Judge James E. Simmons, Jr., in the Southern District of California, addresses a motion to dismiss in a privacy lawsuit involving a healthcare provider’s use of the Meta Pixel tracking tool on its website.
Meta Pixel and Healthcare Data
The defendant operates a website offering healthcare services and information. The plaintiff alleged that the site’s use of Meta Pixel resulted in the interception and sharing of users’ page visit information, which was linked to their Facebook identification numbers for advertising purposes. The plaintiff claimed that this data could reveal sensitive healthcare information and that users were not informed or asked for consent regarding this tracking.
CMIA Claim Dismissed
The court found that the plaintiff failed to adequately allege the disclosure of Protected Health Information (PHI) as defined by HIPAA and California’s Confidentiality of Medical Information Act (CMIA). The complaint did not specify that the tracked data revealed any information about the plaintiff’s health, conditions, or patient status. General allegations of website visits and tracked events (such as “search,” “contact,” or “page_view”) were not enough to constitute PHI.
ECPA and CIPA Claims Dismissed
The court held that the plaintiff did not plausibly allege interception of the “contents of communication,” as required by both the Electronic Communications Privacy Act (ECPA) and the California Invasion of Privacy Act (CIPA). Tracking of webpage addresses and Facebook IDs was considered record or identifying information, not the content of communications.
Invasion of Privacy Claim Dismissed
The court found that the plaintiff did not allege a sufficiently serious intrusion or specify the private information at issue, which is necessary to establish a highly offensive breach of social norms and maintain a claim for invasion of privacy.
Pen Register Claim May Proceed
The court allowed the claim under California Penal Code § 638.51 (use of a pen register or trap and trace device) to proceed. The Meta Pixel was found to meet the statutory definition of such a device, as it tracked addressing information (such as Facebook IDs) without a court order.
To state a claim for improper use of a pen register or trap and trace device, a plaintiff must allege that a defendant used a “device or process” capable of recording “dialing, routing, addressing, or signaling information […] but not the contents of a communication” from a “wire or electronic communication” without a court order. Cal. Penal Code § 638.50-51. Data capable of being associated with a user’s identity falls within the statutory definition of addressing information. Shah v. Fandom, Inc., 754 F.Supp.3d 924, 929 (N.D. Cal 2024) (finding that plaintiff stated a claim for violation of Cal. Penal Code § 638.51 by alleging a website used software that tracked her internet protocol (“IP”) address). The Meta Pixel software meets the statutory definition of a pen register or trap and trace device because it is “software that identifies consumers, gathers data, and correlates that data through unique ‘fingerprinting.’ ” Zarif v. Hwareh.com, Inc., 789 F.Supp.3d 880, 898 (S.D. Cal. 2025) (quoting Greenley v. Kochava, Inc., 684 F.Supp.3d 1024, 1050 (S.D. Cal 2025); see also Moody v. C2 Educational Systems Inc., 742 F.Supp.3d 1072, 1077 (C.D. Cal. 2024) (finding that software that tracked browser and device data and form data met the definition of a pen register or trap and trace device). Thus, a plaintiff may state a claim for violation of § 638.51 by alleging that a defendant used the Meta Pixel on their site and that the Meta Pixel tracked record or identifying information regarding their use of the site. See id.
*5 Here, Plaintiff alleges that Defendant installed the Meta Pixel on their website and that it tracked information related to her visit to the site and her Facebook ID. FAC ¶ 72-74. These allegations are sufficient to state a claim for Use of a Pen Register or Trap and Trace Device because they plausibly show that Defendant used a device to record or capture addressing information without a court order. See Zarif, 789 F.Supp.3d at 898.
AMY WRIGHT v. TRUECARE PROPERTY HOLDINGS, LLC, No. 3:25-CV-00786-JES-BLM, 2025 WL 3248749 (S.D. Cal. Nov. 21, 2025).
