Unreported / Non-Citable
Background
In this coordinated litigation in the Northern District of California, Case No. 22-cv-03580-WHO, Facebook users alleged that Meta Platforms, Inc. obtained protected healthcare information or affected their devices while they used healthcare providers' websites and applications. Plaintiffs sought to certify four classes covering patient-status button clicks, communications identifying a doctor, condition, or treatment, prescription-drug communications, and device intrusion through cookies, data transmissions, or Core Setup computing. The proposed class period runs from June 17, 2018, to the present. The consolidated order resolves the class-certification motion together with the parties' competing expert-exclusion motions.
The classes asserted breach of contract, breach of the implied covenant, intrusion on seclusion, and violations of California's Comprehensive Computer Data Access and Fraud Act. Three classes also asserted claims under the Electronic Communications Privacy Act and the California Invasion of Privacy Act. Meta principally opposed certification on predominance and superiority, pointing to configurable Pixel technology, incomplete historical data, consent, user conduct, California-nexus requirements, and damages, while plaintiffs' experts proposed default-setting analysis and sampling methodologies. The October 30, 2026 order also resolved a motion to strike reply evidence and administrative sealing requests.
The Court’s Holding
Judge William H. Orrick found the undisputed numerosity, adequacy, typicality, and common-question requirements of Rule 23(a) satisfied and concluded that common issues predominate under Rule 23(b)(3). Disputes over covered providers, default settings, filtering, data retention, and user identification could be addressed through common evidence, summary judgment, trial, subclasses, narrowed class periods, or later decertification. The court rejected Meta's reliance on cases such as Frasco v. FloHealth and Ingraham, finding the class definitions here limited to patients whose specifically identified HIPAA- or CMIA-protected information was acquired by Meta. The court treated consent as an objective question focused on what a reasonable user would understand, found Meta's knowledge and intent similarly susceptible to common proof, held that individual damages questions did not defeat certification, and concluded that the litigation's complexity supported superiority, certifying classes under both Rules 23(b)(3) and 23(b)(2).
The certification is granted except for the limited Section 631 class and the redefined CDAFA class, which plaintiffs must narrow or revise. The court denied every expert-exclusion motion — Meta's challenges to Shafiq, Singer, Zigrang, Cohen, and Barasz and Vohs, and plaintiffs' challenges to Weil, Zervas, and Tadelis's first opinion — generally characterizing methodological criticisms as matters of weight and cross-examination while leaving targeted trial objections open. It granted Meta's motion to strike attorney commentary in reply Exhibit 87 but not otherwise appropriate evidentiary citations. The sealing ruling protected source code and specified sensitive technical or personal information while requiring generalized descriptions central to the claims to be disclosed, and directed the parties to meet and confer and file a final joint chart within thirty days. Plaintiffs must file revised class definitions within ten days and proposed notice materials within thirty days, absent an extension.
Key Takeaways
- Four healthcare-privacy classes were certified under Rules 23(b)(3) and 23(b)(2), subject to a narrowed Section 631 definition and a redefined CDAFA device-intrusion class.
- The court distinguished technical complexity from individualized questions and emphasized that class definitions and periods can be adjusted as evidence develops.
- All expert-exclusion motions were denied for class-certification purposes; methodological criticisms were treated as weight and cross-examination issues, with targeted objections left for later proceedings.
- The order permits continued sealing of specified technical and personal information but requires disclosure of generalized descriptions central to the claims.
- Revised class definitions and class-notice proposals are the next required filings; the order does not decide the merits or award damages.
Why It Matters
The decision allows the healthcare-privacy claims to proceed collectively despite substantial disputes over Meta's data, technology, and the identification of class members. It preserves opportunities to test those disputes at summary judgment or trial and to narrow or decertify classes if later evidence warrants.
The paired evidentiary and sealing rulings also shape the next phase of the case: expert testimony remains available for certification, targeted objections may return later, and the parties must refine the public record and notice plan. The order leaves liability, damages, restitution, and any ultimate injunction unresolved.