Judge lets patients sue Meta as a group over hospital website tracking

A federal judge has let patients sue Meta as a group over a tracking tool on healthcare websites. On October 30, 2026, Judge William Orrick certified four classes of Facebook users. They say Meta collected their sensitive data from June 17, 2018, to the present. Meta disagrees and plans to appeal.

What the tool is

The tool is called the Meta Pixel. It is a small piece of code that website owners can add to their sites and apps. The patients say it sent details about their visits to Meta without their knowledge or consent. They say Meta then used the data for targeted ads on its own sites and elsewhere on the web.

What patients claim

The lawsuits were combined into one case in federal court in Northern California. Plaintiffs say the data included personal details, medical conditions, prescriptions and contact with healthcare providers. They say it identified people as patients. They have named more than 660 hospital systems and medical providers that added the Pixel to their websites and apps.

• Breach of contract and breach of implied contract
• Intrusion upon seclusion, a claim about invading someone's privacy
• Violations of California computer data access and fraud law
• Violations of federal and California wiretapping-style privacy laws, in three of the classes

What this does not mean

Class certification is only one step. The judge has not decided whether Meta broke any law. Meta twice asked the court to throw the case out, and the case was allowed to go forward both times.

The suit also does not claim violations of HIPAA, the federal health privacy law. Patients cannot sue under HIPAA directly. The judge did say HIPAA helps show what a reasonable user would expect, and how to read Meta's promises about partners having lawful rights to the data.

What happens next

Meta plans to appeal the ruling. If the appeal fails, the classes will need to be refined and a plan for notifying members agreed. Class members will then be able to stay in or opt out. Most certified class actions of this kind have ended in settlements rather than trials, according to the report.

What to do

The case shows how a health portal or pharmacy site can share visit details with an ad company through a hidden tracker. Reading the privacy notice and checking the privacy settings on those sites is a reasonable first step.