Estimated reading time: 8 minutes.
Key facts
- Case: In re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580-WHO, U.S. District Court for the Northern District of California.
- Ruling: On October 30, 2026, U.S. District Judge William H. Orrick granted the plaintiffs' motion for class certification, with two limits.
- Who is covered: Facebook users whose health-related activity on healthcare provider websites or apps was allegedly obtained by Meta, from June 17, 2018, onward. Final class wording is still being revised.
- What is alleged: That the Meta Pixel and related Meta Business Tools sent patients' protected health information to Meta without consent. Meta denies wrongdoing.
- What changed: Users can now pursue their claims as a group instead of one by one. The ruling does not decide whether Meta broke the law.
- Money: No settlement, fund or claim form exists. No court has awarded damages.
- Next steps: Plaintiffs must file revised class definitions within 10 days and a proposed notice plan within 30 days of the order.
In this article
- What the judge decided
- How the Meta Pixel works
- The four certified classes
- The laws behind the claims
- What Meta argued
- Where the judge drew limits
- Case timeline
- What this means for patients
- What happens next
- Frequently asked questions
A federal judge in San Francisco has allowed Facebook users to sue Meta Platforms as a group over claims that its tracking code collected their health information from hospital and other healthcare websites. The 37-page order, filed October 30, 2026, certifies four classes of users in a case that has been running since June 2022.
Class certification is a procedural step, not a verdict. It means the case can be tried on behalf of large groups of people at once. Every claim below is still an allegation that Meta disputes.
What the judge decided
Judge William H. Orrick granted the motion "except for the limited Section 631 and redefined CDAFA class," two narrower adjustments explained below. He certified the classes under two parts of Federal Rule of Civil Procedure 23. Rule 23(b)(3) covers classes seeking money, and Rule 23(b)(2) covers classes seeking a court order that changes how a company behaves.
The judge rejected Meta's main argument that too many questions would need to be answered person by person. He wrote that Meta's opposition "confuses complexity," which he said the case "undoubtedly" presents, with "individualized questions." He added that "various accepted case management strategies can handle the complexity of this case."
He also denied Meta's motions to exclude the plaintiffs' expert witnesses, in some cases leaving Meta free to raise objections again at trial. He said the debate between the two sides' experts was significant but "provides grounds for cross-examination and not exclusion."
What changed on October 30 Facebook users in the defined groups can now pursue their claims together. The order does not find that Meta did anything wrong, and it does not create a payment.
How the Meta Pixel works
Meta Platforms, Inc. owns Facebook and Instagram and offers free advertising tools that businesses add to their own websites and apps. The best known is the Meta Pixel, a small piece of code that, according to a 2022 investigation by The Markup, logs which pages a visitor views, which buttons they click and certain information they type into forms. The website owner gets analytics and the ability to target ads on Facebook and Instagram to people who visited its site.
The lawsuit focuses on healthcare providers that used these tools. In June 2022, The Markup reported that it tested the websites of Newsweek's top 100 U.S. hospitals and found the Meta Pixel on 33 of them sending Facebook data when a visitor clicked a button to schedule a doctor's appointment. The first complaint in this case was filed the next day, on June 17, 2022.
The plaintiffs say Meta's default settings caused providers' sites to send protected information automatically, and that Meta never told providers to change those defaults. The order notes an expert's citation to academic research finding that one automatic data-collection setting, called Automatic Events, was active on 99.6% of healthcare websites from 2019 to 2022. Meta disputes how much protected data it actually received and points to filters it says were meant to block sensitive information. The judge said those disputes turn on common evidence that can be tested at summary judgment or trial.
The four certified classes
The plaintiffs proposed four classes, all covering a period from June 17, 2018, to the present:
- Patient Status Button-Click Class: Facebook users who had at least one patient portal, medical appointment, bill payment or diagnostic assessment button click obtained by Meta from listed healthcare providers.
- Patient Health Information Class: Facebook users who had at least one communication or fact identifying a doctor, condition or treatment acquired by Meta from listed healthcare providers.
- Prescription Drug Information Class: Facebook users whose communications with a prescription drug website for a drug they were prescribed were obtained by Meta.
- Patient Device Intrusion Class: Facebook users whose devices Meta allegedly used, by placing a cookie called "_fbp" or running its code, while they were on a healthcare provider's site.
The "listed healthcare providers" are entities on a list the plaintiffs filed, which the order describes as entities covered by HIPAA. The judge granted the plaintiffs' request to file a revised version of that list.
Who may be included You must have been a Facebook user, and your activity on a covered provider's site must have reached Meta. Final definitions are due within 10 days, so check the court-approved notice before assuming you are in or out.
The laws behind the claims
All four classes bring claims for breach of contract and breach of the implied covenant of good faith, based on promises the plaintiffs say Meta made to users in its terms. They also bring intrusion upon seclusion, a privacy claim for highly offensive intrusion into private matters, and claims under California's Comprehensive Computer Data Access and Fraud Act (CDAFA), a state law against unauthorized use of someone's computer or device.
