In re Blue Shield of California Privacy Litigation (consolidating Doe I v. California Physicians’ Service et al.)

Largest tracker incident reported to HHS (4.7M members); Google Analytics misconfiguration fed Google Ads for nearly three years.

Class action
Active — motion to dismiss decided, proceeding

Timeline

Filed
May 2025
Key ruling
Jul 10, 2026

Key ruling

Standing found, but federal Wiretap Act claim dismissed without prejudice because the plan did not itself intercept; leave to amend.

Status note

ACTIVE. Blue Shield’s Apr. 9, 2025 notice: Google Analytics misconfiguration sent member PHI to Google Ads Apr. 2021–Jan. 2024; reported to HHS OCR. July 10, 2026: standing found, but federal Wiretap Act claim dismissed without prejudice (plan did not itself intercept); leave to amend. | Largest breach-portal-reported tracker incident (4.7M).

Exposure

Pages covered

Patient portal (authenticated)

Tracking technologies named

Google Ads / DoubleClickGoogle Analytics (version not specified)Meta Pixel

Plaintiff firms

Kiesel LawLieff Cabraser Heimann & BernsteinScott+ScottSimmons Hanly Conroy

Data licensed under CC BY 4.0. Cite as SounderData.com Tracker Litigation Database, September 25, 2026.