Doe v. Adobe, Inc.

(Spring Street Courthouse: Dept. 11) September 3, 2026 DEPARTMENT 11 LAW AND MOTION RULINGS

(23STCV11136) .

Tentative Ruling

Re: Motion to Compel Business Records Pursuant to Deposition Subpoena Date: 9/3/26 Time: 11:00 am Moving Party: Jane Doe ("Plaintiff") Opposing Party: Kaiser Foundation Health Plan, Inc. ("Kaiser") Department: 11 Judge: Bruce G. Iwasaki ________________________________________________________________________

Plaintiff's motion to compel business records pursuant to deposition subpoena is denied without prejudice.

BACKGROUND

This is a putative class action. The operative complaint alleges:

1. Patients rightfully expect that their healthcare concerns and choices will be private. And the law protects the privacy of healthcare information. This case is about a serious violation of that core privacy interest.

2. Plaintiff, like millions of other class members, obtained healthcare from Kaiser[.] As for any medical provider, state and common law protect the privacy of the healthcare information held by Kaiser and exchanged between Plaintiff and Class Members, on the one hand, and Kaiser, on the other.

3. One place that legal protection is important is the Kaiser Website, which Kaiser Members use to access their medical records, including prescriptions and immunizations, research their medical conditions, find and communicate with doctors, and undertake other interactions related to the provision of healthcare services.

4. Unfortunately and unlawfully, Defendant . . . repeatedly and systematically violated that legally-protected privacy interest by extracting private health and personally identifiable information from Kaiser Members' communications with the Kaiser Website.

5. Through Defendant's code embedded on the Kaiser Website, Defendant has vacuumed up information about Kaiser Members' medical conditions, immunizations, prescriptions, physician information, and other private data, including healthcare search terms, videos watched, and links accessed. All of that information is linked to particular patients because Defendant takes that data together with unique identifiers that allow Defendant to identify the corresponding Kaiser Member.

6. Plaintiff and Class Members did not consent to Defendant's taking of this highly sensitive and legally-protected medical and other information. Defendant's conduct is unlawful, and it must be stopped. (First Amended Complaint, P.P. 1-6.)

On March 23, 2026, Judge David S. Cunningham III, now retired, heard Plaintiff's motion to compel Kaiser, a nonparty, to produce documents in response to a deposition subpoena. Judge Cunningham denied the motion without prejudice.

On March 26, 2026, Plaintiff served a new deposition subpoena on Kaiser. Here, Plaintiff moves to compel Kaiser to produce responsive documents under the new deposition subpoena. The motion concerns document requests 1 through 14.

DISCUSSION

Request 1

"ALL DOCUMENTS and COMMUNICATIONS, other than those sent to or from ADOBE, RELATING TO any unauthorized transmission of PRIVATE DATA and/or USER-AGENT DATA when a KAISER WEBSITE user navigates[d] to and/or interacts[ed] with the KAISER WEBSITE from January 1, 2016 to the present RELATING TO KAISER and ADOBE." (Plaintiff's Separate Statement, p. 5.)

Last time, Judge Cunningham declined to allow merits discovery. The existence of a motion for summary judgment is a new fact, but it does not change the result. The Court's understanding is that the motion for summary judgment regards Plaintiff's individual claims only. (See, e.g., Kaiser's Response Separate Statement, pp. 14-15.) The request is not limited to documents related to Plaintiff's individual claims. It seeks information pertaining to the entire putative class.

Moreover, the timeframe is overbroad. Judge Cunningham rejected Plaintiff's proposed timeframe ("January 1, 2016 and the present") and stressed that "the timeframe must be strictly limited to the date Adobe's products, software development kits (SDKs), or computer code that were actually implemented on the Kaiser websites." (3/23/26 Ruling, p. 3.)

The motion is denied without prejudice. The Court grants Plaintiff leave to modify the timeframe. Also, if Plaintiff wants to obtain merits information now to oppose summary judgment, she must modify the request to limit it to documents that relate to her individual claims only. The Court will not order Kaiser to produce merits information pertaining to the entire putative class prior to certification. [1]

Request 2

"DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any nonparty to this ACTION, sufficient to identify the KAISER WEBSITE users' DATA, including the type, category, and/or FIELD of DATA, obtained by ADOBE when a KAISER WEBSITE user navigates to and clicks on their test results on the KAISER WEBSITE, including without limitation such DATA represented by "eVar33" transmitted to ADOBE as a result of its ADOBE TRACKERS or other products, services, software development kits ("SDKs"), and/or computer code incorporated, included, and/or used in, on, or by the KAISER WEBSITES at any time between January 1, 2016 and the present." (Plaintiff's Separate Statement, p. 14.)

