By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick
Duane Morris Takeaways: On October 23, 2026, in Rand, et al. v. Eyemart Express, LLC, 2026 WL 3180055 (5th Cir. Oct. 23, 2026), the U.S. Court of Appeals for the Fifth Circuit reversed an order by the U.S. District Court for the Northern District of Texas in which the district court had dismissed a class action brought by website users alleging that a prescription eyewear seller’s use of website advertising technology (“adtech”) violated the Electronic Communications Privacy Act (“ECPA”) and other laws.
This ruling is significant in that it shows that in the hundreds of adtech class actions across the nation seeking millions (or billions) in dollars in statutory damages under the ECPA and other laws, courts ruling on Rule 12(b)(6) motions and drawing all reasonable inferences in the light most favorable to plaintiffs may find plausible allegations that a website operator in fact transmitted private information to an adtech company, such that website owners seeking to challenge adtech class actions under Rule 12(b)(6) may find more success in foregoing such factual challenges to well-pled allegations and instead pressing more legal arguments such as that alleged adtech transmissions do not plausibly allege an “interception” or a “criminal or tortious purpose” under the ECPA.
Background
This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants’ websites secretly captured plaintiffs’ web-browsing data and sent it to Meta, Google, and other online advertising agencies and/or data analytics companies. In these adtech class actions, the key issue is often a claim brought under the ECPA on the theory that hundreds of thousands of website visitors times $10,000 per claimant in statutory damages equals a huge amount of damages. Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including education, retailers, and consumer products. Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided.
To state a claim for violation of the ECPA, also known as the federal wiretap act, a plaintiff must show an intentional interception of the contents of an electronic communication. The ECPA is a one-party consent statute, meaning that there is no liability under the statute for any party to the communication “unless such communication is intercepted for the purposes of committing a criminal or tortious act in violation of the Constitution or laws of the United States or any State.” 18 U.S.C. § 2511(2)(d)); 18 U.S.C. § 2511(2)(d).
In Rand, plaintiffs, Meta users who had already shared their names, photos, and other personal information through their Facebook accounts, brought suit against a seller of prescription eyewear. According to the plaintiffs, the eyewear seller installed the Meta Pixel on its website, thereby transmitting to Meta, allegedly without the plaintiffs’ consent, the following data about their visits to the website: (1) search terms and web browsing activities, as to those plaintiffs who used the site to search and browse for prescription glasses (the “Search Plaintiffs”); (2) prescription information, as to plaintiffs who made purchases on the site (the “Prescription Plaintiffs”); and (3) as to both sets of plaintiffs, an anonymized identifier sufficient for Meta to link these search terms, web-browsing activities, and prescription information to the plaintiffs’ Facebook profiles and send them targeted advertisements. Id. at *2.
The plaintiffs also alleged that these allegedly transmitted data types met the definition of individually identifiable health information (“IIHI”) protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
Further, the plaintiffs alleged that these alleged data transmissions of IIHI without consent violated the ECPA, the Missouri Wiretap Act, and Illinois Eavesdropping act, and constituted an intrusion upon seclusion and breach of contract.
The district court dismissed the complaint under Rule 12(b)(6), finding that the Search Plaintiffs failed to state a claim for relief because they did not allege that they shared any IIHI with the eyewear seller. As to the Prescription Plaintiffs, the district court acknowledged that they allegedly shared IIHI with the eyewear seller by entering their prescription information but found that they had failed to plausibly allege that any IIHI was disclosed to Meta. Without sufficient allegations that any plaintiff’s IIHI was shared with Meta, the district court concluded that each of the plaintiffs’ claims necessarily failed. Id. at *1-2.
On appeal, the plaintiffs argued that the district court’s dismissal order should be reversed and their class action complaint reinstated because they adequately alleged both that they shared their IIHI with the defendant and that the Pixel on defendant’s website conveyed that IIHI to Meta without their knowledge or consent.
The Fifth Circuit’s Decision
The Fifth Circuit agreed with the plaintiffs and reversed, finding, first, that the district court erred in finding lack of any plausible allegations that the Search Plaintiffs did not share any IIHI with the defendant. As the Fifth Circuit explained, the defendant conceded that the information received through the Pixel was individually identifiable because through Facebook, the information was linked to specific users. Id. at *5. Moreover, the Fifth Circuit found that the Search Plaintiffs adequately alleged that they shared information relating to their health conditions or the provision of healthcare by using website. Specifically, the Fifth Circuit found that while the Search Plaintiffs did not allege the transmission of diagnoses or symptoms, “IIHI is not so narrow” and also includes information collected from an individual that “relates to” an individual’s health or condition, to the provision of healthcare to an individual, or the individual’s payment for healthcare. Thus, taking the plaintiffs’ allegations as true, the Fifth Circuit held that the district court erred in finding that the Search Plaintiffs had not shared any IIHI with the defendant. Id. at *5-7.
Second, the Fifth Circuit found that the district court also erred in finding that the plaintiffs failed to plead that their IIHI was shared with Meta. The district court had considered a figure from the complaint representing an example of transmitted data (created by the plaintiffs’ attorney, not representing plaintiffs’ activity), reasoning that it did not sufficiently specify transmission of the either plaintiffs’ data or any prescription information. Accordingly, the district court found that the complaint did not sufficiently allege that any IIHI was shared with Meta. Id. at *7. The Fifth Circuit disagreed. It opined that IIHI is not so narrow that it applies only to specific prescription information and includes, also, interactions on the website relating to plaintiffs’ health. Moreover, the Fifth Circuit found that the figure in the complaint was provided only by way of example and did not contradict other factual allegations that the Fifth Circuit found alleged the transmission of data to Meta relating to the “Prescription Plaintiffs’ actual purchases.” Id.
For these reasons, the Fifth Circuit reversed the dismissal order and remanded for further proceedings.
Implications For Companies
Rand is a cautionary tale for defendant website operators seeking to dismiss adtech class actions under Rule 12(b)(6) on the basis that plaintiffs failed to plausibly allege that the defendant transmitted the plaintiffs’ private data to an adtech company.
While whether any given plaintiff’s private data was in fact transmitted to an adtech company by a website operator remains an individualized issue dependent on browser type, social media account login status, and cookie blocking features, which courts have found sufficiently individualized to prevent named plaintiffs from establishing the defendant’s liability to alleged class members under Rule 23 (as we blogged about here and here), courts must, however, take any allegations of adtech transmissions as true for purposes of Rule 12(b)(6).
For these reasons, adtech class action defendants bringing Rule 12(b)(6) motions often argue for and sometimes achieve dismissal of ECPA claims, instead, on the basis of no plausibly alleged interception, when an internet-based communication is allegedly forwarded to an adtech company as opposed to being intercepted mid-flight, and no plausibly alleged criminal or tortious purpose where the plaintiffs fail to allege that the defendant had the purpose to violate any statute but allege a purpose rather to engage in advertising or data analytics. (See, e.g., our prior blog entry discussing one of these successful dismissals, here.) Notably, the Fifth Circuit’s decision in Rand did not address these arguments. Website owners facing adtech ECPA class actions would do well to press such arguments where appropriate.
Corporate counsel seeking to deter ECPA litigation should also keep in mind the following best practices (discussed in more detail in our prior blog post, here): (1) add or update arbitration clauses to deter class actions and mitigate the risks of mass arbitration; (2) update website terms of use, data privacy policies, and vendor agreements; and (3) audit and adjust uses of website advertising technologies.