[Enforcement library](/enforcement)

# Jancik v. WebMD: a court certified a VPPA Pixel class by asking Meta which subscribers it has data for

Class certification is where many Pixel cases die, because nobody can prove who was logged into Facebook. Here the court accepted a different route: define the class by whether Meta holds Event Data for a subscriber's email address. If you use Advanced Matching, you have handed plaintiffs that route.

US District Court, Northern District of Georgia · Video Privacy Protection Act · Class certified 20 February 2025

## The problem

WebMD publishes health information, including videos, and sends an email newsletter. The plaintiff alleged that WebMD used the Meta Pixel to send Meta the URLs, button clicks and video titles on pages she viewed, with her `c_user` Facebook ID. For newsletter subscribers, WebMD also allegedly sent their email address through Advanced Matching ([Class cert. op. at 2–3](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)). Her own Meta data showed a visit to `www.webmd.com/hypertension-high-blood-pressure/video/blood-pressure-foods` ([op. at 10](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Northern District of Georgia (Judge Thomas W. Thrash Jr.) |
| Case number | 1:22-cv-00644-TWT |
| Parties | Linda M. Jancik (earlier Debra Lebakken) v. WebMD LLC |
| Counsel | Not named in the cited orders |
| Laws | Video Privacy Protection Act |
| Stage | Class certified 20 February 2025; later stages not confirmed in this review |
| Amount | None; the class seeks USD 2,500 per violation in statutory damages |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| VPPA, § 2710(b)(1) | Knowing disclosure of a consumer's video-viewing PII by a video tape service provider | WebMD directed the Pixel to send "Event Data" (URLs, clicks, video titles and descriptions), the \`c\_user\` cookie, and newsletter subscribers' emails via Advanced Matching; it also allegedly uploaded subscriber lists to Meta (\[op. at 3 & n.2\](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1\_22-cv-00644/pdf/USCOURTS-gand-1\_22-cv-00644-2.pdf)) | Motion to dismiss denied 2022; class certified 2025 |

The earlier ruling held that the newsletter made the plaintiff a "subscriber", and that WebMD was plausibly a video tape service provider. It also held that disclosure of her Facebook ID, email and pages viewed plausibly disclosed PII ([MTD op. at 6–11](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-0.pdf)).

## Technical issue

- **Tools or vendors:** the Meta Pixel, Advanced Matching, and a Customer List upload the court described as "independent from the Facebook Pixel" ([op. at 3 n.2](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **Where:** webmd.com pages with video, including pages reached from newsletter links.
- **What data:** page URL (containing `/video/`), titles and descriptions of videos, button clicks, the `c_user` Facebook ID, and hashed email for subscribers.
- **When:** from at least 2020, per deposition testimony quoted in the order ([op. at 2](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **How it came to light:** the complaint, then discovery from WebMD and Meta. A senior software engineer on Meta's Signals team, which "bears primary responsibility for maintaining and updating the Meta Pixel code", testified that Meta can "probably" use an email address to locate a Facebook ID ([op. at 12](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).

**Inth's technical interpretation:** Advanced Matching changes the evidence. Without it, a disclosure needs the visitor to be logged into Facebook in the same browser, and courts such as Martinez v. D2C (S.D. Fla. 2024) found that too uncertain to count a class. With it, the site itself sends a hashed email that Meta can match "even if the user was never logged into Facebook" ([op. at 19](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)). The site's subscriber list plus Meta's Event Data then define the class. On a health site the URL also carries the condition: hypertension, in the plaintiff's own record.

Illustrative pattern, not the defendant's code.

```js
// Bad: newsletter subscribers are matched by email on every page, including video
fbq('init', PIXEL_ID, { em: subscriber.emailSha256 }); // Advanced Matching
fbq('track', 'PageView'); // dl=/hypertension-high-blood-pressure/video/blood-pressure-foods
```

Illustrative pattern, not the defendant's code.

```js
// Fixed: no Advanced Matching; no Pixel on video or health-condition pages.
// Generic consent check, not a specific library API.
const sensitive = /\/video\/|\/(hypertension|diabetes|mental-health)\//.test(location.pathname);
if (!sensitive && consent.has('marketing')) {
  fbq('init', PIXEL_ID);
  fbq('track', 'PageView');
}
```

## Timeline

| Date | Event |
| --- | --- |
| 15 February 2022 | Complaint filed by Debra Lebakken (\[MTD op. at 2\](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1\_22-cv-00644/pdf/USCOURTS-gand-1\_22-cv-00644-0.pdf)) |
| 4 November 2022 | Motion to dismiss denied |
| 2023 to 2024 | Third Amended Complaint names Linda M. Jancik; discovery from WebMD and Meta |
| 10 December 2024 | Motion to strike the plaintiff's expert reply report granted in part, denied in part (\[order\](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1\_22-cv-00644/pdf/USCOURTS-gand-1\_22-cv-00644-1.pdf)) |
| 20 February 2025 | Class certified (\[order\](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1\_22-cv-00644/pdf/USCOURTS-gand-1\_22-cv-00644-2.pdf)) |

## Outcome

The court certified this class under Rule 23(b)(3) and (b)(2): "All persons in the United States who, from February 17, 2020 through the date on which class notice is disseminated, had the same email address associated with a subscription to webmd.com and a Facebook account, and for whom there is associated Event Data in the possession of Meta Platforms, Inc. showing their video-viewing behavior on webmd.com" ([op. at 5, 27, 30](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).

