A consumer does not have to enter a diagnosis, disclose a prescription, or complete a medical appointment for website activity to reveal health information. That is the central finding of a new federal appellate decision that could affect how healthcare providers, pharmacies, telehealth companies, wellness businesses, and retailers use Meta Pixel and similar advertising technologies.
On October 23, 2026, the U.S. Court of Appeals for the Fifth Circuit revived a proposed class action against Eyemart Express, LLC, holding that allegations involving the disclosure of prescription eyewear searches, purchases, and eye-exam scheduling activity to Meta Platforms were sufficient to overcome the grounds on which a district court had dismissed the case.
In Rand v. Eyemart Express, L.L.C., No. 25-10784, the court also determined that the plaintiffs had standing to pursue their claims because the alleged unauthorized disclosure of identifiable health information constituted a concrete privacy injury.
The ruling does not establish that Eyemart violated federal wiretapping law or that every website using Meta Pixel unlawfully discloses health information. It does, however, make clear that courts may treat identifiable activity involving healthcare services and medical products as sensitive health information, even when no specific medical diagnosis appears in the transmitted data.
For businesses using advertising pixels on health-related pages, that distinction deserves immediate attention.
What Happened in Rand v. Eyemart Express?
Eyemart Express operates retail optical stores and a website where customers can browse eyewear, purchase prescription glasses, and schedule eye examinations.
According to the plaintiffs’ amended complaint, Eyemart installed Meta Pixel across its website. The technology allegedly collected information about visitors’ searches, clicks, products viewed, prescription purchases, and appointment-scheduling activities.
Meta Pixel is an advertising and measurement technology that allows website operators to transmit events to Meta. Depending on its configuration, those events can include page views, product identifiers, purchase information, and other details about user interactions.
The plaintiffs alleged that Eyemart permitted Meta to receive health-related website activity without their knowledge or consent. They further alleged that Meta could connect this activity to identifiable Facebook users and use the resulting information for targeted advertising.
Five Facebook users brought claims under the federal Wiretap Act, the Missouri Wiretap Act, and the Illinois Eavesdropping Act, along with claims for intrusion upon seclusion and breach of contract.
The plaintiffs fell into two groups.
The first group, described as the Search Plaintiffs, alleged that they browsed prescription eyewear and searched for products. One also alleged that scheduling an eye examination resulted in information about the selected store being transmitted to Meta.
The second group, the Prescription Plaintiffs, alleged that they purchased prescription eyewear and supplied prescription information during the ordering process.
The district court dismissed the case with prejudice. It concluded that the Search Plaintiffs had not adequately alleged that their browsing activity constituted individually identifiable health information. Although the court recognized that the Prescription Plaintiffs had provided health information, it found their allegations insufficient to establish that the information had actually been transmitted to Meta.
The Fifth Circuit disagreed with both conclusions and reversed the dismissal.
The Court Rejected a Narrow Definition of Health Information
One of the most consequential parts of the decision concerns the definition of individually identifiable health information, or IIHI.
The plaintiffs did not bring a claim directly under the Health Insurance Portability and Accountability Act (HIPAA). The Fifth Circuit expressly recognized that HIPAA does not provide a private right of action.
Instead, the court used HIPAA’s statutory definition of IIHI to evaluate whether the information allegedly disclosed was private health information relevant to the plaintiffs’ claims.
Under 42 U.S.C. § 1320d(6), IIHI includes certain identifiable information relating to an individual’s physical or mental health, the provision of healthcare, or payment for healthcare.
Eyemart argued that the Search Plaintiffs had not entered diagnoses, symptoms, or other information that inherently disclosed a medical condition.
The Fifth Circuit rejected that interpretation.
The court explained that health information need not identify a particular diagnosis or condition. Information can fall within the definition when it relates to a person’s health or the provision of healthcare and can be associated with an identifiable individual.
That reasoning mattered because the plaintiffs alleged that Meta received information about prescription eyewear searches and appointment scheduling, then connected those events with identifying information from Facebook accounts.
The court also emphasized that Eyemart’s counsel had conceded at oral argument that the information Meta received was individually identifiable because it could be associated with particular Facebook users.
That concession narrowed the appellate dispute. The remaining question was whether the browsing and scheduling information related sufficiently to health or healthcare services.
The Fifth Circuit concluded that it did, at least at the pleading stage.
Browsing Medical Products Can Reveal Health-Related Information
The decision distinguishes between a generic website visit and activity involving identifiable healthcare interests.
For example, a person browsing an ordinary retail website might generate advertising events showing which products they viewed.
But a person browsing prescription eyewear, searching for medical services, or scheduling an examination may generate information connected to healthcare needs.
The court reasoned that the plaintiffs’ activities on Eyemart’s website related to vision and the provision of healthcare.