First, the request goes to the merits and seeks information beyond Plaintiff's individual claims. Second, as explained above, the timeframe is overbroad. (See 3/23/26 Ruling, p. 3.) Third, Judge Cunningham held that "Kaiser should be compelled to produce only internal documents or assessments that [Adobe] has not already produced." (Ibid.) He said "competing offers of proof regarding duplication" "would [be] require[d.]" (Ibid.) The instant record does not include such offers of proof.

The motion is denied without prejudice. The Court grants Plaintiff leave to fix these defects (also, same analysis as request 1).

Request 3

"DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any nonparty to this ACTION, sufficient to enable YOU to identify the types, categories, or FIELDS of KAISER WEBSITE users' DATA contained in the payload transmitted to ADOBE's servers at any time between January 1, 2016 and the present, including and whether ECID and/or GUID values are contained in the payload." (Plaintiff's Separate Statement, p. 23.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.)

Request 4

"DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any nonparty to this ACTION, sufficient to enable YOU to identify the form fields transmitted to ADOBE for all of the forms available on KAISER WEBSITES, including whether the content of such form fields is transmitted to ADOBE." (Plaintiff's Separate Statement, p. 31.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.)

Request 5

"DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any nonparty to this ACTION, sufficient to enable YOU to identify which FIELDS of DATA are or were populated by KAISER in accordance with the ADOBE Launch script configured for and implemented on KAISER WEBSITES at any time between January 1, 2016 and the present." (Plaintiff's Separate Statement, p. 38.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.)

Request 6

"ALL DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any non-party to this ACTION, RELATING TO ADOBE's ability to identify users of the KAISER WEBSITES using user DATA, including, but not limited to, PRIVATE DATA and/or USERAGENT DATA, that ADOBE collects through its ADOBE TRACKERS or other products, services, software development kits ("SDKs"), and/or computer code incorporated, included, and/or used in, on, or by the KAISER WEBSITES at any time between January 1, 2016 and the present." (Plaintiff's Separate Statement, p. 46.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.)

Request 7

"ALL DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any non-party to this ACTION, RELATING TO any investigation or inquiry undertaken by YOU to determine whether the ADOBE TRACKERS or other ADOBE products, services, SDKs, and/or computer code incorporated, included, and/or used in, on, or by the KAISER WEBSITES at any time between January 1, 2016 and the present comply with HIPAA." (Plaintiff's Separate Statement, p. 56.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.)

Request 8

"ALL DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any non-party to this ACTION, RELATING TO any investigation or inquiry undertaken by YOU to determine whether the ADOBE TRACKERS or other ADOBE products, services, SDKs, and/or computer code incorporated, included, and/or used in, on, or by the KAISER WEBSITES at any time between January 1, 2016 and the present infringe on the privacy of users of the KAISER WEBSITES." (Plaintiff's Separate Statement, p. 63.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.) [2]

Request 9

"ALL DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any non-party to this ACTION, RELATING TO any investigation or inquiry undertaken by YOU to determine whether the ADOBE products, services, SDKs, and/or computer code incorporated, included, and/or used in, on, or by the KAISER WEBSITES at any time between January 1, 2016 and the present infringe on the privacy of users of the KAISER WEBSITES." (Plaintiff's Separate Statement, p. 72.)

The motion is denied without prejudice (same analysis as requests 1, 2, and 8). (See 3/23/26 Ruling, p. 3.)

Request 10

"ALL DOCUMENTS and COMMUNICATIONS, whether internal or between YOU and any non-party to this ACTION, RELATING TO any investigation or inquiry undertaken by YOU to determine whether the ADOBE products, services, SDKs, and/or computer code incorporated, included, and/or used in, on, or by the KAISER WEBSITES at any time between January 1, 2016 and the present comply with HIPAA." (Plaintiff's Separate Statement, pp. 79-80.)

