Run a free scan

Jancik v. WebMD: a court certified a VPPA Pixel class by asking Meta which subscribers it has data for

Class certification is where many Pixel cases die, because nobody can prove who was logged into Facebook. Here the court accepted a different route: define the class by whether Meta holds Event Data for a subscriber’s email address. If you use Advanced Matching, you have handed plaintiffs that route.

US District Court, Northern District of Georgia · Video Privacy Protection Act · Class certified 20 February 2025

The problem

WebMD publishes health information, including videos, and sends an email newsletter. The plaintiff alleged that WebMD used the Meta Pixel to send Meta the URLs, button clicks and video titles on pages she viewed, with her c_user Facebook ID. For newsletter subscribers, WebMD also allegedly sent their email address through Advanced Matching (Class cert. op. at 2–3). Her own Meta data showed a visit to www.webmd.com/hypertension-high-blood-pressure/video/blood-pressure-foods (op. at 10).

Case record

Court
US District Court, Northern District of Georgia (Judge Thomas W. Thrash Jr.)
Case number
1:22-cv-00644-TWT
Parties
Linda M. Jancik (earlier Debra Lebakken) v. WebMD LLC
Counsel
Not named in the cited orders
Laws
Video Privacy Protection Act
Stage
Class certified 20 February 2025; later stages not confirmed in this review
Amount
None; the class seeks USD 2,500 per violation in statutory damages
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
VPPA, § 2710(b)(1)Knowing disclosure of a consumer's video-viewing PII by a video tape service providerWebMD directed the Pixel to send "Event Data" (URLs, clicks, video titles and descriptions), the `c_user` cookie, and newsletter subscribers' emails via Advanced Matching; it also allegedly uploaded subscriber lists to Meta ([op. at 3 & n.2](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf))Motion to dismiss denied 2022; class certified 2025

The earlier ruling held that the newsletter made the plaintiff a "subscriber", and that WebMD was plausibly a video tape service provider. It also held that disclosure of her Facebook ID, email and pages viewed plausibly disclosed PII (MTD op. at 6–11).

Technical issue

  • Tools or vendors: the Meta Pixel, Advanced Matching, and a Customer List upload the court described as "independent from the Facebook Pixel" (op. at 3 n.2).
  • Where: webmd.com pages with video, including pages reached from newsletter links.
  • What data: page URL (containing /video/), titles and descriptions of videos, button clicks, the c_user Facebook ID, and hashed email for subscribers.
  • When: from at least 2020, per deposition testimony quoted in the order (op. at 2).
  • How it came to light: the complaint, then discovery from WebMD and Meta. A senior software engineer on Meta’s Signals team, which "bears primary responsibility for maintaining and updating the Meta Pixel code", testified that Meta can "probably" use an email address to locate a Facebook ID (op. at 12).

Inth’s technical interpretation: Advanced Matching changes the evidence. Without it, a disclosure needs the visitor to be logged into Facebook in the same browser, and courts such as Martinez v. D2C (S.D. Fla. 2024) found that too uncertain to count a class. With it, the site itself sends a hashed email that Meta can match "even if the user was never logged into Facebook" (op. at 19). The site’s subscriber list plus Meta’s Event Data then define the class. On a health site the URL also carries the condition: hypertension, in the plaintiff’s own record.

Illustrative pattern, not the defendant’s code.

// Bad: newsletter subscribers are matched by email on every page, including video
fbq('init', PIXEL_ID, { em: subscriber.emailSha256 }); // Advanced Matching
fbq('track', 'PageView'); // dl=/hypertension-high-blood-pressure/video/blood-pressure-foods

Illustrative pattern, not the defendant’s code.

