Limits on the certification ruling
Meta opposed certification on the grounds that the information collected, patients' consent and healthcare providers' use of tracking tools differed across the case. Orrick rejected those arguments against allowing the claims to proceed on a classwide basis.
The ruling confines claims under California's wiretapping law to communications connected to California. It also excludes from the device-intrusion class any collection methods that did not involve patients' devices.
The case, In re Meta Pixel Healthcare Litigation, was filed on June 17, 2022, against Meta Platforms, Inc. The consolidated action is before Judge William H. Orrick III in the San Francisco Division of the U.S. District Court for the Northern District of California, under case No. 3:22-cv-03580-WHO (VKD). The complaint alleges that at least 664 hospital systems or provider web properties used the Meta Pixel.
The four proposed classes
The plaintiffs' certification motion proposed a class period beginning June 17, 2018, and continuing to the present. It grouped Facebook users according to the information Meta allegedly received or the use of their devices.
The proposed Patient Status Button-Click Class covered users whose clicks on patient-portal, medical-appointment, bill-payment or diagnostic-assessment buttons at class healthcare providers were obtained by Meta. At least one such click was required. The Patient Health Information Class instead concerned users for whom Meta acquired at least one communication or fact identifying a doctor, condition or treatment, excluding button-click events.
The Prescription Drug Information Class concerned users whose communications with a website for a drug they had been prescribed were obtained by Meta. For the Patient Device Intrusion Class, the proposed definition covered users whose devices Meta used to place an _fbp cookie, supply computing resources, or both, at a healthcare provider property. Orrick's ruling narrowed that device class as described above.
For all four groups, the plaintiffs requested certification of claims for breach of contract, breach of the implied covenant of good faith and fair dealing, intrusion upon seclusion, and violations of the California Comprehensive Computer Data Access and Fraud Act (CDAFA). For the first three groups, they also sought class treatment under the federal Electronic Communications Privacy Act (ECPA) and the California Invasion of Privacy Act.
Earlier challenges to the lawsuit
The litigation reached certification after surviving two rounds of dismissal motions. On September 7, 2023, Orrick let claims under the federal Wiretap Act, part of ECPA, and the California Invasion of Privacy Act move forward, along with claims for breach of contract, breach of the implied covenant and unjust enrichment. Several other claims were dismissed with permission to amend.
Orrick denied a second dismissal motion in January 2024, allowing additional claims involving invasion of privacy, CDAFA and trespass to chattels to proceed.
Decisions in other tracking cases
Other litigation involving Meta's tracking technology has produced different outcomes. In Frasco v. Flo Health, Inc., heard by Judge James Donato in the Northern District of California, a jury on August 1, 2025, found Meta liable under Section 632 of the California Invasion of Privacy Act for a California subclass of Flo app users.
Class certification was denied in the related In re Meta Pixel Tax Filing Cases in the same court on March 30, 2026. The court concluded that identifying who qualified under the original class definition overwhelmed the questions common to the class.
A separate hospital-tracking case turned on the wording of Washington's privacy law. On October 8, 2026, the Washington Supreme Court unanimously upheld dismissal of Washington Privacy Act claims in Baker v. Seattle Children's Hospital. The court held that one person interacting with a corporation's automated website did not amount to a communication "between two or more individuals" as required by the statute.
