Meta Accused of Tracking Patients' Medical Appointments, Prescriptions, and Health Conditions as Judge Certifies Class Action

Facebook owner Meta Platforms is facing a major privacy lawsuit over allegations that its proprietary tracking technology collected patients' sensitive medical information, including appointment activity, prescription details, and health conditions, from healthcare websites and apps.

A federal judge has now certified multiple classes of Facebook users, allowing their claims to proceed collectively and raising the prospect of significant legal exposure for the social media company.

The ruling concerns allegations that Meta's tracking tools, particularly the Meta Pixel, captured protected health information when patients interacted with healthcare providers' digital platforms for advertising purposes on Facebook and Instagram in violation of state and federal consumer protection laws.

Through its account managers and representatives, Meta is allegedly aware that it is receiving patient data from hundreds of different medical providers in the US without patient knowledge, consent, or valid HIPAA authorizations. Plaintiffs have identified at least 664 hospital systems or medical provider web properties where Meta has received patient data via the Meta Pixel, according to interim co-lead counsel in this certified class action, Cohen Milstein.

However, the litigation does not include a direct claim against Meta under HIPAA. The judge said the federal health privacy law was relevant to assessing patients' reasonable expectations of privacy and Meta's contractual promises, rather than providing an independent cause of action in this case.

Meta Pixel is a piece of tracking code that healthcare providers can install on their websites and apps to measure user activity and improve advertising and website performance. However, patients allege that when they logged into medical portals, booked appointments, paid bills, or communicated with prescription websites, the technology transmitted information to Meta that could reveal their identities and sensitive healthcare activity.

Court Ruling Recognises Four Classes Covering Affected Facebook Users

Judge William H. Orrick of the US District Court for the Northern District of California issued the order on 30th October, rejecting Meta's argument that differences between patients, healthcare providers, and the information collected made collective litigation impractical.

The ruling certifies four classes of Facebook users whose healthcare-related information or device activity was allegedly captured through Meta's tracking technology, although the judge imposed limitations on the California wiretapping and computer-intrusion claims:

• Patient Status Button-Click Class: Users whose clicks on patient portals, medical appointments, bill payments, or diagnostic assessments were collected by Meta.
• Patient Health Information Class: Users whose communications or information identifying their doctors, medical conditions, or treatments were allegedly obtained.
• Prescription Drug Information Class: Users whose communications with prescription drug websites relating to medications they were prescribed were collected.
• Patient Device Intrusion Class: Users whose devices were affected by Meta placing tracking cookies or using their computing resources while they visited healthcare websites or apps.

The claims include breach of contract, violation of the implied covenant of good faith, intrusion upon seclusion, and violations of California's Comprehensive Computer Data Access and Fraud Act. Note that three of the classes also pursue claims under the federal Electronic Communications Privacy Act and California Invasion of Privacy Act.

However, the ruling includes limitations. The CIPA Section 631 claims require a connection to California, rather than automatically covering all US users. The device-intrusion class must also be revised to remove certain activities, including data collection through Meta's Conversions API and customer-list uploads, which plaintiffs agreed did not affect users' devices.

Meta's Defence and What Happens Next

Meta has disputed the allegations, arguing that healthcare providers and other website operators control how they install and configure the Pixel. Its Business Tools terms require developers to have the necessary rights to share information and prohibit sending sensitive health data.

The company has also pointed to filtering systems designed to identify potentially sensitive healthcare information, prevent it from entering advertising ranking and optimisation systems, and alert developers when problematic data is detected.

Meta further argued in court that differences in website configurations, patient consent, data retention, and the effectiveness of its filters made it impossible to establish common claims across the proposed classes.

However, Judge Orrick rejected those arguments at the certification stage, finding that the competing expert evidence could be challenged at trial rather than excluded. He also noted that Meta's own data-retention policies meant its oldest available class-wide records dated back only to March 2022, despite the proposed class period beginning in June 2018.

Importantly, the certification is not a finding that Meta broke the law. The company can continue challenging the allegations, the evidence, and the proposed damages as the litigation progresses.

For now, the decision allows Facebook users with qualifying healthcare-related data disclosures to pursue their claims together rather than bringing separate lawsuits. Plaintiffs must submit revised class definitions within 10 days of the order, followed by a proposed class-notice plan within 30 days, unless the parties agree to extend the deadlines. The certification does not establish liability or entitle class members to compensation.