Consent and prescription data
In a separate case involving the telehealth site BlueChew, Google and Meta failed to win dismissal of privacy claims by arguing that users had agreed to the collection of their personal information. The July 14, 2026, ruling by the U.S. District Court for the Northern District of California allowed claims over the alleged collection of patients' prescription data to proceed, according to Tech Times.
The court found that privacy policies written by and for platform operators did not provide the specific, informed agreement required for health data. Its decision opened the way for discovery against the companies providing the pixels.
The BlueChew complaint alleges that Meta's Facebook Pixel sends data as soon as a page loads, before a consent screen appears and without the visitor doing anything beyond navigating to the site. The information allegedly sent to Meta includes a Facebook ID, the page's URL, an IP address and an identifier tied to a particular medication SKU. For example, content ID "1" identifies a six-pack of 30 mg sildenafil.
The plaintiffs are seeking relief under the California Invasion of Privacy Act. Tech Times' analysis says the law provides statutory damages of $5,000 for each violation without requiring proof of actual harm.
October rulings in other tracking cases
Other health-data tracking cases advanced in October. On October 23, 2026, the U.S. Court of Appeals for the Fifth Circuit reinstated the proposed class action Rand v. Eyemart Express, L.L.C., reversing its dismissal and returning it for further proceedings, according to Privacy World, a Squire Patton Boggs publication.
The appeals court found that the plaintiffs had Article III standing. It also held that information about their browsing, purchases and appointment scheduling could plausibly qualify as individually identifiable health information under HIPAA's definition.
On October 30, U.S. District Judge William Orrick in the Northern District of California certified four classes in the consolidated In re Meta Pixel Healthcare Litigation. The classes encompass Facebook users whose health-related information or online activities Meta allegedly collected from June 17, 2018, to the present, according to GovInfoSecurity, an ISMG publication. Meta said it disagreed with the certification decision and would seek to appeal.
Warnings, settlements and declining pixel use
Federal regulators had warned healthcare organizations about tracking pixels in 2023. That July, the FTC and HHS jointly alerted approximately 130 hospital systems and telehealth providers to the privacy risks. In a September bulletin, the FTC said HIPAA-regulated entities violate the FTC Act when they use tracking pixels for marketing without proper patient authorization, Tech Times reported.
Feroot Security examined 19 cases from 2023 through 2025 and found more than $100 million in tracking-pixel-related penalties and settlements paid by U.S. hospitals, telehealth platforms and digital health apps. The amounts included $12.25 million for Advocate Aurora Health, involving approximately 2.5 million patients; $18.4 million for Mass General Brigham; $7.8 million for BetterHelp; and $25 million for GoodRx.
Pixel use has also declined, according to an analysis by Jenny Bristow, chief executive of health marketing firm Hedy & Hopp. More than 98% of U.S. hospitals used website tracking pixels in 2021, compared with 55% in 2024 and 30% in 2025. The share of providers that had removed every pixel from their websites rose from 12% in 2024 to 28% in 2025.
