Health care providers and other entities are increasingly facing class action lawsuits over the use of tracking technologies on their websites—particularly pixels that transmit user data to platforms like Meta and Google. One such case recently settled for $6.75 million. These lawsuits often catch providers off guard, as they stem from routine, widely used website configurations. Plaintiffs typically allege that web analytics and functionality tools capture health-related behavior or personal identifiers without proper safeguards or consent. Plaintiffs are filing lawsuits en masse, and even inadvertent use of tracking technologies can carry legal risk.
What Are Pixels and Why Should I Care?
Tracking technologies are commonly implemented by embedding small snippets of code into a website—typically by marketing teams, IT staff, or outside developers—to monitor user behavior. Pixels are among the most widely used tools.
Due to the way the internet functions, these tools often collect data linked to an IP address, device advertising ID, or social media profile. On health-related websites, lawsuits allege that pixels capture sensitive user behavior, especially on pages tied to patient portals, appointment scheduling, bill payment, or research into medical conditions. These suits catch many providers off guard, having implemented these tools for routine business purposes without recognizing the legal risks involved.
Plaintiffs filing these suits typically reference the following laws:
- Federal and state wiretap laws, such as the Electronic Communications Privacy Act (ECPA);
- Common law claims, including invasion of privacy and breach of contract;
- State consumer protection statutes;
- The Video Privacy Protection Act (VPPA), for sites with embedded video players;
- State health privacy laws; and
- HIPAA, to demonstrate the sensitivity of health data and the expectation of robust privacy and security safeguards.
Key Developments
Federal and state regulators are paying increasing attention to tracking technologies that may result in the unauthorized disclosure of personal information, including identifiable health data. The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) has issued guidance cautioning against the use of such tools in ways that may improperly capture or transmit health information. In the wake of this guidance, plaintiffs’ law firms have filed numerous lawsuits and sent demand letters to providers across the country, seeking class-wide settlements tied to the use of tracking technologies.
Looking Ahead
We urge providers and other entities with public-facing websites to review their current use of tracking tools. While prior exposure may persist, taking appropriate actions now can help mitigate future liability and demonstrate proactive compliance to both plaintiffs and regulators.
As litigation over pixel tracking continues to develop, health care providers should treat this as a significant compliance and litigation risk. Marketing, legal, IT, web development, and compliance teams should work collaboratively to mitigate exposure and align practices with HIPAA, state privacy laws, and consumer protection standards. At Garfunkel Wild, our team of health care-focused cyber, privacy, and litigation attorneys assists clients by evaluating websites for tracking risks, drafting tailored Privacy Policies and Terms of Use, reviewing and negotiating vendor agreements (including with data minimization platforms), ensuring compliance with applicable regulations and guidance, and responding to demand letters and lawsuits brought against providers.
If your organization has received a demand letter, been named in pixel-related litigation, or is concerned about its current website tracking practices, please contact us promptly to assess risk and implement appropriate defenses.
For questions regarding the above, or to discuss your organization’s specific needs, please reach out to the authors, the Garfunkel Wild attorney with whom you regularly work, or contact us at [email protected].
