The Meta Pixel Cases: What Was Actually Alleged Against Healthcare Sites

The Meta Pixel healthcare lawsuits produced a great deal of coverage and very little transferable understanding. The reporting described an outcome, hospitals sued, patients notified, and skipped the mechanism, which is the only part a practice owner can act on. The mechanism is unremarkable, entirely documented, and still running on a large number of medical websites right now.

What follows describes what civil complaints alleged and what breach notifications reported. Allegations are claims, not findings, and this piece treats them that way throughout. The engineering, though, is not in dispute by anyone, and the engineering is the useful part.

What the Meta Pixel healthcare lawsuits actually alleged

Beginning in 2022, a wave of putative class actions was filed against health systems across the United States. A representative example is Krackenberger v. Northwestern Memorial Hospital, filed in the Northern District of Illinois in August 2022, which named the hospital alongside Meta entities.

The complaints shared a structure. They alleged that the provider had installed Meta's advertising pixel on pages including, in some cases, areas behind a patient login, and that as patients used those pages the pixel transmitted information about their activity to Meta, alongside identifiers capable of connecting that activity to a person, without the patient having authorised it.

Two features of that structure are worth noticing. First, the alleged wrong is a disclosure, not a hack. Nothing was broken into. The tag did what tags do. Second, the plaintiffs were not required to show that Meta did anything with the data, only that it received it, which is why the cases turned on transmission rather than on downstream use.

The mechanism, stated precisely

Strip out the legal framing and the sequence is short enough to hold in your head, which is exactly why it kept happening.

The step that turned an ordinary advertising integration into a healthcare problem is the third one, and it is passive. A URL such as a page about a specific procedure carries health meaning as plain text, and it travels automatically in every request the page generates. Nobody decided to send it. It is part of the envelope. That combination is the whole of the analysis in what counts as PHI on a website.

Where a practice had additionally configured event tracking on a form, the payload could include the fact of a submission and, depending on setup, the values in the fields. That configuration is not exotic. It is what an agency does to measure conversions, and it is done with good intentions on nearly every lead-generating site.

There is a further wrinkle worth understanding, because it defeats the most common technical response. Advertising platforms offer a matching feature that takes contact details, applies a one-way hash, and sends the result rather than the plaintext. The intuition is that hashing anonymises. It does not. A hash of an email address is deterministic, which means the same address always produces the same value, which means it functions as a stable identifier for exactly the person it was derived from. If the recipient already holds that person's email address, and a large advertising platform generally does, the hash resolves back to a name. Hashing changes the format of an identifier without changing what it identifies.

That is why the allegations did not turn on whether identifiers were obscured. Obscured identifiers still identify, and the complaints were written by people who understood that.

Why breach notifications tell the clearer story

The litigation is the visible part. The more instructive part is that a number of health systems filed breach notifications over this, independently of whether anyone sued them.

The reasoning is mechanical. If protected health information was disclosed to a third party without authorisation, that is a breach, and notification duties follow. No plaintiff, no regulator and no finding of fault is required to trigger the obligation. An organisation that reviews its own site, concludes PHI went somewhere it should not have, and reports it, has simply applied the rule.

That retrospective quality is the part practice owners consistently miss, and it inverts the usual instinct. The reflex on discovering a problem is to fix it quietly. Here, fixing it quietly does not close the exposure, because the exposure is the historical disclosure rather than the current configuration. This is also why the breach-notification angle survived the litigation over the guidance entirely, as covered in what survived the court challenge.

A parallel regime is worth knowing about for practices that fall outside HIPAA. The Federal Trade Commission enforces its own Health Breach Notification Rule, which reaches entities handling consumer health information that are not covered by HIPAA. A cash-pay aesthetics practice that concluded it has no HIPAA obligations has not thereby concluded it has no notification obligations.

What the Meta Pixel healthcare lawsuits did not decide

Being precise about scope matters, because this topic attracts overstatement from both directions.

These were civil actions, largely brought under privacy, wiretap and contract theories, resolved on their own facts and in some cases settled without any admission. They did not produce a rule that a particular product may not be used in healthcare. There is no such rule. 45 CFR 164.502 names no vendors, and the analysis for Meta's pixel is the same analysis that applies to any third party receiving data from a page.

They also did not decide the separate question that a federal court took up later, about whether an IP address plus a visit to a public health-topic page is itself protected health information. That question was answered in June 2024, in a different case, in the negative.

What the cases did establish, practically rather than legally, is that this class of disclosure is discoverable by outsiders. Anyone can open a practice's website, watch the network requests, and see which third parties receive what. That visibility is why the wave happened at all, and it has not diminished.

It is worth sitting with that point, because it is the one that generalises. Most compliance exposure is invisible from outside an organisation. You cannot audit a competitor's access controls, their training records or their contracts from a browser. You can audit their tracking in about ninety seconds, from anywhere, without permission, and so can a journalist, a plaintiff's firm, a competitor or a prospective patient with a developer console open. The asymmetry that produced a nationwide wave of filings against health systems in 2022 is a permanent property of how the web works, not a moment that passed.

A second generalisable point concerns who was named. The complaints typically named both the provider and the platform. Practices sometimes reason that a large vendor's terms of service, which usually prohibit sending sensitive categories of data, shift responsibility onto them. Read from the other direction, those terms say the provider agreed not to send it. A contractual promise you made and then broke, however inadvertently, is not obviously a defence.

What a practice should take from this

The transferable lesson is not about one company's product. It is that a page's address plus an advertising tag is sufficient to create a disclosure, without anyone intending it, and that the two page types where this matters are predictable: anything behind a login, and anything with a health-intent form.

The second lesson is about how these tags arrive. Very few were placed deliberately by the practice owner. They accumulate through agency engagements, theme updates, page-builder widgets and embedded scheduling tools, which is a problem examined in the consent gap in embedded forms. An inventory of tools you remember choosing is not an inventory of what runs.

The structural response is to make the default nothing. If non-essential tags are held until a visitor agrees, the mechanism described above cannot execute silently, and it cannot be reintroduced by a plugin update or a new agency. That is what consent gating is for, and its value here is precisely that it does not depend on anybody remembering.