In Re Meta Pixel Healthcare Litigation

Background

The case involves four anonymous Facebook users who sued Meta Platforms, Inc. They alleged that healthcare providers had installed Meta’s Pixel code on patient-portal or related websites and that the Pixel transmitted information to Meta when users logged in or browsed those sites. According to the plaintiffs, the transmitted information could reveal a person’s patient status, medical providers, doctors, conditions, and appointments. They alleged that Meta used the information for targeted advertising and brought eight federal and state claims, including contract, privacy, electronic-communications, California unfair-competition, misrepresentation, and trespass claims.

The plaintiffs sought a preliminary injunction—an immediate court order issued before final judgment—prohibiting Meta from intercepting patient information and communications from entities covered by the Health Insurance Portability and Accountability Act (HIPAA), and from using or sharing information it had intercepted. The motion relied on claims under the federal Electronic Communications Privacy Act (ECPA), the California Invasion of Privacy Act (CIPA), and California tort law.

Legal Standard

The court applied the four preliminary-injunction factors: likely success on the merits, likely irreparable harm without an injunction, the balance of harms between the parties, and the public interest. Because the requested injunction would require Meta to take affirmative action rather than merely preserve the existing situation, it was a mandatory injunction. The court explained that such relief requires a clear showing that the law and facts favor the plaintiffs, not merely a showing that they are likely to succeed.

Merits Analysis

The court rejected Meta’s argument that a future consolidated complaint made the motion moot. It then found that the Pixel appeared to transmit information showing patient status. The court also concluded that patient status appeared to qualify as protected health information under HIPAA because it connected an identifiable person with healthcare services.

The court found that Meta’s general disclosures about collecting personal data and information about activity on third-party websites likely did not establish consent to collecting health information from interactions with medical providers. The court also noted that Meta’s policies required business partners to have lawful rights to share data and directed them not to share information they knew or reasonably should know included health information. In the court’s view, these provisions made it unlikely that Meta could establish that the plaintiffs consented to the specific conduct alleged.

For the ECPA claim, the court found that the plaintiffs had made a strong showing on the elements that Meta intentionally intercepted electronic communications using a device and that the transmitted login information and detailed website addresses likely constituted the communications’ “contents.” The court recognized, however, that Meta might invoke the ECPA’s one-party-consent exception because healthcare providers that configured the Pixel presumably consented to Meta’s receipt of the information. The plaintiffs therefore would need to show that Meta intercepted the information for the purpose of committing a crime or tort. The court found a meaningful possibility that they could do so, but was not convinced that they had satisfied the heightened standard for a mandatory injunction.

The court likewise found that the plaintiffs would likely establish the elements of CIPA’s wiretapping claim. It also concluded that the medical communications were likely confidential under CIPA because communications between patients and medical providers are different from ordinary internet communications and involve especially personal information. The court found the plaintiffs’ intrusion-upon-seclusion and invasion-of-privacy claims appeared fairly strong, including on the issues of a reasonable expectation of privacy and whether the alleged conduct was highly offensive. These were preliminary assessments, not final determinations of liability.

Irreparable Harm

The court agreed that the alleged invasion of privacy was an intangible injury that could not be fully remedied with damages. It rejected Meta’s arguments that the plaintiffs had waited too long to seek relief or could avoid injury by disconnecting their off-Facebook activity. The court noted that Meta did not claim its tools could stop information from being sent to Meta in the first place. It also found that Meta was causally connected to the alleged injury because Meta acknowledged it could block data from particular websites or Pixel identification numbers.

Balance of Equities and Public Interest

The court held that the plaintiffs had not shown that the balance of equities favored an injunction. Meta presented evidence about its filtering system, which was designed to detect and block potentially sensitive health data from being used in advertising systems. The court stated that the record did not yet establish how many healthcare systems were using the Pixel, how much health information passed through the filter, how effective the filter was, or whether the plaintiffs’ proposed technical solutions were feasible. Discovery could clarify those issues, and the balance might change as the factual record developed.

The court similarly found that the public interest did not currently favor an injunction. Although the public has a strong interest in protecting privacy and health information, the court was not persuaded that the public interest supported imposing a mandatory injunction before the relevant factual and technical questions were resolved.

Disposition

Judge William H. Orrick denied the plaintiffs’ motion for a preliminary injunction. The order did not finally resolve the plaintiffs’ claims or determine whether Meta was liable. The classification is procedural because the order ruled on temporary, ancillary relief rather than entering a final merits judgment.