Case research · Sources checked October 12, 2026
Kaiser Permanente website/app tracking-technology privacy class action
Plaintiffs allege that Kaiser installed code from multiple third parties (including Google, Microsoft Bing, X/Twitter, Adobe, Quantum Metric and Dynatrace) throughout the Kaiser Permanente website, patient portal and mobile applications, and that this code let those third parties intercept members' patient status, identifying information and communications with medical providers, including protected health information, without members' knowledge or consent. Kaiser denied the claims.
Every line on this page is checked against the court docket and the regulators involved. We do not decide whether you are part of this case or match you with a lawyer. What we do is help you get the medical records that matter, from any provider.
- Status
- Settlement
- Court
- U.S. District Court for the Northern District of California, San Francisco Division
- Docket
- No. 3:23-cv-02865-EMC (PHK)
- Judge
- Hon. Edward M. Chen (U.S. District Judge); Hon. Peter H. Kang (U.S. Magistrate Judge, discovery)
- Started
- 2023-06 (single consolidated class action filed in N.D. Cal.; not an MDL — the Consolidated Class Action Complaint was litigated in this one case)
- Defendants
- Kaiser Foundation Health Plan, Inc., Kaiser Foundation Hospitals, The Permanente Medical Group
Where it stands
As of October 12, 2026
Settled. Judge Chen granted preliminary approval of a class settlement (orders of October 24, 2025 and following), notice went to the people on Kaiser's May 2024 breach-notice list (13,134,307 settlement class members), the claim/opt-out/objection deadline was March 12, 2026, and on July 14, 2026 the court granted final approval. The settlement website states the Final Order has issued and 'Claims are being processed.' Non-monetary relief included removal or modification of the third-party code and addition of consent banners.[1]
The complaint
What is alleged, and what is not decided
Plaintiffs allege that Kaiser installed code from multiple third parties (including Google, Microsoft Bing, X/Twitter, Adobe, Quantum Metric and Dynatrace) throughout the Kaiser Permanente website, patient portal and mobile applications, and that this code let those third parties intercept members' patient status, identifying information and communications with medical providers, including protected health information, without members' knowledge or consent. Kaiser denied the claims. In its own breach notice Kaiser said that on October 25, 2023 it determined certain online technologies may have transmitted personal information to third-party vendors, that the data could include IP address, name, signed-in status, navigation activity and health-encyclopedia search terms, and that Social Security numbers, financial account and credit card numbers were not involved. The court has made no finding of liability; the case was resolved by a class settlement.
On the record
What the regulators and the court have said
- 01
California Attorney General breach list: 'Kaiser Foundation Health Plan, Inc.' — reported date 04/12/2024, date(s) of breach listed as 'n/a' (report sb24-583875).[7]
- 02
Kaiser's sample notification letter filed with the California AG states that on October 25, 2023 Kaiser determined certain online technologies (cookies/pixels) on its websites and mobile apps may have transmitted personal information to Google, Microsoft Bing and X; data could include IP address, name, signed-in indication, navigation activity and health-encyclopedia search terms; usernames/passwords, SSNs, financial and credit card numbers were not included; Kaiser removed the technologies and stated it was 'not aware of any misuse.'[8]
- 03
Federal court discovery orders reference Kaiser's 'April 12, 2024 data breach notification to government regulators' and required production of Kaiser's correspondence with state Attorneys General and HHS OCR about the breach.[5]
- 04
The final approval order defines the settlement class by reference to the 'May 2024 Notice List' — the confidential list of current and former members notified in May 2024 — and records 13,134,307 settlement class members.[1]
Timeline
How the case has moved
Early procedural order in Doe v. Kaiser Foundation Health Plan (N.D. Cal.) continuing the initial case-management conference and allowing third-party subpoenas to Adobe, Alphabet, Microsoft and X; case filed June 2023.[6]
Kaiser Foundation Health Plan, Inc. reports the tracking-technology incident to the California Attorney General (and, per the court's discovery orders, to other regulators the same day).[7]
Kaiser mails member notices (the 'May 2024 Notice List' later used to define the settlement class); sample notice posted by the California AG.[8]
Magistrate Judge Kang orders Kaiser to produce all correspondence with state Attorneys General and HHS OCR 'about a breach' and sets Phase I ESI completion for July 15, 2024.[4]
Judge Chen issues order on the motion for preliminary approval: inclined to approve a settlement class of approximately 13.1 million people subject to changes to the class definition and opt-out process.[2]
Court-approved class notice issued; claim, exclusion and objection deadline March 12, 2026; fairness hearing set for May 7, 2026.[9]
Order Granting Plaintiffs' Motion for Final Approval of the class settlement (13,134,307 settlement class members; 22,599 opt-outs; 19 objections).[1]
If this involves you
The records that matter, and who has them.
Whatever you decide to do next, you will be asked for these. They are yours by law, and most providers have up to 30 days to send them once they have your signed request.
Kaiser Permanente's May 2024 privacy-breach notice (letter or email)
The settlement class was defined by the people on Kaiser's May 2024 Notice List; the notice is the direct evidence you were included and describes the data categories Kaiser said were involved.
Held by: You; Kaiser Permanente (member services number listed in the notice)
Class-notice email/postcard (January 2026) and any claim-submission confirmation
Confirms you were sent settlement notice and, if you filed by March 12, 2026, documents your claim; the settlement administrator is processing claims.
