Judge Certifies Classes in Meta Platforms Healthcare Data Privacy Litigation
A judge has certified classes in consolidated class action litigation against Meta Platforms Inc. over the use of the Meta Pixel tool on healthcare provider and prescription drug provider websites, portals, and applications. Multiple class action lawsuits were filed against Meta Platforms over the use of the Meta Pixel tool on healthcare websites and applications. The lawsuits were consolidated – In Re Meta Pixel Healthcare Litigation – in the United States District Court for the Northern District of California.
The plaintiffs allege that their medical privacy was violated through the improper use of the tracking tool on healthcare websites, which intercepted communications and transmitted sensitive information to Meta Platforms, without patients’ knowledge or consent. The data collected included personally identifiable information and information about patients’ medical conditions, prescriptions, and interactions with their healthcare providers, identifying them as patients. The data collected is monetized by Meta Platforms and used to provide targeted advertising on Meta sites and elsewhere on the web.
The lawsuit alleges that Meta Platforms is aware that its tool is being used on healthcare websites and is collecting sensitive patient data without HIPAA authorizations or consent. The plaintiffs have identified more than 660 hospital systems and medical providers that have added Meta Pixel to their websites and applications. The plaintiffs allege that the addition of the tool on healthcare websites violates Meta Platforms’ contract with its users and federal and state laws.
Meta Platforms disagrees with the claims in the lawsuit and twice sought to have the litigation dismissed. The litigation was allowed to proceed, and on October 30, 2026, U.S. District Court Judge William Orrick of the Northern District of California certified four classes of Facebook users, who allege that their sensitive data was unlawfully collected by Meta Platforms from June 17, 2018, to the present.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The four classes sought certification of claims for breach of contract, breach of implied contract, intrusion upon seclusion, and violation of the California Comprehensive Computer Data Access (CIPA) and Fraud Act (CDAFA). Three of the classes also assert claims for violations of the federal Electronic Communications Privacy Act and the California Invasion of Privacy Act. The CIPA claim was limited to a California subclass.
The four classes certified by the judge are the
- Patient Status Button-Click Class: Includes all Facebook users who had at least one patient portal, medical appointment, bill payment, or diagnostic assessment button click obtained from Meta Platforms from class healthcare providers.
- The Patient Health Information Class: Includes all Facebook users who had at least one communication or fact identifying a doctor, condition, or treatment acquired by Meta Platforms from class healthcare providers, excluding events in the Patient Status Button-Click Class.
- The Prescription Drug Information Class: Includes all Facebook users who had communications with a prescription drug provider website for which they have a prescription obtained by Meta Platforms.
- The Patient Device Intrusion Class: Includes all Facebook users for whom Meta placed an _fbp cookie and/or used computing resources by sending data to Meta through their device and/or by computing Core Setup logic on their device while at a healthcare provider property.
There is no private cause of action in the Health Insurance Portability and Accountability Act (HIPAA), so patients may not take legal action over HIPAA violations. The lawsuit does not assert any claims for violations of the HIPAA Rules; however, the lawsuit does reference HIPAA. The judge determined that HIPAA is relevant to establishing reasonable consumer expectation and possibly a reasonable consumer understanding of the meaning of Meta’s contractual promises regarding partners having lawful rights over the information transferred to Meta via the tool.
Class certification is only one stage in the legal process. The judge has not made any ruling about whether Meta Platforms violated any laws. Meta Platforms has stated that it disagrees with the class certification ruling and plans to appeal. Should that appeal fail, the classes will need to be refined, a formal notice plan agreed, and class members will be given the opportunity to remain or opt out.
Many class action lawsuits have been filed against healthcare providers over their use of Meta Pixel and other website tracking tools. The majority of certified class action lawsuits have resulted in settlements, rather than a trial. Defendants could face a massive jury verdict, while the plaintiffs might lose and face substantial legal costs.
