[Enforcement library](/enforcement)

# Hinton v. Planned Parenthood: "where there's smoke, there must be fire" is not class proof

Judge Donato denied certification of damages and injunctive classes in a CIPA § 631 aiding-and-abetting case over Google and Meta tracking on Planned Parenthood's reproductive-health pages. Plaintiffs offered no common proof that the platforms actually linked page views and searches to identities.

## Key facts

- **Regulator or court:** US District Court, Northern District of California
- **Jurisdiction:** California, US
- **Framework:** CIPA § 631 (aiding and abetting)
- **Record date:** 2026-09-30
- **Procedural status:** Class certification denied; petition for permission to appeal docketed (9th Cir. No. 26-6789); status conference 10 December 2026

Plaintiffs promised to prove that Meta and Google tied searches for abortion, STD testing and birth control to named people. The court found speculation about what trackers are for, not evidence of what they did.

US District Court, N.D. California · CIPA § 631 · Class certification denied 30 September 2026

- The problem
- Case record
- What the court found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Shirley Hinton and Heather Shipley allege that Planned Parenthood Federation of America (PPFA) embedded tracking code from third parties such as Google and Meta on plannedparenthood.org, letting them intercept visitors' "confidential and private healthcare information" and identities. The amended complaint pleads a single claim under CIPA § 631 on an aiding-and-abetting theory ([Order, Dkt. 155](https://storage.courtlistener.com/recap/gov.uscourts.cand.417836/gov.uscourts.cand.417836.155.0.pdf)).

## Case record

| Field | Record |
| --- | --- |
| Court | US District Court, N.D. California (Judge James Donato) |
| Case number | 3:23-cv-04529-JD |
| Parties | Shirley Hinton and Heather Shipley v. Planned Parenthood Federation of America, Inc. |
| Law | CIPA § 631, aiding and abetting only (after partial dismissal, Dkt. 34) |
| Stage | Class certification denied 30 September 2026 (Dkt. 155); petition for permission to appeal docketed, 9th Cir. No. 26-6789 (Dkt. 156, 14 October 2026) |
| Proposed class | People in California who, between 1 September 2022 and 6 July 2023, searched plannedparenthood.org for abortion, STD testing, birth control, pregnancy testing, hormone therapy or emergency contraception, or visited the listed service pages |
| Amount | None; the complaint seeks statutory damages of at least USD 5,000 per violation |
| Source review | 21 October 2026 |

## What the court found

| Question | Result |
| --- | --- |
| Damages class, Rule 23(b)(3): do common questions predominate? | No. Plaintiffs said they would prove with common evidence that Meta and Google "actually linked" class members' searches and page views to their identities. The court called their evidence "an inference based on generalities and speculation": "where there's smoke, there must be fire" is not a basis to certify |
| Off-Meta Activity reports | Plaintiffs acknowledged these did not show Meta linked their PPFA activity; downplaying them did not help establish classwide proof |
| Named plaintiffs' testimony | Individual testimony about using the site is "exactly the opposite of classwide, common proof" |
| Injunctive class, Rule 23(b)(2) | No. Argued in under a page, no generally applicable practice shown, and the primary relief sought is money |
| Rule 23(a) | Not reached |

The court relied on Wal-Mart v. Dukes: generalised evidence about a defendant's business goals is not "significant proof" of what happened to each class member ([Order, Dkt. 155](https://storage.courtlistener.com/recap/gov.uscourts.cand.417836/gov.uscourts.cand.417836.155.0.pdf)).

## Technical issue

- **Tools (alleged):** tracking technologies such as Google Analytics and Meta Pixel.
- **Where:** the site search bar and service pages for abortion, STD testing, birth control, pregnancy testing, hormone therapy and emergency contraception.
- **Contested step:** not whether the tags fired, but whether Meta and Google matched the data to specific account holders. Plaintiffs could not show that on a classwide basis.

**Inth's technical interpretation:** the case was lost on proof of linkage, not on the tags being harmless. A page path such as /abortion-services or a search term sent with a platform cookie still tells the platform about a health topic. Keep advertising and analytics tags off sensitive service pages and out of site search, rather than relying on how a class might later be certified.

```javascript
// Search term and service page sent to ad and analytics vendors
fbq('track', 'Search', { search_string: query });
gtag('event', 'page_view', { page_path: location.pathname });

// No third-party tags on sensitive service paths or site search
const sensitive = /^\/(get-care|abortion|search)/.test(location.pathname);
if (!sensitive && consent.has('marketing')) {
  fbq('track', 'PageView');
}
```

Illustrative pattern, not the defendant's code. Generic consent API, not a specific c15t call.