// Fixed: no Advanced Matching; no Pixel on video or health-condition pages.
// Generic consent check, not a specific library API.
const sensitive = /\/video\/|\/(hypertension|diabetes|mental-health)\//.test(location.pathname);
if (!sensitive && consent.has('marketing')) {
  fbq('init', PIXEL_ID);
  fbq('track', 'PageView');
}

Timeline

Timeline
DateEvent
15 February 2022Complaint filed by Debra Lebakken ([MTD op. at 2](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-0.pdf))
4 November 2022Motion to dismiss denied
2023 to 2024Third Amended Complaint names Linda M. Jancik; discovery from WebMD and Meta
10 December 2024Motion to strike the plaintiff's expert reply report granted in part, denied in part ([order](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-1.pdf))
20 February 2025Class certified ([order](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf))

Outcome

The court certified this class under Rule 23(b)(3) and (b)(2): "All persons in the United States who, from February 17, 2020 through the date on which class notice is disseminated, had the same email address associated with a subscription to webmd.com and a Facebook account, and for whom there is associated Event Data in the possession of Meta Platforms, Inc. showing their video-viewing behavior on webmd.com" (op. at 5, 27, 30).

  • Ascertainability: WebMD holds the subscriber emails and Meta holds the Event Data, so membership can be determined objectively. WebMD’s worries about 404 pages or shared computers were "entirely speculative" (op. at 9–14).
  • Numerosity: WebMD’s records showed at least 550,213 subscriber emails with video activity in 2021 and 2022 alone, and 269,189 who reached video through newsletter links (op. at 15).
  • Commonality: defining the class by Meta’s data "appears to circumvent" individual differences in privacy settings: "If Meta has Event Data showing that a particular user watched a particular video on webmd.com, that is absolute proof of a violation because there is no other way that Meta would have that data" (quoting plaintiff, op. at 22).
  • Typicality: WebMD pointed to a has_user_PII_data column showing "0" and "FALSE" in the plaintiff’s Meta data. The court read that column as reflecting how Meta matched the record, not whether PII was disclosed (op. at 23).
  • Injunction class: WebMD "could be enjoined to either stop using the Pixel in this violative manner or to obtain informed consent compliant with the VPPA" (op. at 29).

The order is a district court ruling and does not bind other courts. Plaintiffs' counsel in other VPPA cases now cite it as the contested certification that succeeded, against denials in Martinez v. D2C, In re Hulu and Therrien v. Hearst (Limited Run Games fee memorandum, ECF 23-1 at 10).

What it cost

What it cost
ItemAmount
Damages, fund or judgmentNone in the cited record
Statutory exposureUSD 2,500 per violation sought for each class member ([op. at 1–2](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf))
Fees and costsNot stated in the cited record

Why it matters

  • A certified class changes settlement value. The starting pool was at least 550,213 subscriber emails, and the VPPA’s liquidated damages are USD 2,500 per violation; the court expected the class to number "at least in the tens of thousands" (op. at 17–18).
  • Your own data features become class evidence. Advanced Matching and customer list uploads let Meta match users without a login, which is what got this class past numerosity.
  • Eleventh Circuit, not Second. The motion to dismiss ruling predates Solomon v. Flipps, and the Second Circuit’s ordinary-person test does not bind Georgia courts.
  • Related: VPPA, Sensitive context in event data, Limited Run Games.

How Inth catches this

  • Code audit: flags a pull request that turns on Advanced Matching (em, ph) or adds customer-list sync code, and traces the subscriber email from the newsletter system into the Pixel call.
  • Website audit: records facebook.com/tr requests on video and health-condition pages, with page, time, region and consent state, including whether ud[em] parameters were present.
  • Consent banner: holds the Meta Pixel helper until marketing is granted under an opt-in policy. Georgia is not in Inth’s listed opt-in regions, so an opt-in policy there is your configuration.
  • Evidence: consent records with choice, country and policy.

A server-side customer list upload does not pass through the browser; only code review and vendor records show it.

Checks for your own systems

In the repository

  • Search for fbq('init' with a third argument, and for Conversions API or customer-list sync jobs.
  • List URL patterns containing /video/ or health conditions.
  • Check whether newsletter emails are hashed and sent anywhere outside your email provider.

In the browser and network

  • Sign up for the newsletter, click a newsletter link to a video page, and capture facebook.com/tr.
  • Look for ud[em], the dl path and any cd[...] title fields.
  • Repeat logged out of Facebook; Advanced Matching should not make the request identifiable if it is truly off.

With the people responsible

  • Ask marketing whether subscriber lists are uploaded to ad platforms and under what consent.
  • Ask counsel to review health-related URLs and titles as potentially sensitive data under other laws too.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit WebMD’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.