Importantly, the decision did not require plaintiffs to establish that the browsing activity conclusively proved a particular medical condition.
The court treated the relationship between the activity and healthcare services as sufficient to support the allegations.
This creates potential exposure for businesses that have historically treated product views, page URLs, and appointment events as ordinary marketing data without considering what those events reveal when associated with identifiable individuals.
Meta Pixel and Article III Standing: Why the Plaintiffs Could Proceed
Eyemart also argued that the plaintiffs lacked Article III standing because they had not suffered a sufficiently concrete injury.
Federal courts generally require plaintiffs to establish an injury that is concrete and particularized, traceable to the defendant, and likely to be redressed by judicial relief.
In privacy litigation, defendants frequently argue that the alleged collection or disclosure of data caused no actual harm.
The Fifth Circuit rejected Eyemart’s standing challenge.
Relying on TransUnion LLC v. Ramirez and other appellate decisions, the court explained that intangible injuries may qualify as concrete injuries when they closely resemble harms traditionally recognized at common law.
Unauthorized disclosure of private information and intrusion upon seclusion are among those recognized categories.
The Fifth Circuit concluded that the alleged disclosure of identifiable health information to Meta was sufficiently analogous to those traditional privacy harms.
The court did not require plaintiffs to demonstrate financial loss, identity theft, or a separate economic injury to establish standing.
Nor did the plaintiffs have to prove every element of the analogous common-law tort merely to establish a concrete injury for jurisdictional purposes.
This is an important distinction. Article III standing allows a plaintiff to bring a claim in federal court. It does not establish that the plaintiff will ultimately prevail on the underlying statutory or common-law cause of action.
Rand Joins a Growing Line of Appellate Pixel Decisions
The Fifth Circuit did not reach its standing conclusion in isolation.
Its opinion discussed several appellate decisions recognizing concrete privacy injuries arising from the alleged disclosure of identifiable website activity to third parties.
In Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), the Sixth Circuit recognized standing arising from allegations that Meta Pixel disclosed identifiable video-viewing information.
In Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), the D.C. Circuit addressed the unauthorized disclosure of private viewing history and found a sufficiently concrete privacy injury.
The Fifth Circuit also cited Salazar v. National Basketball Association, 118 F.4th 533 (2d Cir. 2024), which involved disclosure of personal video-viewing information, and In re BPS Direct, LLC; Cabela’s LLC Wiretapping Litigation, 175 F.4th 423 (3d Cir. 2026), concerning alleged disclosures of shoppers’ banking information through tracking technology.
The Fifth Circuit viewed those decisions as supporting its conclusion that unauthorized disclosure of identifiable health information can constitute a concrete injury.
There is an important difference between these cases and Rand: the earlier appellate decisions addressed video-viewing activity or financial information, while Rand concerned browsing and purchasing activity involving healthcare products and services.
The opinion therefore extends the appellate discussion into a health-related retail environment, not just traditional hospital websites.
The Eyemart Decision Goes Beyond Hospitals and HIPAA-Covered Providers
One reason Rand deserves attention is that Eyemart is an optical retailer offering both products and healthcare-related services.
The dispute was not confined to an electronic health record portal or a hospital patient account.
The plaintiffs alleged that activity on ordinary website pages, including product listings and appointment-scheduling functions, disclosed health-related information.
The court’s reasoning could be invoked in future lawsuits against businesses such as:
- Telehealth providers and online medical consultation services.
- Pharmacies and retailers selling sensitive healthcare products.
- Medical-device and diagnostic-testing companies.
- Vision, dental, fertility, and reproductive-health businesses.
- Mental health platforms and therapy providers.
- Wellness and fitness companies where identifiable activity reveals health conditions or treatment interests.
- Businesses offering GLP-1 treatment, weight-management consultations, or other healthcare services.
These are potential applications of the court’s reasoning, not findings that all such businesses are subject to HIPAA or that their use of pixels is necessarily unlawful.
The relevant questions concern the information collected, whether it is identifiable, what it reveals about healthcare or health conditions, who receives it, and what consent or other legal authorization applies.
Why the Fifth Circuit Distinguished American Hospital Association v. Becerra
The opinion also addressed an important case that businesses have cited when challenging broad interpretations of health information.
In American Hospital Association v. Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024), a federal district court rejected aspects of Department of Health and Human Services guidance concerning tracking technologies and individually identifiable health information.
That case involved guidance addressing, among other things, the combination of an IP address with visits to certain health-related webpages.
Eyemart argued that Becerra supported its position.
The Fifth Circuit found the cases distinguishable.
In Rand, the allegations went beyond a person’s IP address and a visit to a healthcare website. The plaintiffs alleged that Meta received specific product-search, shopping, and appointment activity and could associate that information with identifiable Facebook users.
