• by Wendy Davis  @wendyndavis, September 8, 2023

As expected, a federal judge has ruled that Facebook users can proceed with a lawsuit alleging that Meta Platforms violated federal and state laws by tracking users' visits to health care providers' websites and monetizes data collected from those sites.

In a decision issued Thursday, U.S. District Court Judge William Orrick in the Northern District of California essentially said the users' allegations, if proven true, could support claims that Meta violated federal and state wiretap laws, and that the company violated representations in its terms of service.

Orrick previously signaled that he was inclined to allow the case to proceed, but didn't definitively rule until this week.

The decision comes in a battle dating to May of 2022, when several Facebook users alleged in a class-action complaint that Meta tracks their visits to hospital and health-care websites via the Meta Pixel.

The patients, who are proceeding anonymously, sued soon after The Markup reported that 33 of the country's top 100 hospitals have the Meta Pixel on their sites.

That code sends Meta information about online visitors tied to their IP addresses, according to the Markup. Meta also can potentially draw on tracking cookies to identify some patients who are logged in to Facebook when they visit a hospital site, according to The Markup.

The complaint included claims that Meta violated various wiretap and privacy laws, and that it misrepresented its policies by claiming that publishers only send data to Meta if they have the legal right to do so.

That statement was untrue, according to the plaintiffs, because the hospital sites were subject to the Health Insurance Portability and Accountability Act, which prohibits doctors and hospitals from sharing information about patients without their consent.

Meta urged Orrick to dismiss the lawsuit at an early stage in the proceedings, arguing that the Meta Pixel is not in itself illegal.

The company also said it didn't intentionally receive sensitive health data, arguing both that it instructs outside web developers who install the tracking code to avoid sending health information and that it attempts to filter out sensitive data.

Orrick said in his ruling that questions surrounding Meta's intent couldn't be answered without more evidence.

“While plaintiffs acknowledge that Meta may tell third parties and Facebook users that it intends to prevent receipt of sensitive health information, plaintiffs contend that is not what Meta really intends,” he wrote. “What Meta’s true intent is, what steps it actually took to prevent receipt of health information, the efficacy of its filtering tools, and the technological feasibility of implementing other measures to prevent the transfer of health information, all turn on disputed questions of fact that need development on a full evidentiary record.”

The judge dismissed several other claims in the complaint, but said the users could amend their allegations regarding those claims and bring them again by September 27.