Facebook users who say the Meta Pixel sent their health information to Meta from hospital, doctor and pharmacy websites were certified as four classes in In re Meta Pixel Healthcare Litigation in October 2026. Meta has not been found liable, and there is no settlement or anything to claim.
Allegations Only · No Settlement Yet
This article describes a class certification ruling. The plaintiffs’ claims are unproven allegations. Certifying a class lets the claims go forward on behalf of a group; it does not decide who is right. Meta Platforms, Inc. has not been found liable, and there is no settlement and nothing to claim at this time. This page is informational and is not legal advice.
What Happened?
On October 30, 2026, U.S. District Judge William H. Orrick of the Northern District of California granted class certification in In re Meta Pixel Healthcare Litigation, Case No. 3:22-cv-03580-WHO, the consolidated lawsuit over the Meta Pixel and Meta’s other business tools on healthcare websites and apps. The 37-page order (Dkt. 1425) certifies four classes of Facebook users whose healthcare information, the plaintiffs allege, was obtained by Meta, or whose devices were affected by Meta’s code, while they were on their healthcare providers’ websites or apps.Meta opposed certification. Its main argument was that too many questions would have to be answered one person at a time — which providers configured the Pixel to send which data, whether a given user consented, and whether someone was booking care for a relative rather than for themselves. The judge rejected that framing, writing that “Meta’s opposition confuses complexity — which undoubtedly this action presents — and individualized questions,” and that accepted case management tools can handle the complexity.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
The Four Certified Classes
The plaintiffs asked for, and received, four classes with a class period running from June 17, 2018, to the present. As described in the order:- Patient Status Button-Click Class — Facebook users who had at least one patient portal, medical appointment, bill payment or diagnostic assessment button click obtained by Meta from a “Class Healthcare Provider.”
- Patient Health Information Class — Facebook users who had at least one communication or fact identifying a doctor, condition or treatment acquired by Meta from a Class Healthcare Provider, not counting the button clicks covered by the first class.
- Prescription Drug Information Class — Facebook users whose communications with a prescription drug website, for a drug they had been prescribed, were obtained by Meta.
- Patient Device Intrusion Class — Facebook users for whom Meta placed an _fbp cookie, or used their device’s computing resources by sending data to Meta or running Meta’s “Core Setup” code, while they were on a healthcare provider’s website or app.
“Class Healthcare Providers” are entities covered by HIPAA that the plaintiffs identified on a list filed with the court; the judge granted the plaintiffs’ motion to file a revised version of that list. Whether every entity on it really is a covered provider is left for summary judgment or trial.
Which Claims Go Forward as a Class
All four classes seek certification of claims for breach of contract, breach of the implied covenant of good faith and fair dealing, intrusion upon seclusion, and violation of California’s Comprehensive Computer Data Access and Fraud Act (CDAFA). The three information classes also bring claims under the federal Electronic Communications Privacy Act (ECPA) and the California Invasion of Privacy Act (CIPA).The certification comes with two limits. First, the CIPA section 631 wiretapping claim requires a connection to California, so the judge adopted the plaintiffs’ fallback proposal and limited that claim to subclasses of patients who either communicated from California or exchanged a communication with a California-based healthcare provider. Second, Meta argued that two of its tools within the device class definition — the Conversions API and “customer list” uploads — do not touch users’ devices at all. The plaintiffs agreed and said they would amend that class, which the order’s conclusion calls the “redefined CDAFA class.”
The judge certified the classes for damages under Rule 23(b)(3) and also for injunctive relief under Rule 23(b)(2). The injunction the plaintiffs describe would bar Meta from collecting and using health information communications on healthcare provider web properties and from using patients’ device storage and resources there, and would require certain disclosures about Meta’s data collection and advertising practices. Meta argued that it has improved its efforts to keep protected health information out of its systems; the order notes that the plaintiffs’ experts dispute that.
The Issues the Judge Flagged for Later
The order repeatedly says that the disputes Meta raised are real but are for summary judgment or trial, not grounds to deny certification. Among them:- Meta’s data. Meta argued that under its standard retention policies the oldest classwide data it has dates only to March 2022, while the classes go back to June 2018. The judge called this the “admittedly more difficult issue” for the plaintiffs, but found the plaintiffs’ experts had proposed accepted methods — relying on Meta’s default settings and on sampling — and said the problem may at most narrow the class periods or the damages or restitution available.
