{"id":3364,"date":"2026-10-26T17:37:07","date_gmt":"2026-10-26T21:37:07","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=3364"},"modified":"2026-10-26T17:37:08","modified_gmt":"2026-10-26T21:37:08","slug":"fifth-circuit-reverses-dismissal-of-adtech-class-action-on-narrow-grounds-finding-sufficient-factual-allegations-of-disclosure-of-phi","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2026\/10\/26\/fifth-circuit-reverses-dismissal-of-adtech-class-action-on-narrow-grounds-finding-sufficient-factual-allegations-of-disclosure-of-phi\/","title":{"rendered":"Fifth Circuit Reverses Dismissal Of Adtech Class Action On Narrow Grounds, Finding Sufficient Factual Allegations Of Disclosure Of PHI"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/em><\/strong>\u00a0 On October 23, 2026, in Rand, et al. v. Eyemart Express, LLC, 2026 WL 3180055 (5th Cir. Oct. 23, 2026), the U.S. Court of Appeals for the Fifth Circuit reversed <\/a>an order by the U.S. District Court for the Northern District of Texas in which the district court had dismissed a class action brought by website users alleging that a prescription eyewear seller\u2019s use of website advertising technology (\u201cadtech\u201d) violated the Electronic Communications Privacy Act (\u201cECPA\u201d) and other laws.\u00a0<\/em>

This ruling is significant in that it shows that in the hundreds of adtech class actions across the nation seeking millions (or billions) in dollars in statutory damages under the ECPA and other laws, courts ruling on Rule 12(b)(6) motions and drawing all reasonable inferences in the light most favorable to plaintiffs may find plausible allegations that a website operator in fact transmitted private information to an adtech company, such that website owners seeking to challenge adtech class actions under Rule 12(b)(6) may find more success<\/em> in foregoing such factual challenges to well-pled allegations and instead pressing more legal arguments such as that alleged adtech transmissions do not plausibly allege an \u201cinterception\u201d or a \u201ccriminal or tortious purpose\u201d under the ECPA.\u00a0<\/em><\/p>\n\n\n\n

Background<\/strong><\/p>\n\n\n\n

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants\u2019 websites secretly captured plaintiffs\u2019 web-browsing data and sent it to Meta, Google, and other online advertising agencies and\/or data analytics companies.  In these adtech class actions, the key issue is often a claim brought under the ECPA on the theory that hundreds of thousands of website visitors times $10,000 per claimant in statutory damages equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including education, retailers, and consumer products.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided.<\/p>\n\n\n\n

To state a claim for violation of the ECPA, also known as the federal wiretap act, a plaintiff must show an intentional interception of the contents of an electronic communication.  The ECPA is a one-party consent statute, meaning that there is no liability under the statute for any party to the communication \u201cunless such communication is intercepted for the purposes of committing a criminal or tortious act in violation of the Constitution or laws of the United States or any State.\u201d  18 U.S.C. \u00a7 2511(2)(d)); 18 U.S.C. \u00a7 2511(2)(d).<\/p>\n\n\n\n

In Rand<\/em>, plaintiffs, Meta users who had already shared their names, photos, and other personal information through their Facebook accounts, brought suit against a seller of prescription eyewear.  According to the plaintiffs, the eyewear seller installed the Meta Pixel on its website, thereby transmitting to Meta, allegedly without the plaintiffs\u2019 consent, the following data about their visits to the website: (1) search terms and web browsing activities, as to those plaintiffs who used the site to search and browse for prescription glasses (the \u201cSearch Plaintiffs\u201d); (2) prescription information, as to plaintiffs who made purchases on the site (the \u201cPrescription Plaintiffs\u201d); and (3) as to both sets of plaintiffs, an anonymized identifier sufficient for Meta to link these search terms, web-browsing activities, and prescription information to the plaintiffs\u2019 Facebook profiles and send them targeted advertisements.  Id.<\/em> at *2.<\/p>\n\n\n\n

The plaintiffs also alleged that these allegedly transmitted data types met the definition of individually identifiable health information (\u201cIIHI\u201d) protected under the Health Insurance Portability and Accountability Act of 1996 (\u201cHIPAA\u201d).<\/p>\n\n\n\n

Further, the plaintiffs alleged that these alleged data transmissions of IIHI without consent violated the ECPA, the Missouri Wiretap Act, and Illinois Eavesdropping act, and constituted an intrusion upon seclusion and breach of contract.<\/p>\n\n\n\n

The district court dismissed the complaint under Rule 12(b)(6), finding that the Search Plaintiffs failed to state a claim for relief because they did not allege that they shared any IIHI with the eyewear seller.  As to the Prescription Plaintiffs, the district court acknowledged that they allegedly shared IIHI with the eyewear seller by entering their prescription information but found that they had failed to plausibly allege that any IIHI was disclosed to Meta.  Without sufficient allegations that any plaintiff\u2019s IIHI was shared with Meta, the district court concluded that each of the plaintiffs\u2019 claims necessarily failed.  Id.<\/em> at *1-2.<\/p>\n\n\n\n

On appeal, the plaintiffs argued that the district court\u2019s dismissal order should be reversed and their class action complaint reinstated because they adequately alleged both that they shared their IIHI with the defendant and that the Pixel on defendant\u2019s website conveyed that IIHI to Meta without their knowledge or consent.<\/p>\n\n\n\n