- **Ascertainability:** WebMD holds the subscriber emails and Meta holds the Event Data, so membership can be determined objectively. WebMD's worries about 404 pages or shared computers were "entirely speculative" ([op. at 9–14](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **Numerosity:** WebMD's records showed at least 550,213 subscriber emails with video activity in 2021 and 2022 alone, and 269,189 who reached video through newsletter links ([op. at 15](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **Commonality:** defining the class by Meta's data "appears to circumvent" individual differences in privacy settings: "If Meta has Event Data showing that a particular user watched a particular video on webmd.com, that is absolute proof of a violation because there is no other way that Meta would have that data" (quoting plaintiff, [op. at 22](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **Typicality:** WebMD pointed to a `has_user_PII_data` column showing "0" and "FALSE" in the plaintiff's Meta data. The court read that column as reflecting how Meta matched the record, not whether PII was disclosed ([op. at 23](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **Injunction class:** WebMD "could be enjoined to either stop using the Pixel in this violative manner or to obtain informed consent compliant with the VPPA" ([op. at 29](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).

The order is a district court ruling and does not bind other courts. Plaintiffs' counsel in other VPPA cases now cite it as the contested certification that succeeded, against denials in Martinez v. D2C, In re Hulu and Therrien v. Hearst ([Limited Run Games fee memorandum, ECF 23-1 at 10](https://web.archive.org/web/20251220225634/https://www.limitedrungamessettlement.com/files/023-1_nyed_2-24-cv-08861.pdf)).

## What it cost

| Item | Amount |
| --- | --- |
| Damages, fund or judgment | None in the cited record |
| Statutory exposure | USD 2,500 per violation sought for each class member (\[op. at 1–2\](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1\_22-cv-00644/pdf/USCOURTS-gand-1\_22-cv-00644-2.pdf)) |
| Fees and costs | Not stated in the cited record |

## Why it matters

- **A certified class changes settlement value.** The starting pool was at least 550,213 subscriber emails, and the VPPA's liquidated damages are USD 2,500 per violation; the court expected the class to number "at least in the tens of thousands" ([op. at 17–18](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)).
- **Your own data features become class evidence.** Advanced Matching and customer list uploads let Meta match users without a login, which is what got this class past numerosity.
- **Eleventh Circuit, not Second.** The motion to dismiss ruling predates [Solomon v. Flipps](/enforcement/solomon-v-flipps), and the Second Circuit's ordinary-person test does not bind Georgia courts.
- Related: [VPPA](/enforcement/laws/vppa), [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data), [Limited Run Games](/enforcement/limited-run-games).

## How Inth catches this

- **Code audit:** flags a pull request that turns on Advanced Matching (`em`, `ph`) or adds customer-list sync code, and traces the subscriber email from the newsletter system into the Pixel call.
- **Website audit:** records facebook.com/tr requests on video and health-condition pages, with page, time, region and consent state, including whether `ud[em]` parameters were present.
- **Consent banner:** holds the Meta Pixel helper until marketing is granted under an opt-in policy. Georgia is not in Inth's listed opt-in regions, so an opt-in policy there is your configuration.
- **Evidence:** consent records with choice, country and policy.

A server-side customer list upload does not pass through the browser; only code review and vendor records show it.

## Checks for your own systems

### In the repository

- Search for `fbq('init'` with a third argument, and for Conversions API or customer-list sync jobs.
- List URL patterns containing `/video/` or health conditions.
- Check whether newsletter emails are hashed and sent anywhere outside your email provider.

### In the browser and network

- Sign up for the newsletter, click a newsletter link to a video page, and capture `facebook.com/tr`.
- Look for `ud[em]`, the `dl` path and any `cd[...]` title fields.
- Repeat logged out of Facebook; Advanced Matching should not make the request identifiable if it is truly off.

### With the people responsible

- Ask marketing whether subscriber lists are uploaded to ad platforms and under what consent.
- Ask counsel to review health-related URLs and titles as potentially sensitive data under other laws too.

## Sources and limits

- [Opinion and order granting class certification, 20 February 2025](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-2.pdf)
- [Opinion and order denying motion to dismiss, 4 November 2022](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-0.pdf)
- [Opinion and order on motion to strike, 10 December 2024](https://www.govinfo.gov/content/pkg/USCOURTS-gand-1_22-cv-00644/pdf/USCOURTS-gand-1_22-cv-00644-1.pdf)
- [Limited Run Games fee memorandum, ECF 23-1 (archived)](https://web.archive.org/web/20251220225634/https://www.limitedrungamessettlement.com/files/023-1_nyed_2-24-cv-08861.pdf), for how other courts' certification rulings are cited

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit WebMD's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Salazar v. NBA](/enforcement/salazar-v-nba), [Limited Run Games](/enforcement/limited-run-games), [VPPA](/enforcement/laws/vppa)