Meta Pixel Class Action Certified: Judge Orrick Approves Four Nationwide Classes Over Health Data

The Meta Pixel class action over hospital websites is now certified. On October 30, 2026, Senior U.S. District Judge William H. Orrick of the Northern District of California certified four nationwide classes of Facebook users who allege that Meta's Pixel tracking code collected their sensitive health information from healthcare websites and apps, according to MLex. The ruling in In re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580-WHO, lets the plaintiffs pursue wiretap and privacy claims for millions of users together rather than one by one. Under the California Invasion of Privacy Act, statutory damages are counted per violation, so a certified class turns small per-person sums into an aggregate that can reach the billions.

Orrick rejected the core of Meta's opposition: that differences in the information collected, in patients' consent, and in how each provider configured its tracking tools made a classwide trial unworkable. He did not give the plaintiffs everything. MLex reports that he limited the California wiretapping claims to communications with a California connection and narrowed a class alleging unauthorized intrusion into patients' devices to exclude collection methods that did not involve those devices. The full order had not been widely reported by November 1, and the exact certified class definitions are not yet public. This article separates what has been reported about the order from the case record that is already verified.

Was the Meta Pixel class action certified?

Yes. MLex reported on October 30, 2026 that Judge Orrick certified four nationwide classes in the healthcare Pixel case. A second MLex piece on October 31 described the outcome as Meta losing its bid to block class certification. The order resolves a motion the plaintiffs filed on September 30, 2025, which asked for four classes of Facebook users from June 17, 2018 onward. Orrick heard argument on June 12, 2026 and said a written order would follow.

The certification order is the most consequential ruling in the case since it was consolidated in 2022. Before it, Meta faced the claims of a handful of named plaintiffs. Now it faces claims on behalf of every class member who fits the certified definitions. The order also distinguishes the healthcare case from two other Pixel cases that went the other way this year. Those are discussed below.

What classes did Judge Orrick certify in the Meta Pixel healthcare case?

The plaintiffs proposed four classes of Facebook users whose health-related activity on provider websites or apps was allegedly transmitted to Meta, starting June 17, 2018. One proposed class, the "Patient Status Button-Click Class," covered users whose clicks on patient-portal, appointment, bill-payment, or diagnostic-assessment buttons were obtained by Meta from healthcare providers. A broader class covered health information more generally.

On the public reporting, Orrick certified four classes. He trimmed two theories:

• CIPA geography. The California Invasion of Privacy Act claims were limited to communications with a California connection. Users nationwide remain in the classes for other claims, but the CIPA wiretap theory does not travel with every out-of-state communication.
• Device intrusion. A class built on unauthorized intrusion into patients' devices was narrowed to exclude data-collection methods that did not involve the patients' own devices. This is consistent with the Comprehensive Computer Data Access and Fraud Act, California Penal Code section 502, which requires access to a computer, system or network, and with common-law trespass to chattels.

The reports do not say which of the surviving claims (the federal Wiretap Act, CIPA section 631, the CDAFA, invasion of privacy, trespass to chattels, unjust enrichment and statutory larceny) each class carries. Practitioners should read the order itself before assuming a given claim was certified for a given class.

Why did the court reject Meta's arguments against class certification?

Meta argued that the case broke apart on individual questions, which is a Predominance objection under Rule 23(b)(3). Its three main variation arguments, as MLex describes them, were:

1. Different data. The Pixel was installed by many providers on many pages, and what it captured varied from site to site.
2. Different consent. Patients encountered different privacy policies, cookie banners and portal terms, and some may have agreed to tracking.
3. Different provider practices. Each hospital or clinic decided whether, where and how to deploy the code.

Orrick found that these differences did not make classwide litigation unsuitable. That holding matters most on consent. In privacy class actions, defendants regularly defeat certification by showing that consent must be decided person by person. A court that accepts a classwide consent framework, built on Meta's own terms and on what Meta received rather than on each patient's experience, removes the defense's strongest certification argument.

