Reported / Citable
Background
Five Facebook users brought a putative class action alleging that Eyemart Express used Meta’s Pixel on its website to transmit their browsing, prescription-eyewear, and eye-exam scheduling information to Meta without their knowledge or consent. They asserted claims under the Federal Wiretap Act, the Missouri Wiretap Act, the Illinois Eavesdropping Act, intrusion upon seclusion, and contract law. Although they did not assert a HIPAA claim, they relied on HIPAA’s definition of individually identifiable health information to characterize the allegedly disclosed data.
The district court held that the plaintiffs had Article III standing but dismissed the amended complaint with prejudice. It concluded that the plaintiffs who searched for eyewear or scheduled an exam had not alleged that they shared individually identifiable health information with Eyemart, and that the plaintiffs who supplied prescription information had not adequately alleged that Eyemart disclosed such information to Meta.
The Court’s Holding
The Fifth Circuit agreed that the plaintiffs had standing. Accepting the complaint’s allegations as true, the court held that the alleged unauthorized transmission of identifiable health information to Meta was a concrete and particularized injury closely related to harms traditionally addressed by intrusion upon seclusion and public disclosure of private facts. The alleged injury was also traceable to Eyemart and redressable through the requested damages and injunctive relief.
The panel held that the district court erred in both threshold pleading determinations supporting dismissal. The search plaintiffs plausibly alleged that their product browsing and appointment scheduling related to their health or the provision of healthcare and became individually identifiable when Meta paired the data with their Facebook information. The plaintiffs also plausibly alleged that Eyemart transmitted their identifiable health information to Meta through the Pixel and uploaded customer lists. The district court improperly treated a demonstrative screenshot as dispositive, drew inferences against the plaintiffs, and failed to assess the amended complaint as a whole.
The court reversed the dismissal and remanded. It did not decide whether the plaintiffs adequately pleaded every element of their statutory, tort, and contract claims. The district court must address those questions on remand, and discovery will be necessary only if it determines that the claims are adequately pleaded.
Key Takeaways
- Unauthorized disclosure of identifiable health information to an online tracking company can constitute a concrete Article III injury analogous to traditional privacy harms.
- At the pleading stage, browsing prescription products and scheduling an eye exam can plausibly convey health-related information even without revealing a specific diagnosis.
- A court evaluating a Rule 12(b)(6) motion must consider the complaint as a whole, draw reasonable inferences for the plaintiffs, and not treat a limited demonstrative example as overriding broader factual allegations.
- The Fifth Circuit resolved only the standing and threshold information-sharing issues; it left the sufficiency of the remaining elements of each cause of action to the district court.
Why It Matters
The decision recognizes that website activity involving healthcare products and services may qualify as identifiable health information when tracking technology links that activity to a particular person. It also reinforces that plaintiffs may rely on plausible factual allegations about tracking practices before discovery reveals the precise data transmitted.
The ruling does not establish liability or hold that the wiretapping, privacy, or contract claims are otherwise sufficient. It requires the district court to reconsider those claims without relying on the two threshold pleading conclusions the Fifth Circuit rejected.