[Enforcement library](/enforcement)

# In re Meta Pixel Healthcare: patients sued the pixel vendor, and the wiretap claims survived

Most hospital pixel cases sue the hospital. This one sues Meta, the company that wrote the Pixel and received the data. The court let wiretap and contract claims go forward and refused to let Meta's own terms ("do not send us health data") settle the question of intent. For site owners, the lesson is that a vendor's terms do not stop the data arriving; your configuration does.

US District Court, Northern District of California · ECPA, CIPA, contract · Class certification argued 2026

## The problem

Five Facebook users said their healthcare providers (MedStar Health, Rush University System for Health, WakeMed, Ohio State University Wexner Medical Center and North Kansas City Hospital) "installed the Meta Pixel on its patient portals", and that when they logged in "the Pixel transmitted information to Meta" that "revealed their status as patients and was monetized by Meta for use in targeted advertising" ([Dkt. 316 at 1–2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-19.pdf), summarising the complaint). Plaintiffs say they identified "more than 660 entities covered under" HIPAA from which Meta receives information ([Dkt. 159 at 5](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-1.pdf)). Meta denies the claims.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, N.D. California (Judge William H. Orrick) |
| Case number | 3:22-cv-03580-WHO (VKD) |
| Parties | Anonymous Facebook users v. Meta Platforms, Inc. |
| Counsel | Plaintiffs: interim co-leads Cohen Milstein (Geoffrey Graber) and Simmons Hanly Conroy (Jay Barnes), with Kiesel Law, Terrell Marshall and Gibbs Mura. Meta: Gibson, Dunn & Crutcher (\[Dkt. 1274\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-64.pdf); \[class certification motion\](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf)) |
| Laws | ECPA; CIPA §§ 631, 632; contract; unjust enrichment; privacy and intrusion; CDAFA; trespass |
| Stage | Class certification motion heard (hearing set for 10 June 2026); no ruling reported as of Meta's Q2 2026 10-Q |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

The consolidated complaint (February 2023) pleaded 13 claims ([Dkt. 185](https://www.cohenmilstein.com/sites/default/files/Complaint%20-%20Meta%20Pixel%20Healthcare%200%2002212023.pdf)).

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| ECPA, 18 U.S.C. § 2511 | Intentional interception of contents; no liability if a party consented, unless the purpose is criminal or tortious | Pixel redirected portal log-ins and descriptive URLs to Meta | Motion to dismiss denied, 7 September 2023 (\[Dkt. 316 at 26\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-19.pdf)) |
| CIPA §§ 631, 632 | Reading contents in transit; recording confidential communications | Same | Denied; non-California plaintiffs allowed to proceed at this stage (\[Dkt. 316 at 8–9\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-19.pdf)) |
| Breach of contract; unjust enrichment | Meta's terms promised it requires partners to have the right to share data | Meta took health data it said it did not want | Denied |
| Privacy, intrusion, CDAFA, trespass | Various | Same; the \_fbp cookie placed on patients' devices | Dismissed with leave in 2023; survived the second motion, 29 January 2024 (\[Dkt. 417 at 11\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-24.pdf)) |
| Negligence per se, larceny, UCL, CLRA | Various | Same | Not re-pleaded or withdrawn |

Three rulings explain why the case is still alive:

- **Contents.** "\[T\]he log-in buttons and the kinds of descriptive URLs identified in the Smith Decl. are 'contents'", because the URLs include "both the 'path' and the 'query string'" ([Dkt. 316 at 5](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-19.pdf), quoting the PI order).
- **Consent.** Whether the hospitals "actually consented to the sending of sensitive healthcare information" depends on what Meta told and trained them, and "These evidence-bound determinations are inappropriate to reach on this motion" ([Dkt. 316 at 8](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-19.pdf)).
- **Intent.** The court refused to certify an interlocutory appeal on whether Meta's instruction to partners not to send health data defeats intent: "what steps it actually took to prevent receipt of health information, the efficacy of its filtering tools ... all turn on disputed questions of fact" ([Dkt. 659 at 1–2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-33.pdf)).