## Timeline

| Date | Event |
| --- | --- |
| 1 September 2022 to 6 July 2023 | Proposed class period |
| 1 September 2023 | Complaint filed |
| Not stated | Partial dismissal of the prior complaint (Dkt. 34); first amended complaint (Dkt. 48) |
| 30 September 2026 | Class certification denied (Dkt. 155); pending summary judgment and Daubert motions administratively terminated |
| 14 October 2026 | Ninth Circuit case number 26-6789 docketed for a petition for permission to appeal (Dkt. 156) |
| 10 December 2026 | Status conference |

## Outcome

Certification of both classes was denied. The parties must re-engage in ADR on an individual, non-class basis and discuss whether the summary judgment and Daubert motions (Dkt. 115, 116, 132, 133) need to be supplemented or re-briefed. Those motions were administratively terminated pending the 10 December 2026 status conference. No liability has been found.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Damages or settlement | None | [Order, Dkt. 155](https://storage.courtlistener.com/recap/gov.uscourts.cand.417836/gov.uscourts.cand.417836.155.0.pdf) |
| Statutory damages sought | At least USD 5,000 per violation (complaint, as quoted in the order) | [Order, Dkt. 155](https://storage.courtlistener.com/recap/gov.uscourts.cand.417836/gov.uscourts.cand.417836.155.0.pdf) |
| Defence costs | Not stated in the cited record |  |

## Why it matters

- **Linkage proof is the hard part.** Plaintiffs framed the case around platforms tying page views to identities, then had to prove that for every class member. General statements about what pixels are for were not enough.
- **Same judge, different outcome.** Judge Donato presided over the Flo trial that found Meta liable under CIPA; compare [Frasco v. Meta](/enforcement/frasco-v-meta). Class treatment turned on the evidence offered, not on the sensitivity of the data.
- **Not a safe harbour.** The ruling is about class proof. Individual claims continue and an appeal has been sought. Compare other tracking cases where certification was fought: [In re Meta Pixel Healthcare](/enforcement/in-re-meta-pixel-healthcare) (ruling pending) and [Calhoun v. Google](/enforcement/calhoun-v-google) (certification denied).

Related pages: [CIPA § 631](/enforcement/laws/cipa-631-wiretapping), [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data).

## How Inth catches this

- **Consent banner:** holds analytics and advertising tags until their category is granted where the policy is opt-in. Consent does not make sending reproductive-health page paths or searches to an ad platform appropriate.
- **Website audit:** records which vendors receive requests from sensitive service pages and site search, including the URL, search parameters and event names sent.
- **Evidence:** consent records with choice, country and policy, and per-page runtime observations that show what was sent and when.

Limit: Inth sees what leaves the browser. Whether a platform matched the data to an account happens on the platform's side and is not visible.

## Checks for your own systems

### In the repository

- List tags that fire on service, booking and search pages, and exclude sensitive paths.
- Check search and Search-event parameters sent to vendors for typed queries.

### In the browser and network

- Search the site for a sensitive term and inspect third-party requests for the term or the results URL.
- Visit each service page while logged in to Google and Meta in the same browser and record what is sent.

### With the people responsible

- Record when tags were removed from sensitive pages and keep the evidence.
- Agree who approves new tags on health-related pages.

## Sources and limits

- [Order re class certification, Dkt. 155](https://storage.courtlistener.com/recap/gov.uscourts.cand.417836/gov.uscourts.cand.417836.155.0.pdf), 30 September 2026
- [Court case page with recent filings](https://cand.uscourts.gov/cases-e-filing/cases/323-cv-04529-jd/hinton-et-al-v-planned-parenthood-federation-america-inc), reviewed 21 October 2026

The complaint, the class certification briefs and the earlier dismissal order were not opened; their content comes from the 30 September 2026 order. The Ninth Circuit petition was not opened, so who filed it and its arguments are not recorded here. The specific vendors beyond Google and Meta are not identified in the order.

Source review: 21 October 2026. This page describes the cited records and procedural stage. It does not audit Planned Parenthood's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Frasco v. Meta](/enforcement/frasco-v-meta), [In re Meta Pixel Healthcare](/enforcement/in-re-meta-pixel-healthcare), [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data).