Hi CIPAWorld! I’m Fynn and am new here at Troutman Amin. I have some good news to share.
The case is Gisela Gonzalez Merical v. The Joint Corp. GISELA GONZALEZ MERICAL, individually and on behalf of all others similarly situated, Plaintiff, v. THE JOINT CORP., Defendant. (E.D. Cal., Aug. 3, 2026, No. 1:26-CV-00974-KES-SAB) 2026 WL 2225531.
This suit arose out of Gisela Gonzalez Merical’s use of the defendant’s website in order to book a chiropractic appointment. To do so, she provided the defendant with her full legal name, phone number, email address, clinic of choice, and other information related to her appointment booking. Merical provided this information under the assumption that it would be held confidentially by the defendant. Merical purports that the defendant did not obtain her consent prior to intercepting and disclosing her information to outside third parties. Merical ultimately alleged that her private information was intercepted by a third party, resulting in the unlawful disclosure of personally identifiable information and protected health information.
As a result, Merical sued Defendant for violations of: the Federal Wiretap Act, the California Invasion of Privacy Act, and invasion of privacy under the California constitution.
Thereafter, Defendant filed three motions to dismiss: (1) a motion to dismiss for lack of standing, (2) a motion to dismiss for failure to state a claim, and (3) a motion to dismiss as to punitive damages. The Court granted all three motions!
Injury-in-fact
First and foremost, for a plaintiff to have standing, that is to be allowed into the federal courthouse doors, they must establish (1) they suffered an injury-in-fact, (2) that the injury was caused by the defendant’s harm, and (3) that the injury can be judicially redressed.
The court in this case focused on the injury-in-fact element of standing, distinguishing the injuries alleged in the cases Merical cited and the injuries she herself had alleged in this case. The court repeatedly found that Merical failed to identify what protected health information was disclosed. Although she did divulge her full legal name, phone number, email address, and clinic of choice, these disclosures did not rise to the level of private information featured in the cases cited. Those cases disclosed highly personal health information such as menstruation, ovulation and pregnancy. The complaints also identified specific symptoms, the types of procedure sought, and other information relating to medical conditions.
In this way, Merical’s pleadings failed to establish whether she actually disclosed personal health information or that her personal health information was transmitted to third parties. Accordingly, she did not demonstrate a violation of a discernable privacy interest and therefore did not allege an injury-in-fact.
Now turning to the Defendant’s motion to dismiss for failure to state a claim.
Electronic Communications Privacy Act (ECPA)
The Electronic Communication Privacy Act (ECPA) makes it unlawful to intentionally intercept electronic communications. Stating a claim requires that a defendant (1) intentionally (2) intercepted (3) the contents of (4) plaintiffs’ electronic communications (5) using a device. Notably, the ECPA has an exemption from liability when a person is a party to the communication, unless the communication is intercepted for the purpose of committing a criminal or tortious act.
Since the defendant was a party to Merical’s communications while trying to schedule a chiropractic appointment, the ECPA would not offer protection to her due to the rule exempting a party to the communication from liability. Merical, therefore, argued that the crime-tort exception applied to her ECPA claim. However, the court found that she did not plead any criminal or tortious activity that would have prevented the party-exception rule. She merely made conclusory allegations that the defendant had intercepted her communications with the intention of committing criminal or tortious acts. As a result, the party exception rule applied and Merical failed to state a claim under the ECPA.
California Invasion of Privacy Act (CIPA)
Finally, we get to the California Invasion of Privacy Act (CIPA), a state law designed to protect telephone communications. To state a claim under section 631(a), a plaintiff needs to show that (1) by means of a machine, instrument, or contrivance, a defendant (2) willfully and without the consent of all parties (3) read, attempted to read, or to learn the contents or meaning of any communication, (4) while the communication was in transit (5) to or from any place in California.
The court allowed both parties to brief on the issue of whether CIPA applies to the internet. There is no binding authority on the issue and district courts have reached opposing conclusions. The court here found that section 631(a)’s text, as well as its legislative history, and successive revisions suggest that it does not apply to the internet. It states that such a modification to the law is best left to the California appellate courts or the legislature to enact.
The court reaches this conclusion despite the Ninth Circuit’s memorandum opinion expressing: “Though written in terms of wiretapping, section 631(a) applies to interment communications”. The court here explained that the Ninth Circuit’s statement was an overstatement and not precedential. Lastly, the court decided that CIPA does not apply to the internet to avoid reading it too broadly—after all, it is a criminal statute. Although most CIPA cases are civil actions, the court acknowledged that those outcomes may have implications for criminal cases. When ambiguities arise in criminal statutes, it is best to resolve them according to the rule of lenity.
Unlike section 631(a), the court found that section 632 does apply to the internet because section 632.01 explicitly contemplates internet and social media use. Section 632 creates a cause of action against any person who intentionally records a confidential without the consent of all parties involved in the communication. Notably, a conversation is confidential under this provision if a party to the conversation has an objectively reasonable expectation that the conversation is not being overheard by others. The court here held that Merical’s allegations did not support an objectively reasonable expectation that disclosing her name, phone number, and email address when looking for chiropractic services would be a confidential communication. Since this type of information is relatively generic, the court struggled to see how Merical could have an expectation of privacy over it.
Punitive Damages
The defendant’s motion to dismiss as to punitive damages was granted with prejudice. The court explained that the principle of strict construction is generally applied to statutes that impose civil punitive penalties. Since Merical had not demonstrated undue delay, bad faith, or a failure to cure deficiencies, she was not entitled to punitive damages.
In review, Merical lacked standing because she did not allege disclosures of personal information or transmission of such personal health information that could have resulted in an injury-in-fact.
Furthermore, to effectively avoid the party exception and effectively invoke the ECPA’s crime-tort exception, a plaintiff must plead criminal or tortious activity on behalf of the defendant that amounts to more than mere conclusory allegations. Here, Merical did not do so.
The Court concluded CIPA’s section 631(a) does not apply to the internet, and such an amendment is best left to the appellate courts or the legislature. This is a pretty big finding.
Lastly, Section 632 does apply to the internet and confidential communications are protected so long as it is objectively reasonable to believe that the communication is confidential. Here, the court found it a stretch to believe that the generic information Merical input to the website could constitute an expectation of privacy.