Case research · Sources checked October 12, 2026
Meta Pixel healthcare tracking class action against Meta (In re Meta Pixel Healthcare Litigation)
Plaintiffs, Facebook users who were patients of healthcare providers, allege that the Meta Pixel installed on provider websites and patient portals transmitted to Meta information about their patient status and communications, such as logging into a portal, booking appointments, paying bills or viewing condition-specific pages, together with Facebook identifiers, and that Meta used this data for advertising without valid consent or HIPAA authorization. The complaint claims Meta's terms require partners to have lawful rights to share user data but that Meta did not enforce them.
Every line on this page is checked against the court docket and the regulators involved. We do not decide whether you are part of this case or match you with a lawyer. What we do is help you get the medical records that matter, from any provider.
- Status
- Active
- Court
- U.S. District Court for the Northern District of California, San Francisco Division
- Docket
- 3:22-cv-03580-WHO
- Judge
- Hon. William H. Orrick III (District Judge); Hon. Virginia K. DeMarchi (Magistrate Judge, discovery)
- Started
- June 17, 2022
- Defendants
- Meta Platforms, Inc.
Where it stands
As of October 12, 2026
The case survived two rounds of motions to dismiss and is awaiting a ruling on class certification. Plaintiffs moved for class certification on September 9, 2025 (public redacted version filed September 30, 2025), Meta opposed on December 9, 2025, and the motion and the parties' Rule 702 expert motions were argued June 12, 2026. As of Meta's September 23, 2026 statement of recent decision (Dkt. 1413) no class certification ruling had issued; post-certification deadlines were stayed by stipulation in May 2026 pending that ruling, and a June 8, 2026 docket entry restored the trial date (date not stated in the filings opened).[4]
The complaint
What is alleged, and what is not decided
Plaintiffs, Facebook users who were patients of healthcare providers, allege that the Meta Pixel installed on provider websites and patient portals transmitted to Meta information about their patient status and communications, such as logging into a portal, booking appointments, paying bills or viewing condition-specific pages, together with Facebook identifiers, and that Meta used this data for advertising without valid consent or HIPAA authorization. The complaint claims Meta's terms require partners to have lawful rights to share user data but that Meta did not enforce them. Meta disputes the allegations, including on consent and on what data it received, and points to its filtering systems. The case is against Meta only, not against the hospitals.
On the record
What the regulators and the court have said
- 01
HHS Office for Civil Rights published a bulletin, 'Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,' stating that tracking technologies on user-authenticated pages such as patient portals generally have access to PHI, that vendors handling PHI are business associates requiring a business associate agreement, that website privacy policies and cookie banners are not HIPAA authorizations, and that impermissible disclosures are presumed breaches absent a low-probability-of-compromise showing. The page notes it was last reviewed June 26, 2024.[7]
- 02
On June 20, 2024, in American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex., Fort Worth Division), the court declared unlawful and vacated the bulletin's 'Proscribed Combination' (treating an IP address combined with a visit to an unauthenticated public webpage about specific health conditions or providers as individually identifiable health information), finding it exceeded HHS's authority under HIPAA; it denied a permanent injunction and stated the vacatur does not limit the rest of the guidance. HHS's bulletin page acknowledges the ruling and says HHS is evaluating next steps.[8]
Timeline
How the case has moved
Class action complaint filed by 'John Doe' against Meta Platforms (Dkt. 1), citing the MedStar 'myMedStar' patient portal as an example and alleging at least 664 hospital systems or provider web properties used the Pixel.[1]
Judge Orrick denies plaintiffs' motion for a preliminary injunction (Dkt. 159), finding potentially strong claims but not the heightened showing required for mandatory relief.[2]
Order on Meta's motion to dismiss the Consolidated Class Action Complaint (Dkt. 316): federal Wiretap Act (ECPA), California Invasion of Privacy Act, breach of contract, implied covenant and unjust enrichment claims proceed; constitutional privacy, intrusion upon seclusion, CDAFA, negligence per se, trespass to chattels, larceny, UCL and CLRA claims dismissed with leave to amend.[3]
Plaintiffs move for class certification (Dkts. 1152-1153), proposing four classes: Patient Status Button-Click, Patient Health Information, Prescription Drug Information, and Patient Device Intrusion, with a class period from June 17, 2018.[4]
Meta files opposition to class certification (Dkts. 1251-1252) and, on Dec. 19, Rule 702 motions to exclude plaintiffs' experts.[4]
Court grants stipulation adjourning all post-class-certification deadlines until it rules on class certification (Dkts. 1354-1355).[4]
Oral argument held on class certification and the parties' Rule 702 motions.[5]
Meta files a statement of recent decision in support of its class certification opposition (Dkt. 1413); no certification ruling reported as of this filing.[6]
If this involves you
The records that matter, and who has them.
Whatever you decide to do next, you will be asked for these. They are yours by law, and most providers have up to 30 days to send them once they have your signed request.
Patient portal account records and activity/audit logs (e.g., MyChart or the provider's portal) showing when you logged in, scheduled appointments, paid bills or messaged providers
The proposed classes are defined by specific portal actions (button clicks such as appointment scheduling or bill payment) during the class period; the provider's portal access log is the authoritative record of those actions and dates.
