Wisconsin Federal Court Remands Privacy Class Action Lawsuit Based On Lack Of No Injury From Google Analytics Data Tracking

Duane Morris Takeaways: On May 1, 2026, in Brahm, et al. v. Hospital Sisters Health System, et al., No. 23-CV-444, 2026 U.S. Dist. LEXIS 96866 (W.D. Wis. May 1, 2026), Judge William M. Conley of the U.S. District Court for the Western District of Wisconsin remanded a putative class action to state court after finding that Plaintiffs lacked Article III standing to pursue claims that healthcare defendants’ use of Google Analytics on patient portals resulted in unauthorized disclosure of protected health information (“PHI”) to Google. Id. at *2-3. The Court held that Plaintiffs’ lack of evidence of actual harm, together with their theory of future harm, was insufficient to confer standing. Id. at *3. The decision reinforces the growing trend among federal courts requiring proof that disclosed data was actually used to identify individuals, not merely that such identification was theoretically possible.

Case Background

The Defendant healthcare companies operate public websites and authenticated MyChart patient portals as “MyHSHS” and “MyPrevea,” which allow patients to log in with a username and password to access their medical records, schedule appointments, and pay bills. Id. at *4. Between at least 2016 and 2023, Defendants deployed Google Analytics tracking technology on their public websites, within patient portals on their websites, and on MyPrevea’s login page and app. Id. at *6. Whenever a user visits Defendants’ websites or portals, Google Analytics gathers information about the user’s interactions and shares certain transmissions with Google. Id. at *7.

Plaintiffs asserted that Google Analytics routinely disclosed patients’ identities and protected health care information to third-party websites like Google without the patients’ knowledge or consent. Id. at *1. Plaintiffs alleged that they began seeing Facebook advertisements related to their specific medical conditions after visiting Defendants’ portals or websites. Id. at *5. However, Plaintiffs also searched about their medical conditions or treatment online and have had their personal information involuntarily exposed to third parties by entities unrelated to the litigation. Id. None of the Plaintiffs had ever tried or intended to sell their PHI, nor did they claim to have suffered any out-of-pocket expenses as a result of Defendants’ allegedly wrongful disclosures. Id. at *10. Nonetheless, they sought actual damages based on the alleged “diminished sales value of their PHI,” as well as statutory and nominal damages. Id.

Plaintiffs alleged claims for violation of federal and state wiretapping statutes, as well as Wisconsin common and statutory laws for breach of duty of confidentiality, breach of implied contract to protect privacy, public disclosure of private facts, and unjust enrichment. Id. at *3. Plaintiffs moved to certify four subclasses, while Defendants moved for summary judgment as to all claims. Id.  

The Court’s Opinion

The Court addressed the “threshold question” of Article III standing on its own initiative, noting that Defendants’ summary judgment motion called Plaintiffs’ standing into question and standing “is jurisdictional and cannot be waived” and must be “secured at each stage of the litigation.” Id. at *12. While the Court had previously allowed the original named Plaintiff to proceed past the motion to dismiss stage because it found her allegations of injury sufficient at the pleading stage, the Court explained that with a full record at the summary judgment stage, Plaintiffs failed to present sufficient evidence of a concrete injury-in-fact on multiple grounds. Id. 

First, as to Plaintiffs’ tort claims for invasion of privacy and breach of fiduciary duty, the Court found no evidence from which a reasonable jury could conclude that their patient identity or PHI was actually disclosed to Google, disclosed by Google, or used by Google inappropriately. Id. at *17. Plaintiffs’ evidence did not establish that any of the disclosed anonymous information was actually used by Google or another third party to identify them. Id.  

Despite Plaintiffs’ expert opining that Google’s systems had the “technical capability and documented practice” of linking information to specific individuals, the Court determined that the capabilities of Google’s systems were insufficient to demonstrate what it actually did. Id. at *19. Further, Plaintiffs failed to proffer evidence showing that Defendants caused Plaintiffs’ PHI to be shared, as opposed to other third parties or Plaintiffs themselves through their own voluntary internet disclosures. Id. at *20. 

Relying on the Seventh Circuit’s decision in Dinerstein v. Google, LLC, 73 F.4th 502 (7th Cir. 2023), the Court emphasized that Plaintiffs “must still present sufficient evidence that Google Analytics actually worked as allegedly intended, which they have failed to do in this case,” and therefore, Plaintiffs failed to show a concrete injury to support standing under Article III. 2026 U.S. Dist. LEXIS 96866, at *23. The risk of Google or other third parties identifying Plaintiffs at a later date by leveraging the data obtained from Defendants was “not sufficiently imminent to obtain relief in federal court.” Id.

Second, as to the breach of implied contract claim, the Court found that Plaintiffs lacked standing because their asserted pecuniary harm based on the diminished sales value of their PHI or nominal damages, without any actual harm, was an injury in law and not an injury-in-fact as required by Article III. Id. at *24-25.

Third, Plaintiffs alternatively asserted unjust enrichment, arguing that Defendants retained without compensation Plaintiffs’ PHI and then disclosed this information to third parties for Defendants’ own gain. Id. at *26. However, the Court found that without any evidence of improper disclosure, Plaintiffs’ alleged pecuniary injury was “simply speculative and insufficient to confer standing.” Id. at *27.

Fourth, the wiretapping claims likewise failed. Although Plaintiffs sought statutory damages, the Court held that a statutory violation on its own does not confer standing without an underlying concrete, particularized injury. Id. at *28 (citing TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021)).

Having found that Plaintiffs lacked standing as to all claims, the Court remanded the case to Wisconsin state court for further proceedings. Id.

Implications For Companies

Brahm reinforces that plaintiffs challenging tracking technology must present actual evidence identifying what allegedly private information was disclosed and cannot rely on abstract and speculative alleged injuries to confer Article III standing. Asserting an Article III standing defense remains an effective defense that companies should consider throughout litigation, balanced against the prospect of the case continuing in state court.