The first three classes also bring claims under the federal Electronic Communications Privacy Act (ECPA), often called the federal Wiretap Act, and the California Invasion of Privacy Act (CIPA), a state law against intercepting communications without consent.
The Health Insurance Portability and Accountability Act (HIPAA) limits how hospitals and other covered entities share patient information. HIPAA does not let individuals sue, and the plaintiffs bring no HIPAA claim. The judge said HIPAA is still relevant to what a reasonable consumer would expect and to how Meta's contract promises should be read.
What Meta argued
According to the order, Meta argued that a class trial would be unmanageable because:
- Hospitals and app developers configured the Pixel differently, and some say they never used it.
- Meta's standard data retention means its oldest classwide data dates from March 2022, while the classes reach back to June 2018.
- Each provider gave patients different disclosures, which Meta said raises individual consent questions.
- Some users visited health sites for a family member, did general research or used ad blockers.
The judge called many of these examples "de minimis," meaning too small to matter at this stage. On consent, he followed a Ninth Circuit standard that asks what a reasonable user would understand from the disclosures, a question common to the class. He added that the plaintiffs "will have to make choices on how to try this case."
Where the judge drew limits
Two parts of the request were narrowed.
California connection for wiretap claims. Section 631 of CIPA and the CDAFA require a link to California. For the Section 631 claim, the judge agreed with the plaintiffs' fallback proposal: subclasses of patients who either communicated from California or exchanged a communication with a California-based healthcare provider. He found the plaintiffs had made a plausible showing of a California link for the CDAFA claim.
Device class. Meta argued that two of its tools, Conversions API and customer list uploads, send data from a business's servers and do not touch patients' devices. The plaintiffs agreed and will amend the device class to remove them.
What remains undecided Whether Meta actually received each type of protected data, whether users consented, and whether any damages are owed are all open questions for summary judgment or trial.
Case timeline
- June 17, 2022: The first case is filed, a day after The Markup's report.
- December 21, 2022: The court appoints interim co-lead class counsel, according to Cohen Milstein, one of the firms.
- September 7, 2023, and January 29, 2024: The court denies parts of Meta's motions to dismiss, according to Cohen Milstein, allowing contract, ECPA, privacy and CDAFA claims to continue.
- April 10, 2025: A magistrate judge orders a limited deposition of Meta CEO Mark Zuckerberg, according to Cohen Milstein.
- October 30, 2026: Judge Orrick grants class certification.
What this means for patients
Nothing is payable now. There is no settlement, no claims administrator and no claim form. If the certification order stands, the court will approve a notice telling class members what the case is about and how to stay in or opt out.
The judge did note the stakes. Discussing whether a class action is the best way to handle the case, he wrote that "$5,000 in statutory damages" would be "by no means insignificant," while stressing that he was assuming, not deciding, that statutory damages under CIPA or another law are appropriate. That is not an award or an estimate of what anyone will receive.
Some hospitals have settled their own pixel cases separately, including Bayhealth and Duke Health. Those settlements involve the providers, not Meta. You can see open cases on our list of class action cases you can join. This article is for information only and is not legal advice.
What happens next
Within 10 days of the order, the plaintiffs must file revised class definitions after conferring with Meta. Within 30 days, they must submit a proposed notice plan and notice forms. The parties also have 30 days to narrow what remains sealed in the class certification record.
Under Federal Rule of Civil Procedure 23(f), a party may ask the U.S. Court of Appeals for the Ninth Circuit for permission to appeal a class certification order within 14 days after it is entered. We found no public statement from Meta on whether it will seek an appeal. We will update this story as the case moves forward.
Frequently asked questions
What did the judge rule in the Meta Pixel healthcare case?
On October 30, 2026, Judge William H. Orrick certified four classes of Facebook users who say Meta collected their health information through tracking tools on healthcare websites and apps, with narrower limits on two claims.
Does this mean Meta lost the lawsuit?
No. Class certification only lets the claims proceed as a group. Meta denies the allegations, and no court has found it liable.
Who is in the class?
Facebook users whose patient portal clicks, appointment or bill-payment clicks, doctor, condition, treatment or prescription information from covered providers was allegedly obtained by Meta from June 17, 2018, onward, plus a device-based class. Final wording is being revised.
Is there a Meta Pixel settlement or claim form?
No. There is no settlement in this case and no claim form. Be cautious of anyone asking for payment or personal details to "join."
How will I know if I am a class member?
The court must approve a notice plan. The plaintiffs must propose one within 30 days of the October 30 order, and approved notices will explain who is included and how to opt out.
Can Meta appeal the class certification order?
Federal rules let a party ask the Ninth Circuit for permission to appeal a class certification order within 14 days after entry. Whether Meta will do so was not known at publication.
