Hinton v. Planned Parenthood: "where there’s smoke, there must be fire" is not class proof

Plaintiffs promised to prove that Meta and Google tied searches for abortion, STD testing and birth control to named people. The court found speculation about what trackers are for, not evidence of what they did.

US District Court, N.D. California · CIPA § 631 · Class certification denied 30 September 2026

Class certification denied; petition for permission to appeal docketed (9th Cir. No. 26-6789); status conference 10 December 2026

Regulator or court: US District Court, Northern District of California
Jurisdiction: California, US
Framework: CIPA § 631 (aiding and abetting)
Order: 30 September 2026

Sensitive context in event data

The problem

Shirley Hinton and Heather Shipley allege that Planned Parenthood Federation of America (PPFA) embedded tracking code from third parties such as Google and Meta on plannedparenthood.org, letting them intercept visitors' "confidential and private healthcare information" and identities. The amended complaint pleads a single claim under CIPA § 631 on an aiding-and-abetting theory (Order, Dkt. 155).

Case record

Court: US District Court, N.D. California (Judge James Donato)
Case number: 3:23-cv-04529-JD
Parties: Shirley Hinton and Heather Shipley v. Planned Parenthood Federation of America, Inc.
Law: CIPA § 631, aiding and abetting only (after partial dismissal, Dkt. 34)
Stage: Class certification denied 30 September 2026 (Dkt. 155); petition for permission to appeal docketed, 9th Cir. No. 26-6789 (Dkt. 156, 14 October 2026)
Proposed class: People in California who, between 1 September 2022 and 6 July 2023, searched plannedparenthood.org for abortion, STD testing, birth control, pregnancy testing, hormone therapy or emergency contraception, or visited the listed service pages
Amount: None; the complaint seeks statutory damages of at least USD 5,000 per violation
Source review: 21 October 2026

What the court found

Hinton v. Planned Parenthood rulings
Question	Result
Damages class, Rule 23(b)(3): do common questions predominate?	No. Plaintiffs said they would prove with common evidence that Meta and Google "actually linked" class members' searches and page views to their identities. The court called their evidence "an inference based on generalities and speculation": "where there’s smoke, there must be fire" is not a basis to certify
Off-Meta Activity reports	Plaintiffs acknowledged these did not show Meta linked their PPFA activity; downplaying them did not help establish classwide proof
Named plaintiffs' testimony	Individual testimony about using the site is "exactly the opposite of classwide, common proof"
Injunctive class, Rule 23(b)(2)	No. Argued in under a page, no generally applicable practice shown, and the primary relief sought is money
Rule 23(a)	Not reached

The court relied on Wal-Mart v. Dukes: generalised evidence about a defendant’s business goals is not "significant proof" of what happened to each class member (Order, Dkt. 155).

Technical issue

Tools (alleged): tracking technologies such as Google Analytics and Meta Pixel.
Where: the site search bar and service pages for abortion, STD testing, birth control, pregnancy testing, hormone therapy and emergency contraception.
Contested step: not whether the tags fired, but whether Meta and Google matched the data to specific account holders. Plaintiffs could not show that on a classwide basis.

Inth’s technical interpretation: the case was lost on proof of linkage, not on the tags being harmless. A page path such as /abortion-services or a search term sent with a platform cookie still tells the platform about a health topic. Keep advertising and analytics tags off sensitive service pages and out of site search, rather than relying on how a class might later be certified.

// Search term and service page sent to ad and analytics vendors
fbq('track', 'Search', { search_string: query });
gtag('event', 'page_view', { page_path: location.pathname });

// No third-party tags on sensitive service paths or site search
const sensitive = /^\/(get-care|abortion|search)/.test(location.pathname);
if (!sensitive && consent.has('marketing')) {
  fbq('track', 'PageView');
}

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

1 September 2022 to 6 July 2023Proposed class period
1 September 2023Complaint filed
Not statedPartial dismissal of the prior complaint (Dkt. 34); first amended complaint (Dkt. 48)
30 September 2026Class certification denied (Dkt. 155); pending summary judgment and Daubert motions administratively terminated
14 October 2026Ninth Circuit case number 26-6789 docketed for a petition for permission to appeal (Dkt. 156)
10 December 2026Status conference

Outcome

Certification of both classes was denied. The parties must re-engage in ADR on an individual, non-class basis and discuss whether the summary judgment and Daubert motions (Dkt. 115, 116, 132, 133) need to be supplemented or re-briefed. Those motions were administratively terminated pending the 10 December 2026 status conference. No liability has been found.

What it cost

Hinton v. Planned Parenthood costs
Item	Amount	Source
Damages or settlement	None	Order, Dkt. 155
Statutory damages sought	At least USD 5,000 per violation (complaint, as quoted in the order)	Order, Dkt. 155
Defence costs	Not stated in the cited record

Why it matters

Linkage proof is the hard part. Plaintiffs framed the case around platforms tying page views to identities, then had to prove that for every class member. General statements about what pixels are for were not enough.
Same judge, different outcome. Judge Donato presided over the Flo trial that found Meta liable under CIPA; compare Frasco v. Meta. Class treatment turned on the evidence offered, not on the sensitivity of the data.
Not a safe harbour. The ruling is about class proof. Individual claims continue and an appeal has been sought. Compare other tracking cases where certification was fought: In re Meta Pixel Healthcare (ruling pending) and Calhoun v. Google (certification denied).

How Inth catches this

Consent banner: holds analytics and advertising tags until their category is granted where the policy is opt-in. Consent does not make sending reproductive-health page paths or searches to an ad platform appropriate.
Website audit: records which vendors receive requests from sensitive service pages and site search, including the URL, search parameters and event names sent.
Evidence: consent records with choice, country and policy, and per-page runtime observations that show what was sent and when.

Limit: Inth sees what leaves the browser. Whether a platform matched the data to an account happens on the platform’s side and is not visible.

Checks for your own systems

In the repository

List tags that fire on service, booking and search pages, and exclude sensitive paths.
Check search and Search-event parameters sent to vendors for typed queries.

In the browser and network

Search the site for a sensitive term and inspect third-party requests for the term or the results URL.
Visit each service page while logged in to Google and Meta in the same browser and record what is sent.

With the people responsible

Record when tags were removed from sensitive pages and keep the evidence.
Agree who approves new tags on health-related pages.

Sources and limits

Order re class certification, Dkt. 155, 30 September 2026
Court case page with recent filings, reviewed 21 October 2026

The complaint, the class certification briefs and the earlier dismissal order were not opened; their content comes from the 30 September 2026 order. The Ninth Circuit petition was not opened, so who filed it and its arguments are not recorded here. The specific vendors beyond Google and Meta are not identified in the order.

Source review: 21 October 2026. This page describes the cited records and procedural stage. It does not audit Planned Parenthood’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.