Unreported / Non-Citable
Background
Plaintiffs seek to certify four classes of Facebook users whose protected healthcare information was obtained by Meta Platforms, Inc. ("Meta") through its tracking technologies (Meta Pixel and other Business Tools) embedded on healthcare providers' websites and apps. The proposed classes cover a period from June 17, 2018, to the present and include: (1) Patient Status Button-Click Class; (2) Patient Health Information Class; (3) Prescription Drug Information Class; and (4) Patient Device Intrusion Class. Plaintiffs assert claims for breach of contract, breach of the implied covenant, intrusion on seclusion, violation of California's Comprehensive Computer Data Access and Fraud Act (CDAFA), and for the first three classes, violations of the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA).
Meta opposes certification, arguing individualized issues predominate regarding which entities sent protected data, user consent, Meta's intent, and damages. Meta also challenges the reliability of plaintiffs' experts and moves to exclude their testimony. Plaintiffs move to exclude several of Meta's experts.
The Court’s Holding
The court grants plaintiffs' motion for class certification under Rule 23(b)(3) for all four classes and under Rule 23(b)(2) for injunctive relief, with two modifications: (1) the CIPA § 631 class is narrowed to patients who communicated from California or with a California-based healthcare provider; and (2) the CDAFA class definition will be amended to remove Conversions API and customer list uploads.
The court denies all motions to exclude expert testimony (Shafiq, Singer, Zigrang, Cohen, Barasz, Vohs, Zervas, Tadelis, Weil), finding that challenges go to weight, not admissibility. The court grants in part and denies in part the administrative motions to seal, ordering that generalized descriptive explanations of Meta's systems may not remain under seal while source code, table/field names for active systems, employee contact information, and plaintiff health information may remain sealed.
Key Takeaways
- Class certification granted for four classes of Facebook users whose HIPAA/CMIA-protected health information was acquired by Meta via tracking pixels on healthcare provider sites.
- Predominance satisfied: common evidence (Meta's default settings, expert sampling methodologies, contractual promises) outweighs individualized issues like consent, entity coverage, and device-level variations, which are de minimis or amenable to subclassing.
- CIPA § 631 claim narrowed to California-nexus subclass; CDAFA class redefined to exclude server-side data uploads (CAPI/customer lists) that do not affect user devices.
- All Daubert challenges denied: plaintiffs' experts' methodologies (sampling, AI classification, WTA conjoint surveys, profit modeling) and defense experts' opinions are admissible; disputes go to weight and cross-examination.
- Sealing order partially lifted: generalized descriptions of Meta's data acquisition, matching, and use of health data must be unsealed; only source code, active system architecture details, and personal identifiers remain protected.
Why It Matters
This ruling represents a major victory for plaintiffs in the Meta Pixel healthcare litigation, certifying broad classes covering millions of Facebook users whose sensitive health data was allegedly collected by Meta through healthcare provider websites. The court rejected Meta's arguments that the configurability of its Pixel, varying provider disclosures, and data retention gaps create insurmountable individualized issues, emphasizing that complexity does not defeat predominance.
The decision endorses the use of sampling, AI-assisted classification, and willingness-to-accept survey methodologies for classwide damages, and affirms that contractual promises by Meta not to collect protected health data support breach of contract claims that anchor standing and consent analyses. The narrowing of the CIPA § 631 class and CDAFA class reflects careful tailoring to jurisdictional and technical realities. The sealing ruling promotes transparency regarding Meta's data practices while protecting legitimate trade secrets.