- Provider settings. Meta argued some websites changed the Pixel’s defaults and never sent it protected data. The order notes the plaintiffs’ expert cited research finding Meta’s Automatic Events setting active on 99.6 percent of healthcare websites from 2019 to 2022, and says evidence on this point will be common to each provider’s patients.
- Consent. Whether Meta’s and the providers’ disclosures amounted to “actual” consent is, the judge wrote, an objective question likely to be resolved on a classwide basis at summary judgment.
- Damages. The order notes that statutory damages of $5,000 under CIPA, if they apply, are “by no means insignificant,” but that the cost of litigating a case this complex would swamp any single person’s claim — one reason a class action is the superior way to resolve it.
The same order denied Meta’s motions to exclude the plaintiffs’ experts and the plaintiffs’ motions to exclude Meta’s experts, finding the disputes between them are grounds for cross-examination rather than exclusion. It also ruled on a long list of sealing requests: source code and sensitive table names stay sealed for now, but general descriptions of how Meta acquired and used data from healthcare providers are to be made public.
What Happens Next
The order sets three near-term deadlines, each measured from October 30, 2026:- Within 10 days — after meeting with Meta’s lawyers, the plaintiffs file revised class definitions consistent with the order.
- Within 30 days — the plaintiffs submit a proposed notice plan and forms of notice, either agreed with Meta or disputed in one joint filing, unless the parties stipulate to more time.
- Within 30 days — the parties file any documents they agree can be unsealed and one final joint chart narrowing what Meta still wants kept under seal.
Once a notice plan is approved, class members are notified about the case. A certified class is not a settlement: no money is available unless the case later settles or the plaintiffs win and a court approves a way to pay class members. Federal Rule of Civil Procedure 23(f) also allows a party to ask the Ninth Circuit for permission to appeal a class certification order.
Judge Orrick’s order cites a separate case in the same court several times: Frasco v. Flo Health, Inc., the case over data from the Flo period-tracking app in which a jury returned a verdict against Meta in August 2025. The judge in that case declined to certify a CIPA section 631 class for lack of a California connection — the same issue that led Judge Orrick to limit that claim here.
Questions
Does class certification mean Meta lost the case?
No. Class certification decides only that the claims can be tried on behalf of a group instead of person by person. Judge Orrick did not decide whether Meta broke any law, and the order says several of Meta’s arguments will be tested at summary judgment or trial. Meta has not been found liable.
Is there money to claim from the Meta Pixel healthcare case?
Not at this time. There is no settlement, no judgment and no claim form. Money would become available only if the case later settles or the plaintiffs win at trial and a court approves a way to pay class members.
Who is in the certified classes?
All four classes are made up of Facebook users, with a class period from June 17, 2018, to the present. They cover users whose patient-portal, appointment, bill-payment or diagnostic button clicks were obtained by Meta from listed healthcare providers; users whose communications identifying a doctor, condition or treatment were acquired; users whose communications with a prescription drug website for a drug they were prescribed were obtained; and users whose devices received a Meta _fbp cookie or ran Meta code while on a healthcare provider’s website or app. The plaintiffs must file revised definitions.
How will class members find out about the case?
The order gives the plaintiffs 30 days to submit a proposed notice plan and forms of notice, agreed or disputed, unless the parties stipulate to more time. Once the court approves a plan, class members are notified about the case and the choices the notice describes, which in a damages class normally include a way to opt out.
What did the judge say about Meta’s own data?
Meta argued that under its standard retention policies its oldest classwide data dates only to March 2022, while the classes reach back to June 2018. The judge called this the more difficult issue for the plaintiffs but found it did not defeat certification, saying it may instead narrow the class periods or the damages or restitution available.
Sources
• Order on Motion for Class Certification and Motions to Exclude, In re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580-WHO (N.D. Cal.), Dkt. 1425 (Oct. 30, 2026)• Case docket — CourtListener
