If you’re going to sue over what a website learned about your prescriptions, it helps to say which prescriptions you looked up.
That, in a nutshell, is the lesson of Rose v. IQVIA Holdings Inc., No. 2:26-cv-01492 WBS SCR, 2026 WL 3439181 (E.D. Cal. Nov. 12, 2026). Judge William B. Shubb dismissed every claim against IQVIA, the health data company behind Drugs.com, because the plaintiffs never said what they actually searched for. The dismissal does come with leave to amend, so it may be more of a checkup than a cure, but the ruling is still a good one. The court went claim by claim and laid out what Plaintiffs need to fix, giving anyone defending a health-tracking case a useful roadmap.
The setup is a familiar one that readers of CIPAWorld are all too familiar with. Plaintiffs Abbie Rose and David Becerra alleged that IQVIA used tracking tools on Drugs.com to collect and share sensitive medical information, including search terms, pill identifier entries, and the drug pages they visited. As readers have seen in similar situations before, neither plaintiff had an account and instead relied simply on the fact that they used the site’s public search bar. Their complaint brought claims under CIPA Sections 631(a) and 638.51, the California Comprehensive Computer Data Access and Fraud Act (CDAFA), the UCL, invasion of privacy under the California Constitution, and the common law of intrusion upon seclusion.
One of those claims didn’t make it to the starting line. While the case was pending, California enacted SB 690, which bars Section 638.51 pen register suits by anyone other than the Attorney General and applies retroactively to pending claims in actions filed within two years before the law took effect. To their credit, the plaintiffs read the room and voluntarily dismissed that claim. If anyone needed proof that SB 690 has some teeth, here it is.
IQVIA also tried to bring its privacy policy into the fight, offering three archived versions from the Wayback Machine. The court wouldn’t look at them given that the complaint never mentioned the privacy policy, and it wasn’t going to incorporate a document whose only job was to support a consent defense. IQVIA’s request for judicial notice failed too since the plaintiffs disputed the accuracy of the archived pages and wanted foundation from someone who actually knows how the Wayback Machine works, not just a declaration from defense counsel (which is fair as it can be seen as self-serving hence why the court agreed). As practical tip for defense teams, if you want to rely on archived web pages at the pleading stage, come ready with stronger authentication, or save the consent fight for later.
Moving to the main crux of the complaint, plaintiff alleged that they “entered specific search terms” about their health and searched for “prescribed medications.” What they didn’t say was which terms, which medications, or which pages. Instead, the complaint walked through screenshots of a hypothetical search for the anti-anxiety drug Lorazepam. The court held that a hypothetical search can’t stand in for a real one, especially one “tied to neither named plaintiff.” Following a string of recent California federal decisions, including Cousin v. Sharp Healthcare, 681 F. Supp. 3d 1117 (S.D. Cal. 2023), the court made clear that health privacy plaintiffs have to describe the actual content they shared.
That gap sank everything. It doomed the CIPA Section 631(a) claim, because wiretapping requires interception of the “contents” of a communication, and the court couldn’t tell whether the plaintiffs’ searches revealed anything meaningful without knowing what they were. It doomed the privacy claims, too. The plaintiffs argued that “[f]ew things are more private than which prescription drugs a person takes and why.” Fair enough, said the court, but you still have to tell us which drugs. Without that, there was no way to decide whether the plaintiffs had a reasonable expectation of privacy in searches run on a public website without an account, or whether the alleged intrusion was “highly offensive.”
The court also flagged a separate problem with the CDAFA and UCL claims, one that better search details won’t fix on their own: money. CDAFA requires “damage or loss,” and the plaintiffs offered two theories. The first was that IQVIA should give up the profits it made from their data but the court wasn’t persuaded given that a company benefiting from your data doesn’t mean you lost anything, especially when you never claimed you’d sell it yourself or identified a real market for it. The second theory was harm to their phone from a “persistent cookie” that stayed on their devices for 400 days. That one crumbled too since a cookie that sticks around for over a year is still just a cookie unless you can show it actually slowed your device down or ate up meaningful storage. And data you generate while browsing someone else’s website isn’t damage to your own computer.
The UCL claim hit the same wall since to sue under the UCL, you need to have “lost money or property.” The plaintiffs said their data “has monetary value” and pointed to IQVIA’s “multibillion-dollar data business.” The court wasn’t persuaded here either as IQVIA’s ability to profit from data doesn’t mean the plaintiffs lost a dime.
So where does this leave things? The plaintiffs have 21 days to amend, and they’ve already told the court they can identify the medications and conditions they researched. Expect a more detailed complaint soon but even so, this ruling raises the bar. Plaintiffs will need to tie real searches to real people, and they’ll still have to find a way around the court’s analysis on economic loss, device harm, and what counts as “contents.”
For businesses, the takeaways are encouraging as California federal courts are increasingly unwilling to treat “sensitive health information” as a magic phrase. They want specifics and arguments that data has value, or that a cookie overstayed its welcome, are not the same as actual losses. That said, companies running health-related websites shouldn’t treat this as an all-clear. A plaintiff who can say “I searched for this medication, and here’s where it went” is in a much stronger position, and the defense may have to win on other grounds.
For now, IQVIA’s diagnosis looks good but expect the plaintiffs to come back with their symptoms written down. We will let you know as soon as we hear more here.
Talk to you soon CIPAWorld and as always, be safe.