The motion is denied without prejudice (same analysis as requests 1 and 2). (See 3/23/26 Ruling, p. 3.) [3]

Request 11

"DOCUMENTS and COMMUNICATIONS sufficient to show, for each calendar year from January 1, 2016 to present, (a) the number of KAISER WEBSITE account holders residing in California, and (b) that KAISER has records identifying those KAISER WEBSITE account holders residing in California." (Plaintiff's Separate Statement, p. 86.)

The motion is denied without prejudice. Request 11 contains the same timeframe defect that appears in request 2. Additionally, Judge Cunningham held:

Requests seeking records that identify the number of California account holders and website visits are relevant to the ascertainability and numerosity elements of class certification. However, to the extent Plaintiff seeks records containing the putative class members' identifying contact information, Plaintiff may not use a nonparty subpoena to bypass established privacy protections. The Court will require the use of a formal Belaire-West notice process before any such identifying information is disclosed. (3/23/26 Ruling, pp. 3-4, emphasis in original.)

His ruling means Plaintiff cannot utilize this request, if at all, until the Belaire-West process is complete. During the September 3 rd hearing, the Court will ask the attorneys to give an update on the Belaire-West process.

Request 12

"DOCUMENTS and COMMUNICATIONS sufficient to show, for each calendar year from January 1, 2016 to present, (a) the number of times KAISER WEBSITE account holders residing in California logged into those accounts, and (b) that KAISER has records identifying those KAISER WEBSITE account holders." (Plaintiff's Separate Statement, p. 94.)

The motion is denied without prejudice (same analysis as requests 1, 2, and 11). (See 3/23/26 Ruling, pp. 3-4.)

Request 13

"DOCUMENTS and COMMUNICATIONS sufficient to show, for each calendar year from January 1, 2016 to present, (a) how many times KAISER MEMBERS residing in California, whether former or current, accessed their MEDICAL RECORDS on any KAISER WEBSITES, and (b) that KAISER has records identifying those KAISER MEMBERS." (Plaintiff's Separate Statement, pp. 101-102.)

The motion is denied without prejudice (same analysis as requests 1, 2, and 11). (See 3/23/26 Ruling, pp. 3-4.)

Request 14

"DOCUMENTS and COMMUNICATIONS sufficient to show, for each calendar year from January 1, 2016 to present, (a) the number of times KAISER MEMBERS residing in California visited any KAISER WEBSITES, and (b) that KAISER has records identifying such KAISER MEMBERS." (Plaintiff's Separate Statement, pp. 109-110.)

The motion is denied without prejudice (same analysis as requests 1, 2, and 11). (See 3/23/26 Ruling, pp. 3-4.)

[1] Judge Cunningham ordered Plaintiff to define the term "data breach" and to meet and confer about the definition. (See 3/23/26 Ruling, p. 3.) Instead, Plaintiff replaced "data breach" with "unauthorized transmission." Kaiser argues that "unauthorized transmission" is ambiguous. As a matter of guidance, the Court disagrees. (See Reply, p. 7.)

[2] The original version of request 8 sought "[d]ocuments relating to Kaiser's internal 'concerns' about whether Adobe's trackers infringed on user privacy[.]" (Ibid.) Judge Cunningham found the original version irrelevant, reasoning that "[w]hat Kaiser subjectively believed has not bearing on what Adobe actually did or what Plaintiff must actually prove[.]" (Ibid.) The current version removes the "concerns" language and focuses on objective "investigation[s] or inquir[ies] undertaken by" Kaiser. This change in the current version is acceptable, though the other problems noted above persist.

[3] The parties did not ask Judge Cunningham to analyze the original version of request 10; nevertheless, the Court finds that the current version suffers from most of the same problems that encumber request 2 - i.e., the request goes to the merits, and the timeframe is overbroad.

Case Number: 26STCV03900 Hearing Date: September 3, 2026 Dept: 11 Nguyen (26STCV03900) .

Tentative Ruling

Re: Motion to Compel Arbitration Date: 9/3/26 Time: 11:00 am Moving Party: SoCal Premier Marketing, Inc. ("SoCal Premier" or "Defendant") Opposing Party: Phuong Nguyen, Elizabeth Rolon, and Kiara Bulnes (collectively "Plaintiffs") Department: 11 Judge: Bruce G. Iwasaki ________________________________________________________________________ TENTATIVE RULING