Fifth Circuit Reverses Dismissal of Meta Pixel Wiretap Lawsuit

Fifth Circuit Reverses Dismissal of Meta Pixel Wiretap Lawsuit

The Fifth Circuit reversed the dismissal of a putative class action over Meta Pixel tracking on Eyemart Express's website on October 23, 2026, holding that five plaintiffs adequately pleaded that their health information reached Meta. The panel left every substantive claim for the district court.

Information last verified on October 24, 2026.

Status: Reversed and remanded. The published opinion in Rand v. Eyemart Express, L.L.C., No. 25-10784 (5th Cir. Oct. 23, 2026), authored by Judge Stephen A. Higginson for a panel of Judges Haynes, Higginson and Ho, reverses the Northern District of Texas's dismissal with prejudice and sends the case back for further proceedings. The merits are undecided. The panel held only that the plaintiffs have Article III standing and that the two threshold findings the dismissal rested on were wrong, and it directed that the district court reconsider all of the plaintiffs' substantive claims. Whether Eyemart will seek panel or en banc rehearing, and when the mandate will issue, are not known as of October 24, 2026.

Jurisdiction scope: This article covers one published federal appellate decision from the U.S. Court of Appeals for the Fifth Circuit, which binds the federal district courts of Texas, Louisiana and Mississippi, together with the federal Wiretap Act at 18 U.S.C. 2510 to 2523, which applies nationwide, and the Missouri wiretap statute at Mo. Rev. Stat. 542.402. It does not state the recording or eavesdropping rules of any other state. For those, see our index of state by state recording and wiretap statutes.

What Happened

A Fifth Circuit panel reversed the dismissal of a putative class action against Eyemart Express, L.L.C. on October 23, 2026 and remanded it to the Northern District of Texas. Five Facebook users, Rachelle Rand, Esperanza Gottschau, Ramon Soto, Georgianna Lash and Aaron Mees, alleged that Eyemart's website runs the Meta Pixel, a tracking tool from Facebook's parent company, and that the Pixel sent their searches, clicks, product viewing information and appointment scheduling information to Meta. According to the complaint, Eyemart does not obtain users' consent to that tracking and does not notify users of it.

The plaintiffs sued under the federal Wiretap Act, the Missouri Wiretap Act and the Illinois Eavesdropping Act, and also pleaded intrusion upon seclusion and breach of contract. The district court dismissed the amended complaint in full, with prejudice. The Fifth Circuit held that dismissal rested on two erroneous threshold findings.

The plaintiffs divided themselves into two groups. The Search Plaintiffs alleged that they used the site to browse and search for prescription eyewear, and one of them alleged that scheduling an eye exam caused the Pixel to send the name and location of the Eyemart store she visited to Meta. The Prescription Plaintiffs alleged that they bought prescription eyewear, which required them to enter prescription information on the site, and that their prescriptions and other health information went to Meta through the Pixel. All of them had already given Meta other personal details through their Facebook accounts, including names and photos, so that Meta could combine the two streams and identify them.

Eyemart moved to dismiss twice. On the first motion the district court found that the plaintiffs had standing but had not stated a claim, and gave them leave to amend. On the second motion, which did not renew the standing arguments, the district court dismissed everything with prejudice. It found that the Search Plaintiffs had not conveyed any IIHI to Eyemart at all, and that the Prescription Plaintiffs, although they had shared IIHI with Eyemart by entering prescription data, had not shown that any of it reached Meta. Without those foundational allegations, the district court reasoned, every claim failed.

On appeal Eyemart defended that ruling and, in the alternative, renewed its standing challenge. The panel rejected the standing argument and then took apart both threshold findings. Its concluding paragraph states the disposition precisely:

"In accordance with the foregoing, we agree with the district court that Plaintiffs have standing, and REVERSE the district court's dismissal on the grounds that the Search Plaintiffs had not shared IIHI with Eyemart and that neither the Search Plaintiffs nor the Prescription Plaintiffs' IIHI was shared with Meta and REMAND for further proceedings consistent with this opinion." Rand v. Eyemart Express, L.L.C., No. 25-10784, slip op. at 18 (5th Cir. Oct. 23, 2026)

The dismissal is gone and the two reasons behind it are rejected. Nothing in the opinion holds that Eyemart violated any wiretap statute, that the Pixel is an interception device, or that any claim will survive the next round of briefing.

