Key Points

  • The Fifth Circuit held that unauthorized disclosure of shoppers' health information to Meta through the Pixel is a concrete, particularized injury that confers Article III standing.
  • Information qualifies as individually identifiable health information under HIPAA's definition if it relates to a health condition or the provision of health care, and it need not reveal a specific diagnosis.
  • The Search Plaintiffs adequately alleged that their browsing and exam-scheduling activity on Eyemart's site was health information, and the court distinguished American Hospital Ass'n v. Becerra.
  • The district court erred by treating a sample screenshot in the complaint as dispositive, drawing inferences in Eyemart's favor and disregarding other allegations that the Prescription Plaintiffs' information reached Meta.
  • The panel reversed the with-prejudice dismissal and remanded for the district court to evaluate whether each claim's elements are adequately pleaded.

The U.S. Court of Appeals for the Fifth Circuit on Oct. 23 revived a proposed class action accusing Eyemart Express, an eyewear chain, of letting Meta Platforms collect customers' eyeglass purchases, prescriptions and eye-exam bookings through a tracking tool on its website.

Judge Stephen A. Higginson, writing for a panel that also included Circuit Judges Haynes and Ho, reversed a Northern District of Texas ruling that had dismissed the case with prejudice. The panel held that the five Facebook users who sued have standing, the constitutional threshold for bringing a case in federal court, and that their amended complaint plausibly alleged that Eyemart shared their health information with Meta.

The panel said it was not aware of any appeals court decision on tracking of health information by the Meta Pixel, code that websites install to report visitors' activity to Meta for ad targeting. The ruling extends to health data the reasoning of Second, Third, Sixth and D.C. Circuit decisions that treated online tracking of viewing histories and shopping data as a concrete injury. It also holds that health information need not reveal a diagnosis.

According to the complaint, whose allegations the court accepted as true at this stage, the Pixel on Eyemart's website sends users' searches, clicks, product views and appointment details to Meta, which builds profiles to serve targeted ads. The complaint alleges that Eyemart neither obtained users' consent nor told them about the tracking.

The plaintiffs sued under the Federal Wiretap Act, the Missouri Wiretap Act and the Illinois Eavesdropping Act, and they also asserted intrusion upon seclusion, a privacy tort, and breach of contract. One group, whom the opinion calls the "Search Plaintiffs," browsed and searched for prescription glasses, and one of them booked an eye exam that sent the store's name and location to Meta. The "Prescription Plaintiffs" bought eyewear and typed their prescriptions into the site.

The plaintiffs contend that the tracked data is "individually identifiable health information," or IIHI, as the Health Insurance Portability and Accountability Act of 1996 defines the term. HIPAA's definition covers information that relates to a person's health condition, health care or payment for care and that identifies the person. The plaintiffs brought no HIPAA claim, which the Fifth Circuit has held private parties cannot bring, and the court used the statute's definition because both sides and the trial judge had.

The district court found standing on Eyemart's first motion to dismiss and allowed an amendment. On the second motion, it dismissed the case in full, holding that the Search Plaintiffs had shared no IIHI with Eyemart and that the Prescription Plaintiffs had not shown their IIHI reached Meta. On appeal, Eyemart defended that ruling and asked, in the alternative, for dismissal on standing grounds.

The panel rejected the standing argument. Relying on the Supreme Court's 2021 decision in TransUnion LLC v. Ramirez, Higginson wrote that intangible harms resembling those long recognized at common law, including disclosure of private information, can support a lawsuit. The earlier circuit cases involved media consumption and shopping habits. Here, he wrote, "Plaintiffs allege unauthorized disclosure of their private health information, which is inherently sensitive and personal."

Higginson cited the D.C. Circuit's decision in Pileggi v. Washington Newspaper Publishing Co., which likened Pixel tracking to "a magazine seller nos[ing] around in someone's mailbox to learn what periodicals to press the owner to buy." Those analogies, he wrote, "apply with even more force to the disclosure of personal health information at issue here." The panel concluded, "We join the other courts to consider this issue in similar circumstances and find that Plaintiffs have suffered a cognizable injury in the unauthorized disclosure of their IIHI to Meta."

On the merits, Eyemart argued that the Search Plaintiffs "never alleged that they entered diagnoses or symptoms, or completed a transaction or appointment request, that inherently disclosed a condition." The panel responded that "IIHI is not so narrow" and held that such information "need not reveal a specific diagnosis or condition; that it pertains to a condition or provision of healthcare is sufficient." The opinion noted that Eyemart's lawyer conceded at oral argument that the data was individually identifiable because it was linked to Facebook users.

Eyemart relied on American Hospital Ass'n v. Becerra, a 2024 Northern District of Texas ruling that a Department of Health and Human Services bulletin exceeded the agency's authority because it "appeared to shoehorn additional information into the IIHI definition." The panel distinguished that case because the technology there linked only an IP address to a site visit. The Eyemart complaint alleges that Meta captured searches for specific products and providers and paired them with Facebook profiles.

The panel also faulted the trial court's treatment of the Prescription Plaintiffs. That court relied on a sample screenshot, created by a plaintiffs' attorney, of data from an "AddToCart" event showing a content ID, a frame material, a fulfillment vendor and a price. Higginson wrote that the judge drew inferences from the image "in the light most favorable to Eyemart, rather than to Plaintiffs," and treated a figure offered "[b]y way of example" as dispositive. "This limited focus defies the well-established Rule 12(b)(6) dismissal standard," he wrote.

Read as a whole, the panel held, the complaint alleges that Meta received data about the vision products the plaintiffs viewed, their prescription eyewear purchases and their appointment details. It also alleges that Eyemart uploads customer lists with email addresses and purchase information so Meta can match shoppers to Facebook profiles. Higginson added that "without the benefit of discovery, Plaintiffs cannot be expected to know much more at this early stage."

The case returns to the Northern District of Texas, where the district court will decide whether the plaintiffs adequately pleaded the elements of each wiretap, tort and contract claim. The opinion said, "If the district court finds that Plaintiffs have adequately pled the elements of their claims, discovery will be necessary to test those allegations."