The Fifth Circuit\u2019s Decision<\/strong><\/p>\n\n\n\n

The Fifth Circuit agreed with the plaintiffs and reversed, finding, first, that the district court erred in finding lack of any plausible allegations that the Search Plaintiffs did not share any IIHI with the defendant.  As the Fifth Circuit explained, the defendant conceded that the information received through the Pixel was individually identifiable because through Facebook, the information was linked to specific users.  Id.<\/em> at *5.   Moreover, the Fifth Circuit found that the Search Plaintiffs adequately alleged that they shared information relating to their health conditions or the provision of healthcare by using website.  Specifically, the Fifth Circuit found that while the Search Plaintiffs did not allege the transmission of diagnoses or symptoms, \u201cIIHI is not so narrow\u201d and also includes information collected from an individual that \u201crelates to\u201d an individual\u2019s health or condition, to the provision of healthcare to an individual, or the individual\u2019s payment for healthcare.  Thus, taking the plaintiffs\u2019 allegations as true, the Fifth Circuit held that the district court erred in finding that the Search Plaintiffs had not shared any IIHI with the defendant.  Id.<\/em> at *5-7.<\/p>\n\n\n\n

Second, the Fifth Circuit found that the district court also erred in finding that the plaintiffs failed to plead that their IIHI was shared with Meta.  The district court had considered a figure from the complaint representing an example of transmitted data (created by the plaintiffs\u2019 attorney, not representing plaintiffs\u2019 activity), reasoning that it did not sufficiently specify transmission of the either plaintiffs\u2019 data or any prescription information.  Accordingly, the district court found that the complaint did not sufficiently allege that any IIHI was shared with Meta.  Id.<\/em> at *7.  The Fifth Circuit disagreed. It opined that IIHI is not so narrow that it applies only to specific prescription information and includes, also, interactions on the website relating to plaintiffs\u2019 health.  Moreover, the Fifth Circuit found that the figure in the complaint was provided only by way of example and did not contradict other factual allegations that the Fifth Circuit found alleged the transmission of data to Meta relating to the \u201cPrescription Plaintiffs\u2019 actual purchases.\u201d  Id.<\/em><\/p>\n\n\n\n

For these reasons, the Fifth Circuit reversed the dismissal order and remanded for further proceedings.<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

Rand<\/em> is a cautionary tale for defendant website operators seeking to dismiss adtech class actions under Rule 12(b)(6) on the basis that plaintiffs failed to plausibly allege that the defendant transmitted the plaintiffs\u2019 private data to an adtech company. <\/p>\n\n\n\n

While whether any given plaintiff\u2019s private data was in fact transmitted to an adtech company by a website operator remains an individualized issue dependent on browser type, social media account login status, and cookie blocking features, which courts have found sufficiently individualized to prevent named plaintiffs from establishing the defendant\u2019s liability to alleged class members under Rule 23 (as we blogged about here<\/a> and here<\/a>), courts must, however, take any allegations of adtech transmissions as true for purposes of Rule 12(b)(6).<\/p>\n\n\n\n

For these reasons, adtech class action defendants bringing Rule 12(b)(6) motions often argue for and sometimes achieve dismissal of ECPA claims, instead, on the basis of no plausibly alleged interception, when an internet-based communication is allegedly forwarded to an adtech company as opposed to being intercepted mid-flight, and no plausibly alleged criminal or tortious purpose where the plaintiffs fail to allege that the defendant had the purpose to violate any statute but allege a purpose rather to engage in advertising or data analytics.  (See, e.g.,<\/em> our prior blog entry discussing one of these successful dismissals, here<\/a>.)  Notably, the Fifth Circuit\u2019s decision in Rand<\/em> did not address these arguments.  Website owners facing adtech ECPA class actions would do well to press such arguments where appropriate.<\/p>\n\n\n\n

Corporate counsel seeking to deter ECPA litigation should also keep in mind the following best practices (discussed in more detail in our prior blog post, here<\/a>): (1) add or update arbitration clauses to deter class actions and mitigate the risks of mass arbitration; (2) update website terms of use, data privacy policies, and vendor agreements; and (3) audit and adjust uses of website advertising technologies.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick Duane Morris Takeaways:\u00a0 On October 23, 2026, in Rand, et al. v. Eyemart Express, LLC, 2026 WL 3180055 (5th Cir. Oct. 23, 2026), the U.S. Court of Appeals for the Fifth Circuit reversed an order by the U.S. District Court for the Northern … <\/p>\n

Continue reading “Fifth Circuit Reverses Dismissal Of Adtech Class Action On Narrow Grounds, Finding Sufficient Factual Allegations Of Disclosure Of PHI”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,122,145,12],"class_list":["post-3364","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","author_category":"","last_name":"Maatman Jr.","first_name":"Gerald L.","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/geraldmaatman.html","description":"Read Gerald's bio.<\/a>"},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","author_category":"","last_name":"Donoho","first_name":"Justin","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/justindonoho.html","description":"Read Justin's Bio<\/a>"},{"term_id":145,"user_id":740,"is_guest":0,"slug":"hhryan","display_name":"Hayley Ryan","avatar_url":{"url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg","url2x":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg"},"author_category":"1","last_name":"Ryan","first_name":"Hayley","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/hayleyryan.html","description":"Read Hayley's bio.<\/a>"},{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","author_category":"","last_name":"Zmick","first_name":"Tyler Z.","job_title":"","user_url":"","description":"Read Tyler's bio.<\/a>"}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/3364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=3364"}],"version-history":[{"count":2,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/3364\/revisions"}],"predecessor-version":[{"id":3368,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/3364\/revisions\/3368"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=3364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=3364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=3364"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=3364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}