Valuation was the other question. Before the June 12 hearing, Orrick sent the parties four questions. According to the Daily Journal, one asked whether a product with no market, here health information, can be valued at all, and if so how to do it reliably. Measuring damages on a classwide basis is part of the Commonality and predominance analysis after Comcast Corp. v. Behrend. The certification order indicates the plaintiffs gave him enough on that question, at least for the classes he approved. Statutory damages also help plaintiffs here: CIPA and the federal Wiretap Act fix a sum per violation, so the court does not need to decide what each person's data was worth.

How the Meta Pixel case got here: a timeline

The case consolidates proposed class actions filed in 2022 after reporting that hospital websites were sending patient information to Meta through the Pixel. The complaint alleges that at least 664 hospital systems or medical provider web properties transmitted patient data to Meta through the tool. HIPAA Journal noted that Meta is not a HIPAA business associate and that patients gave no HIPAA authorizations, so the disclosures would be impermissible under the Privacy Rule. HIPAA itself creates no private right of action, which is why the claims run through wiretap, computer-fraud and common-law theories.

Date	Event
2022	Proposed class actions against Meta over the Pixel on provider websites are consolidated in the N.D. Cal. before Judge Orrick
Aug.–Sept. 2023	Orrick tentatively, then formally, trims the complaint roughly in half, advancing federal Wiretap Act, CIPA, unjust enrichment and larceny claims
2023	Orrick denies a preliminary injunction, calling the allegations "troubling" but finding it "too early" to conclude the public interest supports a mandatory injunction
2024	On a renewed motion, Orrick holds the plaintiffs stated claims for invasion of privacy, trespass to chattels and CDAFA violations
Feb. 2025	At a sanctions hearing over deleted button-click data, Orrick finds no "malintent" but says the data should have been preserved
Sept. 30, 2025	Plaintiffs move to certify four classes of Facebook users from June 17, 2018 onward
Mar. 30, 2026	In the separate Meta Pixel tax filing cases, Judge P. Casey Pitts denies certification without prejudice
June 12, 2026	Orrick hears the healthcare certification motion after posing four written questions, including how to value health data
Oct. 30, 2026	Orrick certifies four nationwide classes, limiting CIPA claims and narrowing the device-intrusion class
~Nov. 13, 2026	Fourteen-day window for a Rule 23(f) petition closes (computed from an Oct. 30 entry)

Cohen Milstein is among interim co-lead class counsel. The court's certification order would ordinarily also appoint class counsel under Rule 23(g). The public reports do not say who was appointed.

How much could Meta owe in the Meta Pixel healthcare lawsuit?

No damages figure has been found or sought in a verified filing, and the class size has not been reported. The exposure comes from the statutes, and the arithmetic explains why certification matters so much.

Claim	Statutory remedy	Classwide effect
CIPA § 631 (wiretapping), via § 637.2	$5,000 per violation, or three times actual damages, whichever is greater	Fixed sum per violation and no proof of actual loss required; now limited to California-connected communications
Federal Wiretap Act, 18 U.S.C. § 2520	Greater of $100 per day of violation or $10,000, plus punitive damages and attorney's fees	Statutory damages are discretionary with the court, which tempers but does not remove the exposure
CDAFA, Cal. Penal Code § 502(e)	Compensatory damages and attorney's fees	Tied to access to the user's device, which is why the device-intrusion class was narrowed
Invasion of privacy / intrusion upon seclusion	Compensatory and potentially punitive damages	Requires a showing that the intrusion was highly offensive, which plaintiffs will argue is common to health data
Unjust enrichment / larceny (Penal Code § 496)	Restitution; § 496(c) allows treble damages	Depends on valuing what Meta gained from the data

As a rough illustration, 100,000 California class members with a single CIPA violation each would put $500 million in statutory damages at issue. Real figures will depend on the certified definitions, on how violations are counted, and on whether courts reduce aggregate statutory awards on due-process grounds. Defendants facing large statutory-damages awards routinely raise that due-process argument.

