute-resolution forum, it had 

established standing to sue. Id. at 651. 
No. 20-3134 31 

Dinerstein understandably seizes on this favorable language, but he omits the discussion that follows it. We went 

on to explain in J.P. Morgan that the bank had “a very real 

financial interest in the arbitration” because it was statutorily and contractually obligated to “foot the bill” for the 

resulting costs. Id. Given this independent financial interest, 

the standing question was not merely “one of abstract 

principle”; it was yet another reason why the bank had 

standing to sue. Id. 

The concrete harms present in J.P. Morgan—being hauled 

into an improper forum and financing the resulting costs—

distinguish it from this case. Moreover, while those harms 

prevent us from needing to revisit J.P. Morgan, we note that 

some language in the opinion is in tension with the Supreme 

Court’s recent decisions in Spokeo and TransUnion. No longer 

is “a legal injury sufficient to create standing.” J.P. Morgan, 

760 F.3d at 651. “[U]nder Article III, an injury in law is not 

an injury in fact. Only those plaintiffs who have been concretely harmed” by a defendant may sue in federal court. 

TransUnion, 141 S. Ct. at 2205. Any portion of our opinion in 

J.P. Morgan that suggests otherwise cannot control here.

Finally, we recognize that some tension also exists between our analysis here and that of a few of our sister circuits. There is no direct conflict, however. For starters, many 

of the out-of-circuit decisions pointing in the other direction 

predate TransUnion, a watershed decision on the standing 

doctrine. See, e.g., Mitchell v. Blue Cross Blue Shield, 953 F.3d 

529, 536 (8th Cir. 2020); Springer, 900 F.3d at 287; Katz v. 

Pershing, LLC, 672 F.3d 64, 72 (1st Cir. 2012). Of the circuits to 

consider the issue post-TransUnion, we understand one to 

agree with our position, Perry v. Newsom, 18 F.4th 622, 632 
32 No. 20-3134 

(9th Cir. 2021) (“An analogy to a traditionally recognized 

cause of action does not relieve a complainant of its burden 

to demonstrate an injury.”); one to leave it unresolved, 

Glennborough Homeowners Ass’n v. U.S. Postal Serv., 21 F.4th 

410, 415–16 (6th Cir. 2021) (“We need not resolve these 

thorny questions today ... .”); and one to come out the other 

way, Denning v. Bond Pharmacy, Inc., 50 F.4th 445, 451 (5th 

Cir. 2022) (“[A] breach of contract is a sufficient injury for 

standing purposes.”). But the Fifth Circuit’s opinion in 

Denning did not engage with the logic of Spokeo and 

TransUnion and rested in part on its own precedent. We 

therefore do not understand the Fifth Circuit’s decision to 

conflict with our own, nor are we inclined to adopt its 

approach. As we read Thole, TransUnion, and Spokeo, a 

breach of contract alone—without any actual harm—is 

purely an injury in law, not an injury in fact. And it therefore

falls short of the Article III requirements for a suit in federal 

court. 

C. Remaining Claims

We need not spend much time addressing the tortiousinterference and consumer-fraud claims. Both rest on the 

same allegations of a privacy, pecuniary, or contractual 

injury that we’ve already examined and deemed insufficient 

to confer standing.

Put simply, Dinerstein seeks to invoke the power of the 

federal courts to challenge the lawfulness of an event that 

caused him no harm. But federal courts do not offer “judicial 

determination[s] that the plaintiffs’ interpretation of the law 

is correct”; we resolve cases and controversies. Uzuegbunam, 

141 S. Ct. at 804 (Roberts, C.J., dissenting). Because

Dinerstein has not alleged a plausible, concrete, and actual 
No. 20-3134 33 

or imminent injury to support his standing to sue, no such 

case or controversy exists here. We accordingly modify the 

judgment to reflect a jurisdictional dismissal for lack of 

standing. As modified, the judgment is

AFFIRMED.