Run a free scan

Doe v. Eating Recovery Center: a defence win on "in transit" is not a reason to keep the pixel

An eating-disorder clinic won this CIPA case on a narrow reading of when a pixel "reads" a message. The win came after more than two years of litigation, a lost motion to dismiss and discovery, and it depends on one judge’s view of a contested element. The cheaper path is still not to send clinic browsing to an ad platform.

US District Court, Northern District of California · CIPA §631 and CMIA · Summary judgment for the defendant, 17 October 2025

The problem

The plaintiff alleged that Eating Recovery Center (ERC) "employ[ed] the Meta Pixel on its website and thereby disclos[ed] users' medical information without their consent", and that Meta’s "transmission of information through the Pixel is instantaneous" (Dkt. 40 at 1–2, quoting the complaint). Commentators describe the data at issue as page URLs, time on page, the path to each page and certain button clicks (Covington).

Case record

Court
US District Court, N.D. California (Judge Vince Chhabria; discovery referred to Magistrate Judge Lisa J. Cisneros)
Case number
3:23-cv-05561-VC
Parties
Jane Doe v. Eating Recovery Center LLC (Meta is not a party)
Counsel
Plaintiff: MoginRubin LLP; Don Bivens PLLC ([Dkt. 49](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_23-cv-05561/pdf/USCOURTS-cand-3_23-cv-05561-2.pdf)). ERC: not stated in the cited record
Laws
CIPA §631 (aiding and abetting); CMIA §§ 56.10 and 56.101; UCL; unjust enrichment
Stage
Summary judgment for ERC, 17 October 2025 (as reported)
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
CIPA § 631(a), aiding and abettingA third party reads a communication "in transit" without consent; the site aids itERC's Meta Pixel sent browsing to Meta "simultaneously"Survived dismissal ([Dkt. 40](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_23-cv-05561/pdf/USCOURTS-cand-3_23-cv-05561-0.pdf)); summary judgment for ERC (reported)
CMIA §§ 56.10, 56.101No disclosure, and no negligent release, of medical informationUsing the Pixel disclosed medical informationSurvived dismissal; summary judgment for ERC because the plaintiff was not a "patient" (reported)
UCLLost money or propertyVague allegations of a market for medical dataDismissed at pleading ([Dkt. 40 at 2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_23-cv-05561/pdf/USCOURTS-cand-3_23-cv-05561-0.pdf))
Unjust enrichmentBenefit unjustly retainedERC gained from the dataSummary judgment for ERC; no evidence of enrichment (reported)

At the pleading stage the court accepted the "in transit" allegation: "Doe has sufficiently pled that Meta intercepted her communications 'in transit' as required under § 631(a)" (Dkt. 40 at 2). ERC then tried to join Meta as a necessary party; the court refused, noting that "Meta has disavowed any interest in this litigation" (Dkt. 61 at 1).

Technical issue

  • Tools or vendors: the Meta Pixel.
  • Where: ERC’s public website.
  • What data: page URLs, time on page, referrer path and certain button clicks (as reported by Covington). The reported ruling accepted that URLs and event data can be "contents" when they reveal substantive information such as research into treatment (Duane Morris).
  • When: no consent step was alleged.
  • How it came to light: the complaint relied on screenshots whose creation became a discovery dispute (Dkt. 72).

Inth’s technical interpretation: the Pixel’s request leaves the visitor’s browser for Meta at the same time as, or a moment after, the request to the clinic. Whether that counts as reading "in transit" is a legal characterisation, not an engineering one. On the reported summary-judgment record, the court focused on what Meta did with the data after receipt (it filters and processes server-side) and held that was not reading in transit. Nothing in the browser changed; the evidence about the recipient’s processing did.

Illustrative pattern, not the defendant’s code.

// Treatment pages report URL, referrer and clicks to Meta with the visitor's cookies
fbq('init', '123456789012345');
fbq('track', 'PageView');       // dl=/treatment/anorexia/residential, rl=/insurance/verify
// automatic events also send button text such as "Request a call back"

Illustrative pattern, not the defendant’s code.

// No ad pixel on treatment, admissions or insurance pages; elsewhere only after consent,
// with automatic events off (generic consent check)
const sensitive = /^\/(treatment|admissions|insurance)/.test(location.pathname);
if (!sensitive && consent.has('marketing')) {
  fbq('set', 'autoConfig', false, '123456789012345');
  fbq('init', '123456789012345');
  fbq('track', 'PageView');
}

Outcome

  • Holding (as reported): on 17 October 2025 the court granted summary judgment to ERC on CIPA, concluding the pixel provider did not "read, attempt to read, or attempt to learn the contents of Doe’s communications with ERC" while they were "in transit". It applied the rule of lenity to a statute it called ambiguous and followed Torres v. Prudential in requiring "something more" (Covington; Duane Morris). A separate order granted summary judgment on the CMIA and unjust enrichment claims.
  • The court on CIPA: commentators quote the court calling CIPA "a total mess" and urging the Legislature to "go back to the drawing board" (Duane Morris).
  • Citation: reported as 2025 WL 2971090; a later court filing cites it as 806 F. Supp. 3d 1109 (LifeStance fee motion, Dkt. 101 at 9).
  • Binding effect: a district-court decision; it binds no other court. Courts are, in its own reported words, "all over the map" on this element.

Why it matters

  • A real defence, with a cost. ERC won only after losing the motion to dismiss, litigating discovery and a joinder fight with Meta. Other healthcare defendants cite the same risk to justify settling, as LifeStance’s class counsel did (Dkt. 101 at 9).
  • Pleading versus evidence. The same judge found "in transit" adequately pleaded in 2024 and not proven in 2025. Compare Esparza v. CommonSpirit, where a state court accepted similar allegations at the pleading stage.
  • CMIA "patient" status. The CMIA claim failed because the plaintiff was not ERC’s patient, as reported. Sites that serve prospective patients should not read that as permission; other statutes and theories remain.
  • Only CIPA and CMIA. The case had no federal wiretap claim. It says nothing about ECPA or other states' all-party-consent statutes.

How Inth catches this

  • Code audit: flags a pull request that adds the Meta Pixel to treatment, admissions or insurance templates, and traces the page path and button text into the Pixel’s events.
  • Website audit: records requests to facebook.com/tr from sensitive pages with the page, time, visitor region and consent state.
  • Consent banner: holds the Meta Pixel until the marketing category is granted where the policy is opt-in. Inth’s default California policy is opt-out, so tags run until the visitor opts out; configure a California opt-in policy if CIPA pre-consent claims are a concern.
  • Evidence: dated runtime observations and consent records with choice, country and policy.

Limit: the outcome here turned on what Meta did after receipt; no browser or code check can show that.

Checks for your own systems

In the repository

  • List treatment, admissions and insurance-verification routes and the vendor tags on each.
  • Check whether automatic Meta events are disabled where any pixel remains.

In the browser and network

  • Visit a treatment page and an insurance form; record dl, rl and cd[buttonFeatures] in every facebook.com/tr request.

With the people responsible

  • Do not plan around a favourable ruling on one element; ask counsel which other statutes apply in your states.
  • Decide whether prospective patients' browsing should be treated like patient data for tagging purposes.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Eating Recovery Center’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.