The plaintiffs also alleged that Eyemart uploaded customer lists containing email addresses and purchase information for matching with Facebook accounts.
The court treated that broader collection of alleged facts as materially different from the information addressed in Becerra.
The distinction matters for compliance programs. It is not enough to assume that all website activity is either protected health information or ordinary browsing data. The particular information transmitted and the context in which it is collected can change the analysis.
The Court Also Rejected an Overly Narrow Reading of the Plaintiffs’ Pixel Evidence
Another important part of the opinion concerns how courts evaluate technical evidence at the motion-to-dismiss stage.
The plaintiffs included screenshots intended to illustrate information allegedly transmitted through Meta Pixel.
One example involved an AddToCart event. The district court examined the screenshot and concluded that the displayed fields did not establish disclosure of prescription information.
The Fifth Circuit found that the district court had relied too heavily on the limited example.
The appellate court noted that the screenshot had been created by the plaintiffs’ attorney and was not a record of the plaintiffs’ actual purchases. Its purpose was to illustrate a type of data transmission, not exhaustively document every transmission alleged in the complaint.
The district court should have considered the amended complaint as a whole and drawn reasonable inferences in favor of the plaintiffs.
The Fifth Circuit emphasized that the complaint also alleged broader disclosures involving product descriptions, prescription eyewear purchases, appointment details, and customer-list matching.
At the pleading stage, those allegations were sufficient to overcome the grounds for dismissal.
This does not mean that illustrative screenshots will ultimately prove a privacy violation. It means plaintiffs may survive an early motion to dismiss even when their screenshots do not establish every technical detail of the alleged data flow.
The court expressly recognized that discovery would be necessary to test the allegations if the plaintiffs’ claims otherwise satisfied the applicable pleading requirements.
For defendants, that creates an additional litigation concern: a successful standing and pleading challenge may be difficult when the complaint contains detailed allegations about identifiable data flows, even if the underlying technical evidence remains disputed.
How Rand Relates to ECPA, CIPA and Website Tracking Litigation
The plaintiffs in Rand asserted claims under the federal Wiretap Act, state interception statutes, intrusion upon seclusion, and breach of contract.
The Fifth Circuit did not decide the ultimate merits of those claims. It reversed the dismissal based on the district court’s treatment of the alleged health information and its disclosure to Meta, then returned the case for further proceedings.
Nevertheless, the decision may influence how plaintiffs frame similar allegations under other privacy statutes.
Electronic Communications Privacy Act
The federal Wiretap Act, part of the Electronic Communications Privacy Act, regulates certain intentional interceptions of electronic communications.
In website-tracking litigation, disputes often concern whether a third-party technology intercepted protected communications, whether the website operator or another party consented, and whether a statutory exception applies.
Rand does not eliminate those requirements.
But it provides plaintiffs with appellate authority supporting the proposition that identifiable health-related website activity may be sufficiently private to support a concrete injury.
California Invasion of Privacy Act
California’s Invasion of Privacy Act, particularly Penal Code § 631(a), has become a frequent basis for claims involving pixels, session-replay technologies, and third-party tracking scripts.
Although Rand is a Fifth Circuit decision rather than a California appellate ruling, plaintiffs may cite its discussion of identifiable health information and privacy injury when pursuing California website-tracking claims.
California cases will still turn on CIPA’s statutory elements, applicable consent defenses, and the facts of the alleged interception.
Washington’s My Health My Data Act and Other Consumer Health Privacy Laws
The ruling also has implications beyond traditional wiretapping claims.
Washington’s My Health My Data Act regulates certain consumer health data and applies to covered entities beyond traditional HIPAA-regulated healthcare providers.
Its definitions, consent requirements, and restrictions are distinct from the federal Wiretap Act.
A company collecting identifiable information about a consumer’s health interests, treatment searches, or healthcare-related purchases should assess whether that information falls within applicable state consumer health privacy laws, even if the company is not a HIPAA-covered entity.
The Rand decision does not interpret Washington’s law, but the factual overlap is relevant to companies assessing their broader exposure.
What Healthcare and Wellness Websites Should Review Immediately
The practical issue is not whether a business has Meta Pixel installed. It is what information the pixel or related technology receives, when it receives that information, and whether the transmission is permitted.
A company may have a privacy notice that mentions advertising technologies while still allowing scripts to transmit sensitive information before a visitor has made a consent choice.
Conversely, a company may have a consent banner that appears correct but does not actually control the underlying scripts.
That is why website privacy compliance must be tested technically rather than evaluated solely by reading the privacy policy.
1. Audit Meta Pixel and Other Advertising Technologies
Organizations should identify where Meta Pixel, Google Ads, TikTok Pixel, session-replay tools, and other third-party technologies operate.
