Background
Five Facebook users filed a putative class action alleging that Eyemart Express placed Meta’s tracking Pixel on its website without notifying users or obtaining their consent. According to the amended complaint, the Pixel transmitted information about users’ searches for prescription eyewear, prescription purchases, and efforts to schedule eye examinations, which Meta could combine with information from their Facebook accounts to identify them and target advertisements.
The plaintiffs asserted claims under the Federal Wiretap Act, the Missouri Wiretap Act, and the Illinois Eavesdropping Act, along with intrusion-upon-seclusion and contract claims. The district court dismissed the case with prejudice, concluding that the plaintiffs who searched or scheduled appointments had not alleged that they shared individually identifiable health information, or IIHI, with Eyemart and that the plaintiffs who entered prescription information had not adequately alleged that Eyemart disclosed IIHI to Meta.
The Court’s Holding
The Fifth Circuit first held that the plaintiffs had Article III standing. The alleged unauthorized disclosure of identifiable health information was a concrete and particularized injury closely related to harms traditionally addressed by intrusion upon seclusion and public disclosure of private facts. The alleged injury was traceable to Eyemart’s use of the Pixel and redressable through the requested damages and injunctive relief.
The panel then held that the district court erred in its threshold IIHI determinations. At the pleading stage, the search plaintiffs plausibly alleged that their browsing and appointment-scheduling activity related to their health or the provision of healthcare and became individually identifiable when paired with Facebook information. The prescription plaintiffs likewise plausibly alleged that Eyemart transmitted IIHI to Meta. The district court improperly treated IIHI as limited to specific prescription details, drew inferences against the plaintiffs from a demonstrative screenshot, and failed to evaluate the amended complaint as a whole.
The court reversed and remanded, but it did not decide whether the plaintiffs adequately pleaded every element of their wiretap, eavesdropping, tort, or contract claims. The district court must assess those claims on remand, and discovery will be necessary only if it finds the relevant claims adequately pleaded.
Key Takeaways
- Unauthorized disclosure of identifiable health information to an online tracking company can constitute a concrete privacy injury sufficient for Article III standing.
- At the pleading stage, browsing prescription products and scheduling eye care may qualify as IIHI when the activity relates to health or healthcare and can be linked to an identified person.
- A court evaluating a Rule 12(b)(6) motion must consider the complaint as a whole and draw reasonable inferences for the plaintiffs rather than treating a limited illustrative screenshot as dispositive.
- The Fifth Circuit resolved only the threshold standing and IIHI issues; it left the legal sufficiency of each substantive claim for the district court on remand.
Why It Matters
The decision provides Fifth Circuit guidance on privacy suits involving tracking pixels used by healthcare-related websites. It recognizes that health-related browsing and scheduling data need not disclose a specific diagnosis or prescription to plausibly constitute IIHI when the data relates to healthcare and is linked to an identifiable user.
The ruling also marks an important procedural limit: it removes the district court’s stated grounds for dismissing the entire action, but does not itself establish liability or determine that any statutory, tort, or contract claim survives dismissal on all other grounds.