On October 30, 2026, a federal court in California granted class certification to Facebook users who allege that Meta improperly collected sensitive healthcare information through tracking tools installed on healthcare websites and apps.
In In re Meta Pixel Healthcare Litigation, No. 22-cv-03580-WHO (N.D. Cal. Oct. 30, 2026), U.S. District Judge William Orrick rejected Meta’s primary arguments against class certification, allowing potentially millions of users to pursue privacy claims collectively rather than through individual lawsuits. Although the ruling does not determine Meta’s liability, it represents a significant development in privacy litigation involving third-party tracking technologies.
The Lawsuit Challenges Meta's Collection of Sensitive Healthcare Data
The lawsuit centers on the Meta Pixel, a tracking tool that businesses commonly install on websites to measure user activity and improve advertising.
Plaintiffs allege that Meta used its tracking technology to collect sensitive information from healthcare websites and apps, including patient portal activity, medical appointments, prescription drug information, and communications identifying medical conditions or treatments.
The court certified four classes covering Facebook users whose healthcare information Meta allegedly acquired or whose devices its tracking technology affected. The claims include alleged violations of the federal Electronic Communications Privacy Act, California Invasion of Privacy Act (“CIPA”), California’s computer data access law, and common law privacy and contract obligations.
Common Evidence May Support Class Certification Despite Differences in Tracking Practices
Meta argued that differences among healthcare websites, user consent disclosures, tracking configurations, and the information collected would require individualized inquiries, making class treatment inappropriate.
The court disagreed, finding that Meta confused the complexity of the litigation with the need for individualized proof.
Importantly, the court found that plaintiffs could use common evidence, including Meta’s default tracking settings, internal data, and expert analysis, to establish whether its technology collected protected healthcare information.
The court also concluded that variations in consent disclosures did not necessarily defeat class certification. Citing Calhoun v. Google, LLC, 113 F.4th 1141 (9th Cir. 2024), the court emphasized that consent must be actual and that disclosures must “explicitly notify” users of the conduct at issue. Whether a reasonable user understood those disclosures could be evaluated using common evidence rather than individual testimony.
Businesses Should Review What Tracking Tools Collect and Whether Disclosures Adequately Explain Those Practices
The ruling is particularly important for healthcare organizations and other businesses that collect or transmit sensitive personal information through third-party tracking technologies.
General disclosures about cookies or website analytics may not be sufficient to establish consent to the collection and sharing of sensitive information. Businesses must consider what information their tracking technologies actually collect, whether that information includes sensitive personal data, and whether their disclosures accurately explain those practices.
The broader takeaway is that standardized tracking practices can create classwide litigation exposure. Proactive audits of tracking technologies, data flows, and consent disclosures can help businesses identify and address privacy risks before they become the subject of litigation.