The review should include product pages, healthcare-related search results, appointment workflows, checkout pages, and account areas.
Particular attention should be paid to URLs, query strings, event parameters, product identifiers, form fields, and customer-list uploads.
Even where a website does not intentionally transmit a diagnosis, other information may reveal the nature of a healthcare service or product being sought.
2. Enforce Consent at the Script Level
A consent banner alone does not prevent a script from executing.
Where consent is legally required, the underlying tag or script should be prevented from firing until the appropriate consent state has been established.
A properly configured consent management platform can communicate visitor preferences to a tag management system such as Google Tag Manager.
Google Consent Mode v2 can also communicate consent states for Google services, including ad_storage, analytics_storage, ad_user_data, and ad_personalization.
However, Consent Mode does not necessarily eliminate all network requests. Its advanced implementation can permit certain cookieless signals while consent is denied.
Businesses dealing with sensitive health-related activity should therefore evaluate whether basic consent mode, script blocking, or removal of particular tracking technologies is appropriate.
The objective is to control actual data transmissions, not merely the creation of cookies.
3. Review Server-Side Tracking and Customer-List Uploads
Disabling a browser pixel does not necessarily stop information from being transmitted through server-side integrations.
Meta Conversions API, customer-list matching, ecommerce integrations, and other server-to-server connections should be included in the assessment.
This is especially relevant because the plaintiffs in Rand alleged that Eyemart uploaded customer information to Meta for matching against Facebook accounts.
A company should evaluate both browser-based and server-side data flows before concluding that consent controls are effective.
4. Maintain Accurate Cookie and Privacy Disclosures
Privacy notices should accurately describe the technologies and data practices actually used.
A dynamic cookie policy can help visitors understand the categories of cookies and tracking technologies operating on a website.
An updated privacy notice should explain relevant personal information categories, purposes of processing, third-party disclosures, and applicable consumer rights.
These disclosures support transparency but do not, by themselves, authorize every disclosure of sensitive information.
5. Provide Consumer Privacy Rights Mechanisms
Businesses subject to applicable privacy laws should provide mechanisms for consumers to exercise their rights.
Depending on the law and the business, those rights may include access, correction, deletion, and opting out of the sale or sharing of personal information.
A Data Subject Access Request portal can centralize these requests and help document the company’s responses.
For health-related businesses, request workflows should also account for the potentially sensitive nature of the information involved.
6. Preserve Technical Evidence
Organizations facing website-tracking claims should preserve relevant records of their actual configuration.
Useful evidence may include tag manager versions, consent logs, CMP settings, historical privacy notices, deployment dates, network traces, and records of technical changes.
Current screenshots cannot establish how a website operated months earlier.
That distinction is particularly important in litigation involving claims that tracking occurred before consent or during a specific historical browsing session.
How Captain Compliance Addresses Website Tracking Risk
Captain Compliance provides privacy compliance technology designed to help businesses manage consent, disclose tracking practices, and administer consumer privacy rights.
Its platform includes consent management, cookie scanning, dynamic cookie disclosures, privacy notices, and DSAR functionality.
For organizations using Meta Pixel and similar technologies, a properly deployed CMP can help coordinate consent choices with the operation of marketing and analytics scripts.
Captain Compliance also supports technical review of consent implementations, including the relationship between a consent banner, tag management systems, and the underlying network activity.
That technical verification is particularly important for healthcare and wellness websites because blocking a cookie is not necessarily the same as preventing a sensitive data transmission.
The appropriate configuration depends on the business, the data involved, the applicable legal requirements, and the technologies operating on the website.
No consent management platform automatically eliminates all litigation exposure. The relevant scripts must be configured correctly, sensitive data flows must be assessed, and the system must be tested after deployment.
What Happens Next in Rand v. Eyemart Express?
The Fifth Circuit reversed the district court’s dismissal and remanded the case for further proceedings.
The appellate court held that the plaintiffs had standing and adequately alleged the health-information disclosures that the district court had found missing.
It did not determine whether Eyemart ultimately violated the federal Wiretap Act, the Missouri Wiretap Act, the Illinois Eavesdropping Act, or any other asserted cause of action.
Those claims remain subject to further proceedings and potential defenses.
The ruling nevertheless changes the litigation posture. Eyemart can no longer rely on the district court’s conclusion that the alleged browsing and prescription activity was insufficient to support the claims at the pleading stage.
The case also provides plaintiffs with a new appellate decision addressing identifiable health-related website activity outside a traditional hospital patient portal.
For healthcare providers, retailers, and wellness businesses, the immediate lesson is technical: review what advertising and analytics tools transmit from health-related pages, determine whether those transmissions are authorized, and verify that consent controls operate as intended.
A privacy policy that mentions Meta Pixel is not a substitute for controlling the information Meta receives.