## Technical issue

- **Tools or vendors:** the Meta Pixel; the class motion covers the Pixel, SDK and Conversions API ([class certification motion at 14](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf)).
- **Where:** healthcare providers' sites, including patient-portal log-in, sign-up and log-out, appointment scheduling and check-in, bill payment and health risk assessments (the "button click" definition, [same at 13 n.5](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf)).
- **What data:** plaintiffs' expert identified URLs such as a hospital's ulcerative-colitis page and log-in button clicks ([Dkt. 316 at 5](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-19.pdf)). The class motion lists events from one hospital domain: the patient-portal page with "Log In", a heart-palpitations page with "Request an Appointment", a doctor page, a site search for "diabetes" and condition pages ([class certification motion at 2–3](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf)).
- **When:** the proposed class period starts on 17 June 2018 ([same at 13](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf)).
- **How it came to light:** The Markup's June 2022 Pixel Hunt reporting and a plaintiffs' technical investigation ([Complaint ¶¶ 84–85](https://www.cohenmilstein.com/sites/default/files/Complaint%20-%20Meta%20Pixel%20Healthcare%200%2002212023.pdf)).

**Meta's side:** Meta told the court it uses a filter to detect potentially sensitive health data sent through the Pixel and keep it out of ad ranking and optimisation, and notifies the developer when it blocks data ([Dkt. 159 at 9](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-1.pdf)). The court noted that Meta did not assert that users' own tools could prevent their information being sent to Meta "in the first place" ([same](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-1.pdf)).

**Inth's technical interpretation:** a vendor-side filter acts after the request has left the visitor's browser with the URL, button text and identifiers. From the site owner's side, the only reliable control is not to send: no Pixel on portal and clinical paths, automatic events off, and no condition text in query strings.

Illustrative pattern, not the defendant's code.

```js
// Provider site: Pixel everywhere, automatic events on; vendor filter is the only guard
fbq('init', '123456789012345');
fbq('track', 'PageView');   // dl=/conditions/ulcerative-colitis, then "Log In" button click
```

Illustrative pattern, not the defendant's code.

```js
// Provider site: decide at source. Clinical and portal paths never load the Pixel.
const clinical = /^\/(conditions|doctors|mychart|portal|appointments|billing)/.test(location.pathname);
if (!clinical && consent.has('marketing')) {        // generic consent check
  fbq('set', 'autoConfig', false, '123456789012345');
  fbq('init', '123456789012345');
  fbq('track', 'PageView');
}
```

## Timeline

| Date | Event |
| --- | --- |
| 21 December 2022 | Simmons Hanly Conroy and Cohen Milstein appointed interim co-lead class counsel (Dkt. 158) (\[order\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-0.pdf)) |
| 22 December 2022 | Preliminary injunction denied: "plaintiffs have potentially strong arguments on both the merits and irreparable injury" but could not meet the mandatory-injunction standard (\[Dkt. 159 at 33–34\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-1.pdf)) |
| 21 February 2023 | Consolidated complaint (Dkt. 185) |
| 7 September 2023 | Motion to dismiss denied in part (Dkt. 316) |
| 29 January 2024 | Second motion to dismiss denied (Dkt. 417) |
| 2 October 2024 | Interlocutory appeal certification denied (Dkt. 659) |
| 30 September 2025 | Redacted class certification motion filed; four classes proposed |
| 21 January 2026 | Schedule moved; class certification and Rule 702 hearing set for 10 June 2026 (\[Dkt. 1274\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_22-cv-03580/pdf/USCOURTS-cand-3\_22-cv-03580-64.pdf)) |
| Quarter ended 30 June 2026 | Meta's 10-Q lists the case as pending, with no class certification ruling reported (\[10-Q\](https://www.sec.gov/Archives/edgar/data/1326801/000162828026050705/meta-20260630.htm)) |

## Outcome

- **Holdings so far:** pleading-stage rulings only. ECPA, CIPA, contract and unjust-enrichment claims survived in 2023; privacy, intrusion, CDAFA and trespass survived in 2024 once re-pleaded. The court has repeatedly said consent and intent need a factual record.
- **Proposed classes:** a Patient Status Button-Click Class, a Patient Health Information Class, a Prescription Drug Information Class, and a Patient Device Intrusion Class for Facebook users for whom Meta "placed an \_fbp cookie" while they were at a healthcare provider's property ([class certification motion at 13](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf)).
- **Money:** none awarded or agreed.
- **Binding effect:** district-court orders; they bind no other court. Compare the healthcare-provider cases where federal wiretap claims failed, such as [Kaiser](/enforcement/kaiser-permanente).