On standing, the panel wrote that it had "no difficulty concluding that the unauthorized tracking of Plaintiffs' private health information and disclosure of that information to Meta is an invasion of privacy mirroring the harm addressed by these common law torts," naming intrusion upon seclusion and public disclosure of private facts as the analogues. It also rejected Eyemart's contention that the plaintiffs had to plead each element of intrusion upon seclusion to use it as a standing analogue, explaining that at this stage the comparison is between harms, not elements.

On the first threshold finding, the panel held that IIHI "is not so narrow" as Eyemart argued and that the information "need not reveal a specific diagnosis or condition; that it pertains to a condition or provision of healthcare is sufficient." It noted that Eyemart's counsel conceded at oral argument that what Meta received through the Pixel was individually identifiable, because the data was linked to specific Facebook users.

On the second, the panel faulted the district court for treating a single illustrative screenshot in the amended complaint, Figure 13, as dispositive while expressly disregarding the plaintiffs' other tracking allegations, and for drawing inferences about that figure in Eyemart's favor rather than the plaintiffs'. Quoting Arbuckle Mountain Ranch of Texas, Inc. v. Chesapeake Energy Corp., 810 F.3d 335, 340 (5th Cir. 2016), it wrote that "[u]nder the federal rules, we construe pleadings in their entirety when assessing their sufficiency."

What the Law Actually Says

Three statutes carry the plaintiffs' claims, and the Fifth Circuit construed none of them in this opinion.

The federal Wiretap Act, part of the Electronic Communications Privacy Act, makes it unlawful for any person to "intentionally intercept[], endeavor[] to intercept, or procure[] any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication," 18 U.S.C. 2511(1)(a), and separately reaches intentional disclosure and use of the contents of a communication by someone who knows or has reason to know it was unlawfully intercepted, 18 U.S.C. 2511(1)(c) and (d).

The definitions do the heavy lifting in a tracking case. "Intercept" means "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device," 18 U.S.C. 2510(4); "contents" "includes any information concerning the substance, purport, or meaning of that communication," 18 U.S.C. 2510(8); and "electronic communication" covers "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce," subject to four exclusions, 18 U.S.C. 2510(12). Our overview of how the federal Wiretap Act and ECPA fit together walks through those terms in more detail.

One provision does a great deal of work in website tracking cases: the party exception. Section 2511(2)(d) provides that it "shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State." On its face the exception covers a person who is a party to the communication, subject to the closing criminal or tortious purpose clause. Whether a website operator is such a party when a visitor communicates with its own server, and how that clause applies to tracking code, are contested questions this opinion does not reach. The Fifth Circuit did not reach that question in this opinion. A plaintiff who proves a violation may bring a civil action under 18 U.S.C. 2520(a) to recover "such relief as may be appropriate," and subsection (b) defines appropriate relief to include preliminary and other equitable or declaratory relief, damages under subsection (c) with punitive damages in appropriate cases, and a reasonable attorney's fee and litigation costs.

Missouri's wiretap statute is narrower on its face. Section 542.402.1 of the Revised Statutes of Missouri makes it a class E felony to knowingly intercept, endeavor to intercept, or procure another to intercept "any wire communication," and reaches oral communications only through a device that "transmits communications by radio or interferes with the transmission of such communication." Missouri has its own party exception at section 542.402.2(3), which permits interception "[f]or a person not acting under law to intercept a wire communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act." The structure mirrors the federal provision, down to the criminal or tortious purpose proviso.

The third claim arises under the Illinois Eavesdropping Act. The Fifth Circuit named that statute among the plaintiffs' claims and did not analyze it, so this article does not state its requirements; readers can start with our page on Illinois audio recording rules.

HIPAA sits in the background rather than the foreground. Footnote 2 of the opinion is explicit that the plaintiffs "do not assert a HIPAA claim, nor could they," citing Acara v. Banks, 470 F.3d 569, 570-71 (5th Cir. 2006), which held there is no private cause of action under HIPAA.

