Meta unlikely to succeed on second bid to toss class action over Pixel medical privacy breaches

SAN FRANCISCO (CN) — Facebook’s parent company looks to have little chance of getting a dismissal on multiple claims in a class action claiming the tech giant’s products are designed to track private user information without their knowledge.

Meta attempted to again convince U.S. Senior District Judge William Orrick to toss out numerous claims in a class action filed by plaintiffs who say their medical privacy was violated by Meta’s Pixel advertising tracking tool.

The users say Meta knew or should have known that its Pixel tracking tool was being used on hospital websites to collect their private medical information. The data then went to Meta, which used the data to create personalized ads, the plaintiffs say. At least 664 hospital systems or medical provider web properties sent patient data to Meta through the Pixel tool.

The collection of this data — in the absence of a HIPAA authorization — violates Meta’s own privacy promise to its users, the plaintiffs say. Meta had promised users that the Pixel and other tracking tools required partners to have the lawful right to collect and share the data before providing the data to Meta.

Meta is attempting to toss claims which the judge allowed to proceed in August 2023. The tech giant says that there was nothing inherently unlawful about the use of Pixel to collect data, and web developers are responsible for information shared and making sure they have the proper permission and legal right to share any data they collect.

Meta’s attorney Lauren Goldman said in arguments before Orrick on Wednesday that the plaintiffs had provided allegations that do not support what was in the original complaint brief when asked to identify information Pixel gleaned from their health care providers.

She said the Ninth Circuit Court of Appeals has previously ruled on covered entities by holding that information available on public websites is in contrast to private medical histories protected under HIPPA.

“There’s a big disjoint here between what the plaintiffs say in their brief they allege, and what the complaint actually alleged,” Goldman said. “The courts have repeatedly held that they won’t allow trespass claims where there’s not a significant interference with the functioning of the computer device.”

Class attorney Jay Barnes said that Orrick himself has in the past ruled to allow a finding of trespass by proving a measurable loss in the use of the computer system — in this case, the plaintiffs lost the ability to safely use their computers due to the loss of privacy in their personal information.

He said Meta caused this: “It sneaks the cookie onto the computer, in a way that overcomes the longstanding way that Internet browsers were designed to prevent this type of behavior.”

“To us, the real dispute here is whether measurable loss is enough,” Barnes said. “We’re really getting into a fact question, on whether a loss is enough to determine whether a jury would award damages.”

Barnes also told the judge that the plaintiffs are not all claiming that they are patients, but all experienced cookies being placed on their activity while accessing medical information.

Goldman acknowledged that in prior cases the courts found that Meta promised not to collect users’ information while users were logged out of Facebook. However, she said this was a different case and users did not have the same reasonable expectation of privacy.

Barnes responded that plaintiffs claim Pixel works on their devices without any notice or request for consent, and that if Meta had asked for consent then they would not be open to the trespass claim.

The judge, a Barack Obama appointee, did not indicate when he may issue a ruling. He said that he is inclined to toss only the remaining Consumer Legal Remedies Act claim and deny Meta’s request to throw out the other claims. He is also asked to consider how to sever the multiple cases the class action covers within the Northern District of California as he finds it appropriate.

Orrick added, “I am interested in cases involving interference with devices, dealing with this issue of how significant the injury needs to be.”

The judge in August advanced the plaintiffs’ larceny, California Invasion of Privacy Act and unjust enrichment claims. Notable dismissed claims include Unfair Competition Law claims, Consumer Legal Remedies Act claims and California Comprehensive Computer Data Access and Fraud Act claims.

Follow @nhanson_reports