Website pixel tracking leads to a class action when site code sends visitor activity to an ad company that can identify the visitor. Plaintiffs then sue for wiretapping, eavesdropping, and intrusion, alleging interception for ads without permission. Meta's Pixel is JavaScript that runs on a site and logs events like page views and purchases. Meta Developers explain it also collects headers, Pixel ID, Facebook cookies, button clicks, and optional custom data for ad measurement and targeting Meta Pixel documentation.
Official resource:
- Explore the official data from Techtarget — Use this primary source to review the underlying data.
Table of Contents
- What does the tracker send?
- How does a routine visit become health data?
- What did the Eyemart ruling change?
- What limits apply and what can you keep?
What does the tracker send?
The pixel fires when you view a page, click a button, or make a purchase. It bundles that event with identifiers from your browser and device. Squire Patton Boggs Privacy World reports the Eyemart plaintiffs allege the pixel plus uploaded customer lists let Meta match site activity to Facebook profiles for targeted advertising Privacy World analysis.
That matching claim turns anonymous browsing into an identified profile. Intrusion and eavesdropping theories focus on that second step. Plaintiffs argue the site helped a third party listen in and build an ad record.
How does a routine visit become health data?
Appointment clicks, exam scheduling, and portal messages reveal health needs. A vision-site search for lenses or an eye-exam slot can signal a condition. TechTarget reports Advocate Aurora Health disclosed pixel-related exposure for about 3 million people, including appointment data and MyChart communications, then reached a $12.25M settlement resolving the consolidated breach class action TechTarget report.
The size reflects how many users shared the same tracker. For readers, the lesson is direct. One script on scheduling or checkout pages can affect every visitor.
What did the Eyemart ruling change?
Squire Patton Boggs Privacy World reports that in Rand v. Eyemart Express, the Fifth Circuit held Oct. 23, 2026 that eyewear browsing, prescription purchases, and exam scheduling plausibly constitute identifiable health information and revived federal and state wiretap claims Privacy World analysis. The court did not decide final liability.
The ruling matters because retail health activity now counts at the pleading stage. Plaintiffs can proceed to discovery on wiretap claims rather than face early dismissal. It also widens risk beyond hospitals. Optical shops, dental sites, pharmacies, and wellness sellers use the same tools.
What limits apply and what can you keep?
Baker Donelson explains via JD Supra that California SB 690, signed Sept. 30, 2026 and effective Jan. 1, 2027, ends private pen-register claims for website tracking but preserves Section 631 wiretap claims JD Supra summary.
Operators must therefore audit pixels, obtain consent or HIPAA authorization, or remove trackers. That split shapes future filings. Pen-register counts will fade in California, while wiretap, intrusion, and eavesdropping counts remain central. If you received a notice or saw a settlement announcement, protect your position:.
- Save the notice, dates of visits, and appointment or order confirmations.
- Note what you entered on the site: scheduling, portal messages, or purchases.
- Watch the official settlement site for claim forms and deadlines.