A class action lawsuit alleging the Meta pixel illegally collected patient data will move forward.

On Oct. 30, 2026, a federal judge certified four classes of Facebook users in a class action lawsuit against Meta Platforms Inc. in the U.S. District Court for the Northern District of California.

The lawsuit alleges Meta's tracking code collected patients' private health information from hospital and doctor websites without their consent.

The alleged data collection

Many health care providers installed the Meta Pixel, a piece of code that tracks what visitors do on a website, on their sites and patient apps, the proposed class action alleges. It claims that for most of the class period, the pixel's default settings sent Meta protected health information and that Meta never told providers to change those settings.

That information allegedly included:


  • Clicks to log in to patient portals

  • Clicks to book appointments and pay bills

  • Details about patients' doctors, conditions and treatments

  • Communications about prescription drugs

Meta reportedly matched the data to Facebook users and used it to improve its systems and serve ads. Users claim Meta promised it would not take this data unless its partners had the legal right to share it, which they say providers lacked under the Health Insurance Portability and Accountability Act.

The four certified classes

The lawsuit covers Facebook users from June 17, 2018, to the present:


  • The patient status button-click class covers users whose clicks on portal, appointment, bill payment or diagnostic buttons reached Meta.

  • The patient health information class covers users whose messages identifying a doctor, condition or treatment reached Meta.

  • The prescription drug information class covers communications with prescription drug websites for users who had a prescription for that drug.

  • The patient device intrusion class includes users whose devices received a Meta cookie or ran Meta code while on a provider's site.

The plaintiffs have 10 days from the Oct. 30 order to file revised class definitions, including a narrower device class that excludes two Meta tools they agreed never impacted users’ devices.

The legal claims

All four classes bring claims rooted in privacy and contract law:


  • Breach of contract, which covers broken promises

  • Breach of the implied covenant of good faith and fair dealing, which bars a party from undercutting a contract's purpose

  • Intrusion upon seclusion, which covers highly offensive invasions of privacy

  • California Comprehensive Computer Data Access and Fraud Act, which bars unauthorized access to computers and data

The first three classes also bring wiretapping claims under the federal Electronic Communications Privacy Act and the California Invasion of Privacy Act. The judge limited part of the California claim to communications made from California or with a California-based provider. The plaintiffs seek damages and a court order barring Meta from collecting health information on provider sites.

What the ruling means for Facebook users

Certification allows the case to move forward on behalf of everyone in the classes and not just the named plaintiffs. The plaintiffs must propose a plan for notifying class members within 30 days.

As of this writing, there is no settlement, no claims process and no money available.