California Court Requires Insurer to Defend Privacy Class Action Despite Coverage Exclusions

The US District Court for the Northern District of California recently held that an insurer had a duty to defend an online therapy company in a privacy class action, rejecting arguments that “related acts” and “prior knowledge” exclusions barred coverage. The decision clarifies that such exclusions may not apply when new claims allege distinct wrongful acts under a claims-made policy.

The “timing” trigger of coverage under a claims-made liability insurance policy is easy to recite—coverage is triggered by a claim “made” against the insured and “reported” to the insurer during the policy period. Real-world practice, however, is often far more complicated due to the presence of “related claims” and “interrelated wrongful acts” provisions in the policies that may bring a claim “back in time” to a period of no coverage or into exclusions resulting from the insured’s prior acts or prior knowledge. In BetterHelp, Inc. v. Columbia Casualty Co., decided October 29, 2025, the US District Court for the Northern District of California resolved a dispute over application of these policy provisions in favor of the insured.

PRIVACY CLASS ACTION AND COVERAGE DISPUTE

The case arose from Columbia Casualty’s refusal to defend a class action lawsuit filed against BetterHelp, an online therapy company, in 2023 alleging that BetterHelp “divulged” confidential user information to a third-party network. The insurer asserted the suit was “unequivocally related to and interrelated with” a prior Federal Trade Commission (FTC) civil investigative demand (CID) and draft FTC complaint alleging that BetterHelp disclosed consumer health information without consent. It therefore contended that it was not obligated to defend the suit based on its policy’s prior executive knowledge provision and a prior wrongful acts exclusion.

The district court disagreed, concluding that Columbia Casualty did not meet its burden to avoid a defense duty by establishing that “no conceivable theory” asserted in the class action complaint could bring the suit within policy coverage.

First, it held that the insurer did not establish that the FTC’s CID imparted knowledge to BetterHelp’s executives of the specific wrongful acts alleged in the class action suit.

Second, it held that Columbia Casualty did not show that the CID was “connected to” the class action suit.

Third, the district court concluded that Columbia Casualty did not establish that the suit arose “completely out of” prior, excluded acts. Although the sharing of personal data was at issue in the class action complaint and in the FTC’s earlier draft complaint, the class action complaint also concerned certain conduct that was absent from the FTC’s document. Columbia Casualty therefore could not establish the necessary “causal link” between the class action lawsuit and the conduct at issue in the FTC’s draft complaint.

KEY TAKEAWAYS FOR POLICYHOLDERS AND INSURERS

BetterHelp exemplifies the need for insureds and their counsel to scrutinize the details of the pertinent documents an insurer asserts implicate “related claims” or “interrelated wrongful acts” provisions that, in concert with other policy provisions, justify a coverage denial under a claims-made policy. Similarities in the documents at high levels of generality (e.g., they each allege the “wrongful sharing of personal data)” do not necessarily mean they do not also allege different underlying events, transactions, or situations lacking the necessary “causal connection” for the insurer to get out from under its broad duty to defend.

A good preliminary question to ask in these cases is: could the activities alleged in the second claim have occurred independently of the activities alleged in the first claim? If so, the two claims might not be “related” and the acts at issue in the second claim might not be “interrelated” with the acts at issue in the first claim.

HOW WE CAN HELP

Our lawyers stand ready to advise policyholders and insurers on complex coverage disputes involving data privacy, cybersecurity, and class action claims to help mitigate risk and preserve coverage in evolving regulatory and litigation landscapes.