Anthem Website Tracking Lawsuit Advances on Wiretap and Fiduciary Claims

The claims that remain

A proposed class action over Anthem’s website tracking can proceed on two central claims: alleged violations of the federal Wiretap Act and breach of fiduciary duty. The ruling keeps alive a dispute over how members’ search and browsing data reached outside vendors, though it doesn’t decide whether Anthem is liable. That distinction matters: at this stage, the court has found that the allegations can continue, not that they’ve been proven.

In Alexander-Fetterman v. Anthem Insurance Companies, Inc., filed in the U.S. District Court for the Southern District of Indiana, Judge Brookman declined on Wednesday to dismiss those claims. Members allege that software from Adobe, Medallia and Quantum Metric captured searches—including “hysterectomy” and “obstetrics/gynecology”—as well as clicks and browsing on Anthem’s website and patient portal. They say the information went to the vendors and was used to market Anthem plans and increase enrollment and revenue. Those allegations put the focus on what information the tools collected, how it was transmitted, and what Anthem and the vendors did with it. Each point remains contested or unresolved in the account of the ruling.

Consent and the site’s terms

Anthem, based in Indianapolis, argued that members consented to tracking by using the site. Brookman said that question was premature: the site’s terms of use neither mention nor link to its privacy policies, and he questioned why continued use would establish acceptance of those policies. The ruling therefore leaves open whether the members agreed to the tracking; it identifies a gap in the consent argument at this stage.

That gap is practical as well as legal. A privacy policy may describe a company’s data practices, but a user’s ability to find and understand that policy can matter when a company argues that use of a site amounts to agreement. Here, the judge pointed to the relationship between the terms of use and the separate privacy policies. The case can now develop on whether the members had notice of the relevant practices and whether their actions showed consent. It hasn't answered either question.

What the Wiretap Act question involves

The judge also rejected Anthem’s contention that search terms fall outside the Wiretap Act’s protection for the “contents” of a communication. The members’ allegations concern more than a general count of visits: they identify searches for sensitive medical topics, along with clicks and browsing activity. Whether those details qualify as protected content is central to the surviving claim. The ruling allows the argument to proceed; it doesn’t settle the meaning of the law for every kind of online tracking.

Brookman also found that alleged violations of the federal health privacy law HIPAA can support liability under the Wiretap Act, and that a company need not have acted specifically to break the law rather than, for example, to make money. That leaves room for the court to examine alleged conduct even if the purpose, as the members describe it, was commercial. The distinction matters because motive alone doesn't resolve whether the alleged collection or disclosure violated the statute.

Here's the thing: the same tracking tools can raise different questions depending on what they capture, where the data goes, and how it’s used. A record of a page view may tell a company something different from a search for a particular medical service. (And this is the part most people overlook.) The complaint’s examples make the sensitivity of the alleged information a live issue, but the ruling doesn’t establish what the vendors actually received or how Anthem handled each data point.

Harm, fiduciary duty and the dismissed claims

Members also pleaded sufficient harm to bring the case at this stage, the judge found, based on their allegation that the tracking invaded their privacy. That finding clears an initial procedural hurdle. It doesn't mean the court has determined the members suffered a particular financial loss, nor does it establish that the alleged privacy invasion occurred. The case will have to proceed on a fuller record before those questions can be assessed.

The breach of fiduciary duty claim also remains. Its survival keeps open the members’ argument about Anthem’s responsibilities in relation to the data at issue. The ruling, as described, doesn’t set out a final finding on whether a fiduciary relationship existed or whether Anthem breached a duty. Those are matters for the case to address as the parties develop their arguments and evidence.

Two other claims were dismissed. The unjust enrichment claim failed because members didn’t allege they expected payment for their data, but they may refile it. That leaves a route to try again if they can plead the claim differently. The intrusion upon seclusion claim was dismissed permanently: Indiana law requires an intrusion into physical space, while the complaint alleges intrusion into “digital space.” The difference shows how a claim based on online conduct can run into the limits of a legal theory developed around a different kind of intrusion.

What the next stage could clarify

The surviving claims leave the court to assess the alleged tracking and the parties’ arguments on a fuller record. That means the central questions now have to be tested in detail: what the tracking software captured, what information was transmitted, what notice members received, and how the data was used. The present ruling doesn’t supply those answers. It determines that the members’ allegations are sufficient to keep two claims in the case.

This is more significant than it looks. Health-related searches can reveal sensitive interests, and the allegations concern data moving from a health insurer’s site to outside vendors. If you're working in this space, the dispute is a reminder that the design of a notice and the actual flow of information may both matter when consent is challenged. That’s a general point about the issues raised here, not a finding that Anthem’s practices violated the law.

Anthem’s position will be tested against the members’ account as the litigation continues. The vendors’ roles and the handling of the alleged data may also become clearer, but the ruling doesn’t make findings about their liability. The outcome remains uncertain. For now, the case turns on whether the alleged collection and sharing can be established and whether the surviving legal theories fit those facts.

Adobe is based in San Jose, Quantum Metric in Monument, Colorado, and Medallia in McLean, Virginia. Their inclusion in the allegations gives the dispute a broader set of participants, while the court’s ruling keeps its immediate focus on the claims the members brought and Anthem’s arguments for dismissal. The allegations remain allegations. The next phase will show what the record supports.