In this appeal the statute mattered chiefly as a definition. Footnote 2 also records that the plaintiffs allege Eyemart holds itself out as a HIPAA-covered entity and rely on HIPAA in their Wiretap Act claim, arguments the panel expressly declined to address while remanding for the district court to reconsider all of the substantive claims. Under 42 U.S.C. 1320d(6), individually identifiable health information means any information, including demographic information collected from an individual, that "is created or received by a health care provider, health plan, employer, or health care clearinghouse" and "relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual," and that either "identifies the individual" or is information "with respect to which there is a reasonable basis to believe that the information can be used to identify the individual." Both halves matter: the data must relate to health or care, and it must be identifying. The panel adopted that definition because, as it wrote, it was following the parties' lead and the district court had done the same. Separately, for the obligations HIPAA does impose directly on regulated entities, see our guide to what a covered entity has to report after a breach.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The first thing to notice is how little this opinion decides and how much work it still does. A reversal at the pleading stage moves a case from over to pending. It does not tell anyone who wins. The panel said so twice, once in footnote 2, where it remands for the district court "to reconsider all of Plaintiffs' substantive claims," and once at the close, where it wrote that "[i]f the district court finds that Plaintiffs have adequately pled the elements of their claims, discovery will be necessary to test those allegations." The elements of the federal Wiretap Act claim, the reach of the Missouri statute, the Illinois claim, the tort and the contract theories are all still open on remand.

The standing holding is the part with the widest reach, because standing is jurisdictional and arises in every one of these cases. Since TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), defendants in tracking-pixel cases have argued that a data disclosure is too abstract to be an injury in fact. The Fifth Circuit's answer lines up with four other circuits the opinion collects: Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), and In re BPS Direct, LLC; Cabela's LLC Wiretapping Litigation, 175 F.4th 423 (3d Cir. 2026). We have covered a related standing dispute over health data disclosure in the Ninth Circuit. Notably, the panel did not treat health information as a marginal extension of those media and shopping cases. It described the plaintiffs' information as "inherently sensitive and personal" and wrote that the two hypotheticals the D.C. Circuit used in Pileggi "apply with even more force to the disclosure of personal health information at issue here."

Second, the opinion rejects a narrow reading of what counts as health information in this setting, and it does so on the statutory text rather than on policy. Eyemart's position was that browsing without entering a diagnosis, symptom, transaction or appointment request discloses nothing medical. The panel answered that 42 U.S.C. 1320d(6) covers information that "relates to" a condition or the provision of care, and that "[b]y virtue of its position as a healthcare products and services provider, activity on Eyemart's Site pertains to individuals' vision." That reasoning is tied to the kind of business running the site. It also comes with a caveat the opinion states plainly: the court adopted HIPAA's definition because both sides did. Footnote 2 goes no further, expressly declining to address the plaintiffs' separate arguments that Eyemart holds itself out as a HIPAA-covered entity and that HIPAA informs their Wiretap Act claim.

Third, the panel declined to read American Hospital Ass'n v. Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024), which held that a Department of Health and Human Services bulletin on online tracking exceeded the agency's statutory authority, as a general limit on what health data means. Eyemart offered Becerra as its answer to the district court decisions the plaintiffs relied on. The panel distinguished it on the facts, noting that the technology there connected only an IP address with a visit to a site, while the allegations here describe searches for specific products and providers paired with Facebook profile data. That marks one boundary of the Becerra argument without disturbing the ruling itself.

Fourth, there is a procedural lesson that has nothing to do with pixels. Against a dismissal built on one illustrative screenshot, the Fifth Circuit simply restated ordinary Rule 12(b)(6) practice: read the pleading whole, and draw inferences for the non-movant. Technical exhibits in data-privacy complaints are rarely complete before discovery, and the panel noted that "without the benefit of discovery, Plaintiffs cannot be expected to know much more at this early stage."

Finally, the limits. The panel wrote that neither party supplied a circuit case addressing Pixel tracking of health information and that it was aware of none to date, which is the court's own characterization of the landscape rather than ours. What the opinion did not address is at least as important for anyone reading the statute: the opinion does not decide whether a site operator is a party to the communication under 18 U.S.C. 2511(2)(d), whether URL and event data are "contents" under 18 U.S.C. 2510(8), or whether Missouri's wire-communication language reaches web traffic. Those questions stay where they were.

What Happens Next

The case returns to the Northern District of Texas, USDC No. 3:24-CV-621, where the district court will reconsider the plaintiffs' substantive claims under the standard the Fifth Circuit set out. Because the panel reversed only the two threshold findings, the district court can still address the elements of each individual claim, which it never reached in the ruling under review. The opinion tells it how the sequence runs: if the plaintiffs have adequately pleaded the elements of their claims, discovery follows to test the allegations.