Held by: The healthcare provider (health information management / privacy office); patients may request an accounting of disclosures and access logs under HIPAA
Your own Facebook data download, including 'Your activity off Meta technologies' (formerly Off-Facebook Activity)
Shows which websites and apps Meta records as having sent it activity about your account, which is the data flow plaintiffs allege.
Held by: Meta, via the account's Settings (Download Your Information)
Any breach or privacy notification letter the provider sent about tracking technologies on its website or portal
Identifies the provider's own statement of what tools were used, on which pages, over what dates, and what categories of information may have been transmitted.
Held by: The healthcare provider; HHS OCR breach portal lists breaches affecting 500 or more people
Medical records showing the provider relationship during the class period (appointment histories, visit summaries, billing statements)
Establishes that you were a patient of a named provider and when, which is needed to connect your portal use to the class definitions.
Held by: The healthcare provider's medical records and billing departments
Prescription records and pharmacy or drug-manufacturer website account history
The proposed Prescription Drug Information class covers communications with prescription drug websites for drugs you were prescribed.
Held by: Prescriber; pharmacy; the drug website account
We send the request, follow up with the provider, and deliver the records to you. We don't take case details here and we never share your records with a law firm unless you tell us to.
Questions people ask
Straight answers, with sources
Is the Meta Pixel healthcare lawsuit real?
Yes. In re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580, is a consolidated putative class action against Meta Platforms pending in the U.S. District Court for the Northern District of California before Judge William H. Orrick. It was filed June 17, 2022.[1]
Is my hospital a defendant in this case?
No. This case is against Meta only. Separate lawsuits have been filed against individual health systems over the same technology; some, such as the Advocate Aurora Health case in Wisconsin, have settled.[3]
Which claims survived Meta's motion to dismiss?
In its September 7, 2023 order the court allowed the federal Wiretap Act, California Invasion of Privacy Act, breach of contract, implied covenant and unjust enrichment claims to proceed, and dismissed several other claims with leave to amend.[3]
Has a class been certified?
Not as of the filings reviewed. Class certification was argued June 12, 2026, and as of Meta's September 23, 2026 filing the court had not ruled. No settlement appears in the record reviewed.[6]
What has the government said about tracking pixels on hospital websites?
HHS OCR's bulletin says tracking technologies on authenticated pages like patient portals generally involve PHI and require HIPAA-compliant handling, such as a business associate agreement. In June 2024 a federal court in Texas vacated the part of the bulletin addressing IP addresses combined with visits to unauthenticated public pages, leaving the rest in place.[7]
Sources
Where every fact on this page comes from
Primary sources only: court orders, the Judicial Panel on Multidistrict Litigation, federal regulators and state attorneys general. Each entry shows the day we opened it. This is reference material, not legal or medical advice.
- [1]Class Action Complaint (Dkt. 1), Doe v. Meta Platforms
U.S. District Court, N.D. Cal., via RECAP archive (archive.org mirror of PACER filing) · ia801503.us.archive.org · opened October 12, 2026
Filed June 17, 2022; alleges Pixel on hospital websites/portals sends patient communications to Meta.
- [2]Order Denying Motion for Preliminary Injunction (Dkt. 159)
U.S. District Court, N.D. Cal., via RECAP archive · ia801503.us.archive.org · opened October 12, 2026
Dec. 22, 2022 denial of mandatory preliminary injunction.
- [3]Order on Motion to Dismiss (Dkt. 316)
U.S. District Court, N.D. Cal., via RECAP archive · ia801503.us.archive.org · opened October 12, 2026
Sept. 7, 2023: ECPA, CIPA, contract and unjust enrichment claims proceed; others dismissed with leave to amend.
- [4]Joint Case Management Statement (Dkt. 1402)
U.S. District Court, N.D. Cal., via RECAP archive · ia801503.us.archive.org · opened October 12, 2026
June 30, 2026: class certification argued June 12, 2026, ruling pending; post-certification deadlines stayed.
- [5]Plaintiffs' Amendment to Meta's Statement of Recent Decision (Dkt. 1411)
U.S. District Court, N.D. Cal., via RECAP archive · ia801503.us.archive.org · opened October 12, 2026
Sept. 2, 2026 filing confirming June 12, 2026 hearing and pending ruling.
- [6]Meta's Statement of Recent Decision (Dkt. 1413)
U.S. District Court, N.D. Cal., via RECAP archive · ia801503.us.archive.org · opened October 12, 2026
Sept. 23, 2026; latest filing opened; no certification ruling yet.
- [7]Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
HHS Office for Civil Rights · hhs.gov · opened October 12, 2026
OCR guidance on tracking technologies; notes June 20, 2024 partial vacatur in AHA v. Becerra.
- [8]American Hospital Association v. Becerra, Opinion & Order (ECF No. 67)
U.S. District Court, N.D. Tex., via GovInfo · govinfo.gov · opened October 12, 2026
June 20, 2024: 'Proscribed Combination' declared unlawful and vacated; injunction denied.
- [9]Meta Platforms, Inc. Form 10-Q for quarter ended March 31, 2026
SEC EDGAR · sec.gov · opened October 12, 2026
Lists In re Meta Pixel Healthcare Litigation among putative class actions alleging improper receipt of information via business tools; says several motions to dismiss were denied in whole or in part.