Trulieve Class Action: Medical Marijuana Dispensary Accused of Data Sharing

Case Overview: A class action lawsuit has been filed against Trulieve, alleging that the company shared medical marijuana patient data with third parties without proper consent.

Consumers Affected: Medical marijuana patients who used Trulieve's website or app.

Court: U.S. District Court Northern District of Florida Tallahassee Division

Trulieve, the largest medical marijuana dispensary conglomerate in Florida, is under fire for allegedly sharing sensitive consumer data with third parties without proper consent. 

A new lawsuit claims that the company’s website and mobile app collect and sell private information about medical marijuana patients, exposing them to potential harm and breaching privacy laws.

Trulieve Accused of Sharing Medical Marijuana Patient Data Without Consent

The plaintiff behind the proposed class action lawsuit, identified as John Doe, is a medical marijuana patient in Florida who uses Trulieve’s website to purchase cannabis for personal use. The lawsuit alleges that Doe was unaware their online activity, including their medical marijuana purchases, was being tracked and sold to third-party advertisers.

He says that the data collected by Trulieve includes personally identifiable information (PII) and protected health information (PHI), such as users' internet protocol (IP) address, purchase history, and physical location, all of which can be linked to their marijuana use.

Doe argues that medical marijuana purchases should be treated with the same level of privacy as any other sensitive medical data and that by failing to protect this information, Trulieve has subjected consumers to potential harm, including stigma and discrimination, due to the sensitive nature of their medical marijuana use.

How Trulieve Allegedly Collects and Shares User Data

According to the lawsuit, Trulieve collects PII and PHI from users of its website and mobile app. This data includes medical marijuana card numbers, physician information, and geolocation data. 

Despite its privacy policy claiming that customer privacy is “important” and that data is only shared with the Florida Department of Health, the lawsuit asserts that Trulieve sells this information to advertisers such as Google, Oracle, and Microsoft.

Trulieve's website and app use ad trackers and cookies to monitor users' activities, collecting information such as browsing behavior, purchase history, and location data, the lawsuit alleges. These tools, embedded on its digital platforms, allow third-party companies to gather and track sensitive information about users in real time, often without their knowledge or consent.

The plaintiff claims that Trulieve’s privacy policy is misleading and fails to disclose the full extent of the data sharing, particularly for users outside of California.

“According to Trulieve’s Privacy Policy, ‘your privacy is important to us’ and ‘Trulieve does not share personal information with third parties for business purposes.’  However, the reality is much darker,” the lawsuit states.

Lawsuit Claims Trulieve Violated HIPAA and Consumer Privacy

Medical marijuana use remains a highly sensitive topic in the U.S., as the substance is still federally illegal, the lawsuit states. Patients who use marijuana for medicinal purposes may face stigma from employers, family members, or the federal government. The lawsuit highlights how many patients fear the potential repercussions of their medical marijuana use becoming public.

Given the stigma surrounding marijuana, Doe argues that Trulieve’s failure to protect their data exacerbates the risks of discrimination and personal harm. The lawsuit claims that Trulieve’s actions are particularly damaging because the data collected can be tied directly to medical marijuana usage, which is subject to stricter privacy standards under laws like HIPAA.

The Health Insurance Portability and Accountability Act (HIPAA) provides strict guidelines on how healthcare providers must protect patient information. The lawsuit alleges that Trulieve has violated these guidelines by sharing PHI with third-party advertisers.

In December 2022, the U.S. Department of Health and Human Services updated its guidance to clarify that online tracking technologies used by healthcare providers are subject to HIPAA, even if no patient login is required.

Doe argues that Trulieve, as a provider of medical products, should be held to these same standards. By failing to comply, the lawsuit claims Trulieve has violated reasonable consumer expectations for the treatment of their medical data.

Trulieve Faces Legal Challenges and Controversy

This is not the first time Trulieve has found itself entangled in legal disputes. In 2022, the company was fined $350,000 in Massachusetts following the death of an employee at one of its production facilities. The employee had suffered an asthma attack, and Trulieve was found to have violated several safety requirements.

Trulieve is also involved in a lawsuit seeking $23.8 million in unpaid loans from a medical marijuana company in Ohio. Additionally, the company is suing its former CFO, accusing him of misusing corporate funds for personal expenses. 

In his lawsuit, Doe wants to represent consumers from across the country in her claims of 

common law invasion of privacy, negligence, breach of contract, unjust enrichment, and violations of Florida Deceptive and Unfair Trade Practices Act and the Electronic Communications Privacy Act. He is seeking damages, declaratory and injunctive relief, costs of suit, interest and costs and attorneys’  fees.

Case Details

• Lawsuit: Doe v. Trulieve Inc.
• Case Number: 4:24-Cv-00391-Aw-Mjf 
• Court: U.S. District Court Northern District of Florida Tallahassee Division 

Plaintiffs' Attorneys

• Arturo Peña Miranda, Blake Hunter Yagman, and Jennifer Czeisler (Sterlington, PLLC)
• Katherine M. Aizpuru (Tycko & Zavareei LLP)

Have you used Trulieve's website or app to purchase medical marijuana? Share your experiences and concerns about data privacy in the comments below.