Held by: You; settlement administrator via www.KaiserPrivacySettlement.com
Kaiser Permanente account login history / records showing you used kp.org or the KP mobile app while signed in between November 2017 and May 2024, in a Kaiser operating state
The class covered members who 'accessed the authenticated pages' of Kaiser websites or apps in that window; the court ordered Kaiser to tabulate login days per putative class member by state and year.
Held by: Kaiser Permanente (member services / privacy office); your own device or email records
Your Kaiser medical record and secure-messaging history (messages to providers, appointment and prescription activity in the portal)
Plaintiffs alleged the code intercepted communications with providers and PHI; your portal activity identifies the kinds of health information that could have been in the intercepted traffic.
Held by: Kaiser Permanente HIM / Release of Information; kp.org 'Medical Record' section
Kaiser membership records (enrollment dates, state/region)
Class membership depended on being a Kaiser member in one of the listed operating states during the class period.
Held by: Kaiser Foundation Health Plan member services; your employer's benefits office
We send the request, follow up with the provider, and deliver the records to you. We don't take case details here and we never share your records with a law firm unless you tell us to.
Questions people ask
Straight answers, with sources
Is the Kaiser Permanente tracking-pixel lawsuit real?
Yes. It was litigated as John Does 1-5 v. Kaiser Foundation Health Plan, Inc., No. 3:23-cv-02865-EMC, in the U.S. District Court for the Northern District of California before Judge Edward M. Chen, and ended in a court-approved class settlement given final approval on July 14, 2026.[1]
Who was in the settlement class?
Kaiser Permanente members in California, Colorado, Georgia, Hawaii, Maryland, Oregon, Virginia, Washington or the District of Columbia who accessed the authenticated pages of Kaiser Permanente websites or mobile applications from November 2017 to May 2024, excluding certain people such as members who chose to arbitrate. The court tied the class to the May 2024 Notice List of 13,134,307 people.[9]
Can I still file a claim?
The court-approved deadline to submit a claim, opt out or object was March 12, 2026, and the fairness hearing was held in May 2026. The settlement website now states the Final Order has issued and claims are being processed.[9]
What did Kaiser tell members and regulators happened?
In its notice filed with the California Attorney General, Kaiser said it determined on October 25, 2023 that online tracking technologies on its websites and apps may have transmitted information such as IP address, name, signed-in status, navigation activity and health-encyclopedia search terms to Google, Microsoft Bing and X, and that Social Security numbers, financial account and credit card numbers were not involved. Kaiser reported the incident to the California AG on April 12, 2024.[8]
Did the court decide Kaiser did anything wrong?
No. The case ended in a settlement, which Kaiser entered while denying the claims; the court approved the settlement as fair without ruling on liability, noting that 'a serious privacy violation has been alleged.' Non-monetary relief included removing or modifying the third-party code and adding consent banners.[1]
Sources
Where every fact on this page comes from
Primary sources only: court orders, the Judicial Panel on Multidistrict Litigation, federal regulators and state attorneys general. Each entry shows the day we opened it. This is reference material, not legal or medical advice.
- [1]Order Granting Plaintiffs' Motion for Final Approval; Granting in Part Plaintiffs' Motion for Attorneys' Fees, Etc.; and Denying Objectors' Fee Application (July 14, 2026)
U.S. Courts via GovInfo (N.D. Cal.) · govinfo.gov · opened October 12, 2026
Final approval; class tied to May 2024 Notice List of 13,134,307; allegations summarized.
- [2]Order Re Plaintiffs' Motion for Preliminary Approval (Oct. 24, 2025)
U.S. Courts via GovInfo (N.D. Cal.) · govinfo.gov · opened October 12, 2026
Court inclined to grant preliminary approval for ~13.1 million class subject to changes.
- [3]Order re Supplemental Briefing (Oct. 3, 2025)
U.S. Courts via GovInfo (N.D. Cal.) · govinfo.gov · opened October 12, 2026
Court questions class size (~13.1M), definition and class period Nov 2017–May 2024.
- [4]Order Resolving Discovery Dispute Letter Brief Dated April 30, 2024 (June 28, 2024)
U.S. Courts via GovInfo (N.D. Cal.) · govinfo.gov · opened October 12, 2026
Orders production of Kaiser's communications with state AGs and OCR about the breach.
- [5]Order Resolving Discovery Disputes Regarding Requests for Production (July 23, 2024)
U.S. Courts via GovInfo (N.D. Cal.) · govinfo.gov · opened October 12, 2026
References Kaiser's April 12, 2024 breach notification to regulators; summarizes tracking-code allegations.
- [6]Order Granting Defendants' Administrative Motion to Continue (Aug. 23, 2023)
U.S. Courts via GovInfo (N.D. Cal.) · govinfo.gov · opened October 12, 2026
Early 2023 procedural order confirming case caption, judge and privacy-claim subpoenas.
- [7]Search Data Security Breaches — Kaiser Foundation Health Plan
California Office of the Attorney General · oag.ca.gov · opened October 12, 2026
Lists Kaiser Foundation Health Plan, Inc. breach reported 04/12/2024.
- [8]Kaiser Final Sample Notice (Affected Individuals Notification Letter)
California Office of the Attorney General · oag.ca.gov · opened October 12, 2026
Kaiser's member notice describing the tracking technologies, data involved and not involved.
- [9]Kaiser Privacy Settlement (court-approved settlement website)
Settlement administrator under N.D. Cal. order · kaiserprivacysettlement.com · opened October 12, 2026
Class definition, March 12, 2026 deadlines, Final Order issued, claims being processed.