A California federal judge has allowed Facebook users to pursue privacy claims as a class against Meta Platforms over allegations that the company collected sensitive medical information from healthcare websites without patients’ consent, including details about appointments, medical conditions, treatments and prescription drugs. The ruling allows the claims to proceed collectively but does not determine that Meta unlawfully collected or used the information.
U.S. District Judge William H. Orrick certified four classes of Facebook users in an October 30, 2026, ruling, allowing privacy claims involving Meta’s tracking technology to move forward. The proposed class period begins June 17, 2018, potentially involving millions of interactions with healthcare websites and apps.
The lawsuit centers on Meta Pixel, tracking code that websites use to measure visitor activity and support advertising. The users allege that when patients performed ordinary tasks such as scheduling appointments, logging into health portals, paying medical bills or searching for treatment, information about those interactions was transmitted to Meta.
According to the plaintiffs, those transmissions could reveal a person’s healthcare provider, medical condition, treatment or prescription medication. They claim Meta obtained the information through tracking tools embedded in healthcare websites and applications.
The four certified classes include Facebook users whose appointment, diagnostic-assessment or billing activity was allegedly obtained by Meta; users whose communications identified doctors, conditions or treatments; people whose interactions with prescription-drug websites were collected; and users whose devices were allegedly accessed through Meta tracking technology.
Meta opposed certification, arguing that differences in website configurations, patient consent and the information transmitted would require individual examinations of users’ claims. The company also challenged whether its available records could reliably identify affected patients and healthcare providers across the period covered by the lawsuit.
Orrick found that Meta was treating the case’s complexity as though it necessarily required each user’s claim to be decided separately. He concluded that the plaintiffs had proposed workable methods for addressing common questions across the certified classes.
The judge also declined to exclude the users’ expert witnesses, leaving Meta free to challenge their conclusions through cross-examination and later stages of the case.
Meta did win limits on two portions of the lawsuit. Orrick restricted claims under California’s wiretapping law to communications with a sufficient connection to California and narrowed the class alleging unauthorized device access to conduct that actually involved users’ devices.
The lawsuit includes claims under federal electronic communications law, California privacy and computer-access statutes, and Meta’s contractual obligations to Facebook users. Plaintiffs also allege intrusion upon seclusion, a privacy claim involving intentional interference with activities a person reasonably expects to remain private.
The judge also ordered the release of general information describing how Meta’s systems obtained healthcare data, matched it to Facebook users and potentially used it to improve advertising. Sensitive technical details, including certain source code, may remain confidential.
Attorneys representing the Facebook users must submit revised class definitions consistent with the ruling within 10 days and propose a plan for notifying class members within 30 days, unless the court approves extensions. The court will then determine how notice will be provided and what options affected Facebook users will have as the litigation moves forward.
There is no settlement or finding of liability at this stage.
