On Friday the U.S. Court of Appeals for the Fifth Circuit revived a putative privacy class action alleging that an optical retailer disclosed customers’ health-related website activity to Meta Platforms, Inc. through the Meta Pixel without their knowledge or consent.
In its October 23, 2026, published decision in Rand v. Eyemart Express, L.L.C., the court held that the plaintiffs had Article III standing, that their browsing, purchasing, and appointment-scheduling activity plausibly constituted individually identifiable health information (“IIHI”), and that they plausibly alleged Eyemart shared that information with Meta. The court reversed the dismissal of the case and remanded it for further proceedings.
Although the decision arose at the pleading stage and does not resolve the ultimate merits, it may significantly affect litigation involving tracking technologies on websites offering health-related products or services, and it expands the case law relied upon by the plaintiffs’ bar in bringing these cases.
The Allegations Against Eyemart
Eyemart operates physical stores and a website through which customers may browse eyewear, purchase prescription glasses, and schedule eye examinations. According to the plaintiffs’ complaint, Eyemart installed the Meta Pixel on its website, allowing information about users’ searches, clicks, product views, purchases, and appointment-scheduling activity to be transmitted to Meta.
The plaintiffs were Facebook users and alleged that Meta could combine information collected from Eyemart’s website with identifying information associated with their Facebook accounts. They contended that this allowed Meta to associate particular users with their health-related website activity and use that information for targeted advertising. They also alleged that Eyemart uploaded customer lists to Meta, including email addresses and the prescription eyewear customers purchased or viewed, so that Meta could match users to their Facebook profiles.
The plaintiffs asserted claims under the federal Wiretap Act, the Missouri Wiretap Act, the Illinois Eavesdropping Act, and common-law claims for intrusion upon seclusion and breach of contract. They did not bring a claim directly under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), which does not provide a private right of action. Instead, they relied in part on HIPAA’s statutory definition of IIHI to characterize the information allegedly transmitted.
The district court dismissed the amended complaint with prejudice. It concluded that plaintiffs who browsed and searched for prescription eyewear, one of whom also scheduled an eye examination, had not adequately alleged that they provided health information to Eyemart. It also determined that plaintiffs who entered prescription information had failed to plausibly allege that their health information was transmitted to Meta. The Fifth Circuit rejected both conclusions.
Unauthorized Disclosure of Health Information Can Establish Article III Standing
The Fifth Circuit first held, agreeing with the district court, that the plaintiffs adequately alleged a concrete and particularized injury sufficient to establish Article III standing.
The court reasoned that the alleged unauthorized disclosure of private health information was sufficiently analogous to harms traditionally addressed by the common-law torts of intrusion upon seclusion and public disclosure of private facts. A plaintiff does not need to establish every element of a comparable common-law tort to demonstrate standing. Instead, the alleged harm must be similar in kind to a harm traditionally recognized by the common law.
In reaching that conclusion, the Fifth Circuit joined other federal appellate courts that have recognized standing based on the alleged unauthorized disclosure of identifiable online viewing, browsing, or purchasing activity. The court noted that those cases involved media-consumption and shopping data, and concluded that analogies drawn in one of them—the D.C. Circuit’s 2025 decision in Pileggi v. Washington Newspaper Publishing Co., which likened Pixel tracking to a magazine seller nosing through someone’s mailbox—apply “with even more force” to personal health information.
Standing has been a recurring threshold issue in website-tracking and digital privacy litigation following the Supreme Court’s decision in TransUnion LLC v. Ramirez. Under Rand, an alleged disclosure of identifiable health-related activity to a third party may itself be sufficient to establish a concrete injury, even if the plaintiff does not allege identity theft or financial loss.
The decision does not, however, establish that Eyemart violated any of the laws asserted in the complaint. On remand, the district court must address whether the plaintiffs have adequately pleaded the remaining elements of their claims.
Browsing Activity May Qualify as Health Information
The court’s treatment of browsing and appointment-scheduling activity may be particularly consequential for companies using online tracking technologies.
The plaintiffs fell into two groups:
- “Search Plaintiffs,” who allegedly browsed and searched for prescription eyewear, one of whom also used the website to schedule an eye examination; and
- “Prescription Plaintiffs,” who allegedly purchased prescription eyewear and entered prescription-related information.
The Fifth Circuit held that the Search Plaintiffs plausibly alleged the disclosure of IIHI even though they had not necessarily entered a diagnosis, symptom, or prescription. The court explained that IIHI is not limited to information revealing a specific medical condition. Under HIPAA’s definition, information may qualify if it is created or received by a health care provider, health plan, employer, or health care clearinghouse; relates to an individual’s health, the provision of health care, or payment for health care; and identifies the individual or reasonably can be used to do so.
Because Eyemart allegedly provided health-related products and services, the court concluded at the pleading stage that activity involving prescription eyewear and eye-examination scheduling could relate to an individual’s health or the provision of health care. Because Meta allegedly could associate that activity with particular Facebook users, the information was plausibly identifiable.
The court distinguished American Hospital Ass’n v. Becerra, a 2024 Northern District of Texas decision that invalidated Department of Health and Human Services guidance treating an IP address combined with a visit to a health-related webpage as IIHI. Becerra involved only an IP address linked to a website visit, whereas the plaintiffs here alleged that a third party received detailed information about specific products or services and could connect that activity to an existing user profile. That distinction suggests that courts may evaluate the complete alleged data flow, rather than assessing individual data elements in isolation.
The Fifth Circuit also held that the district court had evaluated the Prescription Plaintiffs’ allegations too narrowly. The district court focused on a demonstrative screenshot included in the complaint, even though the screenshot showed only an example of data allegedly transmitted through one website function and did not depict the plaintiffs’ actual transactions. The Fifth Circuit instead considered the complaint as a whole, including allegations that the Meta Pixel operated across Eyemart’s website and transmitted information about products, purchases, and attempts to schedule eye examinations.
What the Decision Means for Businesses Using Tracking Technologies
The decision may have implications beyond optical retailers. Companies offering health-related products or services through websites, mobile applications, or online scheduling tools may face increased litigation risk when using advertising pixels, analytics software, session-replay tools, or similar technologies.
Businesses should consider evaluating:
- What information their websites and applications transmit to third parties;
- Whether browsing, purchasing, or scheduling activity may reveal interactions with health-related products or services;
- Whether a third party can associate transmitted information with an existing user account or profile;
- Whether cookie banners, consent mechanisms, and privacy notices accurately describe actual data practices; and
- Whether tracking should be disabled or limited on pages involving sensitive products, services, or transactions.
A technical review should consider the complete data flow, including page URLs, event names, product identifiers, customer lists, account identifiers, and the recipient’s ability to combine those elements.
Conclusion
Rand v. Eyemart Express does not establish that every interaction with a health-related website constitutes IIHI or that every use of the Meta Pixel violates privacy law. The decision is nevertheless significant because it revives claims based on allegations that browsing, purchasing, and appointment-scheduling activity was health-related, identifiable, and transmitted to Meta without consent.
Companies offering health-related products or services should not assess website-tracking risk solely by asking whether they transmit diagnoses, prescriptions, or medical records. After Rand, the broader question may be whether the complete data flow reveals an identifiable individual’s interaction with health-related products or services. Businesses using tracking technologies in these contexts should consider working with experienced privacy counsel to evaluate their data flows, disclosures, consent practices, and potential litigation exposure.
For more, stay tuned. Privacy World is there to keep you in the loop.
Recent Comments