Meta Pixel healthcare vs. tax filing: why one class survived

Seven months before Orrick's ruling, Meta defeated certification in In re Meta Pixel Tax Filing Cases before Judge P. Casey Pitts of the same district. The denial was without prejudice. The reasons for that outcome map onto the healthcare ruling:

• Data actually received. In the tax case, discovery showed that Meta received no tax-filing information about any named plaintiff. That undercut the plaintiffs' standing and typicality. In the healthcare case, the button-click theory focuses on data the plaintiffs say Meta did receive from provider sites, including portal logins and appointment requests.
• Class scope. Pitts found that the certification motion expanded the classes beyond those pleaded in the complaint. That exposed members to individual defenses, including CIPA's one-year limitations period, and required burdensome individualized inquiries. Orrick narrowed rather than rejected the classes before him.
• Standing by sub-class. In the tax case, no named plaintiff had standing for the TaxAct classes. Nothing in the healthcare reporting suggests a similar gap.

For defense counsel, the tax case is still the template for opposing pixel-class certification: show through discovery that the defendant did not receive the specific data alleged. For plaintiffs, the healthcare case is now the template for getting past consent and variation arguments.

Can Meta appeal the class certification order?

Meta can ask, but there is no automatic right to appeal. Federal Rule of Civil Procedure 23(f) lets a party petition the court of appeals for permission to appeal an order granting or denying class certification within 14 days after the order is entered. Measured from an October 30 entry, the deadline falls on or about November 13, 2026. The Ninth Circuit decides whether to hear such petitions at its discretion. It looks at whether the order is a "death knell" for one side, whether it raises an unsettled and fundamental question of law, and whether it is manifestly erroneous.

The Ninth Circuit has recently been willing to review certification orders in consumer cases. On October 16, 2026, a panel vacated class certification in LoSavio v. Tesla because the district court inferred classwide exposure to a statement that buyers did not have to see. Meta is likely to argue that consent and data variation raise similar exposure problems. A 23(f) petition does not stay district court proceedings unless the district judge or the court of appeals orders a stay.

If the order stands, the next steps are Class Notice to members of each certified class, an opt-out period because these are damages classes, and expert and dispositive-motion practice before any trial date is set.

Why is this a Meta Pixel class action and not a mass arbitration?

Arbitration readers will notice what is absent from this docket. Many consumer privacy cases over tracking code end up in individual arbitration because the defendant, or a company whose terms the defendant can invoke, has an Arbitration Clause with a Class Action Waiver. That shift is what produces a Mass Arbitration, where thousands of individual demands replace one class.

The Pixel healthcare case followed a different route for two structural reasons:

• Meta's own terms send disputes to court. Facebook's terms of service, as quoted and enforced by federal courts, require user claims to be resolved exclusively in the U.S. District Court for the Northern District of California or a state court in San Mateo County, under California law. Federal judges have transferred user suits to San Francisco on the strength of that forum clause. The terms channel user disputes to a courthouse, not to individual arbitration, which makes a Rule 23 class the natural vehicle.
• The hospitals' terms are not Meta's. Patients deal with providers, not with Meta, on portal and appointment pages. Even where a provider's portal terms contain an arbitration agreement, Meta would have to enforce it as a nonsignatory, through equitable estoppel or a third-party-beneficiary theory. Courts decide that question one agreement at a time, and it is harder to win across hundreds of providers.

The contrast with the Google Contact Center AI case is direct. On October 22, 2026, Judge Rita F. Lin of the same court compelled three callers to arbitration under agreements with Verizon, Uber and Discover that Google never signed. That ruling turned on three identified agreements. The Pixel case involves at least 664 provider web properties with no uniform clause. The reported rulings in the healthcare case do not involve a Motion to Compel Arbitration.

California law adds pressure. SB 690, signed on September 30, 2026, ends private CIPA pen register and trap-and-trace suits over websites. It leaves section 631 wiretap claims, the theory certified here, in place. Claimants' counsel weighing a mass arbitration against a business with an arbitration clause will now cite a certified section 631 class as evidence of claim value.