Whether Eyemart seeks further appellate review is not known as of October 24, 2026. The published opinion sets no schedule beyond the remand, and it records no petition for rehearing and no mandate date. Related coverage on this site includes a California appellate decision on class certification in a hospital tracking pixel case.

How This Affects You

For a reader who used a healthcare-adjacent website that ran a tracking pixel, this decision changes what a federal court inside the circuit can do at the dismissal stage. It does not create a claim, establish liability, or say that any particular tracking practice is unlawful. Standing and stating a claim are separate questions, and a complaint that clears both still has to survive summary judgment and trial.

For operators of websites that sell health products or schedule care, the practical content of the opinion is narrow but concrete: a Fifth Circuit panel has held that browsing and scheduling data from a vision care retailer's site can qualify as individually identifiable health information at the pleading stage, where the site's business is healthcare and the recipient can match the data to a named person. The opinion does not say what a site must do about that. The complaint alleged that Eyemart neither obtained consent to the tracking nor notified users of it, and the panel recited those allegations as pleaded facts without ruling on what they mean for any claim.

This is general legal information, not legal advice. It covers one published Fifth Circuit decision, which binds federal courts in Texas, Louisiana and Mississippi, along with the federal Wiretap Act and the Missouri wiretap statute, and it reflects sources verified on October 24, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Washington Supreme Court ruling on pixel tracking under the state privacy act
• A wiretap ruling on ad-exchange data collection
• Illinois biometric privacy law
• Hospital tracking pixel class certification on appeal

---

Last updated: 2026-10-24. This is a developing story; details verified as of 2026-10-24.

Frequently Asked Questions

Did the plaintiffs win the case?

No. The Fifth Circuit reversed the dismissal and remanded on October 23, 2026, which means the lawsuit continues in the Northern District of Texas. The panel did not rule on whether Eyemart violated any statute, and the district court has not decided the elements of any claim.

What exactly did the Fifth Circuit hold?

It held that the plaintiffs have Article III standing, that the Search Plaintiffs adequately alleged they shared individually identifiable health information with Eyemart, and that the plaintiffs adequately alleged that information was shared with Meta. It reversed the dismissal that had rested on the opposite findings and remanded.

Does this decision interpret the federal Wiretap Act?

No. The opinion names the three statutes the plaintiffs sued under and remands for the district court to reconsider all of the substantive claims. It does not construe 18 U.S.C. 2511 or either state statute.

Is a HIPAA claim part of this lawsuit?

No. Footnote 2 of the opinion states that the plaintiffs do not assert a HIPAA claim and could not, citing Acara v. Banks, 470 F.3d 569 (5th Cir. 2006), which held there is no private cause of action under HIPAA. HIPAA's definition of individually identifiable health information at 42 U.S.C. 1320d(6) was used only as a definition the parties had both adopted.

What is individually identifiable health information under 42 U.S.C. 1320d(6)?

Information, including demographic information collected from an individual, that is created or received by a health care provider, health plan, employer or health care clearinghouse, that relates to a person's physical or mental health or condition, the provision of health care, or payment for health care, and that either identifies the individual or could reasonably be used to identify the individual.

Where does the Fifth Circuit's ruling apply?

A published Fifth Circuit opinion binds the federal district courts within the circuit, which covers Texas, Louisiana and Mississippi. Courts elsewhere may find it persuasive but are not bound by it.

Does the federal Wiretap Act allow a private lawsuit?

Yes. Under 18 U.S.C. 2520(a), a person whose wire, oral or electronic communication is intercepted, disclosed or intentionally used in violation of the chapter may bring a civil action for appropriate relief, which under subsection (b) can include equitable or declaratory relief, damages and a reasonable attorney's fee.

Is Missouri a one-party consent state for wiretapping?

Yes, for wire communications. Mo. Rev. Stat. 542.402.2(3) provides that it is not unlawful for a person not acting under law to intercept a wire communication where that person is a party to the communication, or where one party has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act. The federal provision at 18 U.S.C. 2511(2)(d) is worded similarly, though it covers wire, oral and electronic communications and specifies a criminal or tortious act in violation of the Constitution or laws of the United States or of any State.