## Why it matters

- **Vendor liability is in play.** Hospitals have paid settlements (see [Advocate Aurora](/enforcement/advocate-aurora), [Novant](/enforcement/novant-health)). This case tests whether the vendor that receives the data is liable too.
- **Different defendant, different ECPA analysis.** Against hospitals, courts ask whether the hospital had a separate criminal or tortious purpose (Kaiser). Against Meta, the question became whether the hospitals' consent was "actual" for health data, which the court left for trial.
- **Terms of service are not a control.** Meta's prohibition on sending health data did not end the claims, because the court could not tell from the pleadings what Meta did to enforce it.
- **The \_fbp cookie class.** Plaintiffs seek a class built on cookie placement alone while patients were on provider sites, regardless of what content was sent.

## How Inth catches this

- **Code audit:** flags a pull request that adds the Meta Pixel or Conversions API to portal, appointment, billing or condition templates, and traces URLs, search terms and button text into Pixel events.
- **Website audit:** records requests to facebook.com/tr and the `_fbp` cookie being set on provider pages, with the page, time, visitor region and consent state.
- **Consent banner:** holds the Meta Pixel until the marketing category is granted where the policy is opt-in. Inth's default California policy is opt-out, so tags run until the visitor opts out; configure a California opt-in policy if pre-consent firing is a concern. Consent to marketing on a hospital site does not make portal tracking appropriate.
- **Evidence:** dated runtime observations and consent records with choice, country and policy.

Limit: whether Meta's filter kept data out of ad systems is a question about Meta's servers, which no site-side check can answer.

## Checks for your own systems

### In the repository

- Search for `fbq(` and Conversions API calls (`graph.facebook.com/.../events`) and list the routes and fields involved.
- Confirm `autoConfig` is disabled wherever a Pixel remains, so button text is not sent automatically.

### In the browser and network

- On a provider site, log in to the portal and book an appointment; record facebook.com/tr requests and whether `_fbp` is set.
- Run a site search for a condition and check whether the term appears in any Meta request.

### With the people responsible

- Do not rely on a vendor's "do not send sensitive data" clause; ask who on your side enforces it.
- If you receive Meta's notices about blocked sensitive data, route them to the privacy team, not only marketing.

## Sources and limits

- [Order appointing interim class counsel, Dkt. 158](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-0.pdf), 21 December 2022
- [Order denying preliminary injunction, Dkt. 159](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-1.pdf), 22 December 2022
- [Consolidated class action complaint, Dkt. 185](https://www.cohenmilstein.com/sites/default/files/Complaint%20-%20Meta%20Pixel%20Healthcare%200%2002212023.pdf), 21 February 2023
- [Order on motion to dismiss, Dkt. 316](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-19.pdf), 7 September 2023
- [Order on motion to dismiss and strike, Dkt. 417](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-24.pdf), 29 January 2024
- [Order denying interlocutory appeal certification, Dkt. 659](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-33.pdf), 2 October 2024
- [Plaintiffs' class certification motion, redacted, Dkt. 1176-2](https://www.cohenmilstein.com/wp-content/uploads/2023/09/Meta-Pixel-Class-Certification-Motion-w-Meta-Proposed-Redactions-Sept.-30-2025.pdf), 30 September 2025 (a party's brief: allegations and arguments, not findings)
- [Stipulation and order, Dkt. 1274](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-03580/pdf/USCOURTS-cand-3_22-cv-03580-64.pdf), 21 January 2026
- [Meta Platforms 10-Q, quarter ended 30 June 2026](https://www.sec.gov/Archives/edgar/data/1326801/000162828026050705/meta-20260630.htm)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Meta's current systems or any provider's. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Federal Wiretap Act](/enforcement/laws/federal-wiretap-act), [CIPA §631](/enforcement/laws/cipa-631-wiretapping), [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data), [Doe v. Eating Recovery Center](/enforcement/doe-v-eating-recovery-center).