Pixel litigation this month: Flo, Seattle Children's and Eyemart

The certification arrived in a busy October for tracking-pixel law:

• Baker v. Seattle Children's Hospital (Wash. Oct. 8, 2026). The Washington Supreme Court unanimously held that the state Privacy Act, which protects communications "between two or more individuals," does not reach a patient's search answered by a hospital's automated website. The holding is narrow and statute-specific. A concurrence would protect patient-to-staff messages.
• Rand v. Eyemart Express (5th Cir. Oct. 23, 2026). The Fifth Circuit reversed the dismissal of a putative class action over the Meta Pixel on an eyewear retailer's site. It held that browsing and scheduling activity can plausibly be individually identifiable health information and that the plaintiffs had Article III standing.
• Frasco v. Flo Health (N.D. Cal.). A jury found on August 1, 2025 that Meta violated CIPA by intercepting reproductive-health data from the Flo app. On October 30, 2026, the same day as Orrick's order, MLex reported that Judge James Donato criticized Meta for delays in finalizing the verdict. Flo is the clearest example of where a certified CIPA class can lead at trial.

Together, these decisions show that pixel claims are not uniformly winning or losing. They turn on the statute, on what the defendant actually received, and on whether certification survives.

What it means for healthcare providers, defendants, claimants' counsel and funders

For healthcare providers. Hospitals are not defendants in the Meta case, but the certified classes are defined by activity on their sites. Expect third-party subpoenas for tag-configuration records and consent-banner history. Expect parallel suits as well, since many providers have already faced their own pixel class actions. Providers that removed the Pixel should keep documents showing when they did so, because the class period runs from June 17, 2018.

For technology defendants. The tax-filing denial and the healthcare grant show where the fight is decided: data-receipt discovery and class definition. A defendant that can prove it did not receive the alleged category of data can still defeat certification. A defendant relying on varied consent across third-party sites now has adverse precedent from the Northern District of California. Drafting teams should also note that a forum clause without an arbitration agreement is what made a nationwide class available here.

For claimants' counsel. A certified section 631 class against the platform, rather than against individual sites, is a template for other tracking-code cases. It is also a valuation benchmark for individual arbitration demands where the target business does have a clause. Counsel should watch the Rule 23(f) docket before treating the order as settled.

For litigation funders. Statutory-damages classes with a certified order and a plausible path to trial are the profile that attracts Third-Party Litigation Funding. The Northern District of California requires disclosure of funders in class actions under its standing order, and funding disclosure is a live issue in privacy litigation.

This analysis is not legal advice.

Meta Pixel class action: frequently asked questions

Was the Meta Pixel class action certified?

Yes. On October 30, 2026, Judge William H. Orrick certified four nationwide classes of Facebook users in In re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580-WHO, in the Northern District of California, as reported by MLex.

Who is included in the Meta Pixel healthcare class action?

The classes cover Facebook users whose health-related activity on healthcare websites or apps was allegedly sent to Meta through the Pixel, from June 17, 2018 onward. The certified definitions have not been publicly reported. CIPA claims are limited to communications with a California connection.

Is there a Meta Pixel settlement, and do I need to file a claim?

No settlement has been announced in the healthcare case, and there is no claim form. If the certification stands, class members should receive court-approved notice explaining how to stay in the class or opt out.

How much could Meta owe?

No damages figure has been set. CIPA provides $5,000 per violation, and the federal Wiretap Act provides the greater of $10,000 or $100 per day, so aggregate exposure depends on class size and how violations are counted.

Can Meta appeal the certification order?

Meta may file a Rule 23(f) petition asking the Ninth Circuit for permission to appeal within 14 days of the order's entry, on or about November 13, 2026. The Ninth Circuit decides at its discretion whether to accept the appeal.

How is this different from the Meta Pixel tax filing case?

In the tax filing cases, Judge P. Casey Pitts denied certification on March 30, 2026. Discovery showed that Meta received no tax-filing data about the named plaintiffs, and the proposed classes went beyond those pleaded. The healthcare classes were narrowed but certified.