Third Circuit Affirms Dismissal of Tower Health Pixel Suit

Third Circuit Affirms Dismissal of Tower Health Meta Pixel Class Action

The Third Circuit affirmed the dismissal of a putative class action accusing Tower Health of sharing patients' health information through Meta Pixel tracking code. The patients cleared the Article III standing bar, then declined to argue on appeal that their complaint actually stated a claim.

Information last verified on September 6, 2026.

Status: Decided. On August 28, 2026, in Santoro v. Tower Health, No. 24-3173, the Third Circuit affirmed both orders under review: the district court's dismissal of the Second Amended Complaint with prejudice and its denial of the reconsideration motion that sought leave to file a Third Amended Complaint. The panel concluded the plaintiffs had Article III standing, then reviewed only the with-prejudice dismissal and the amendment ruling for abuse of discretion. It expressly took no position on whether the complaint stated a claim. Claims against Meta Platforms had earlier been transferred to a different judicial district and are not resolved by this opinion.

Jurisdiction scope: Third Circuit decisions bind the federal district courts within the circuit, which 28 U.S.C. § 41 defines as Delaware, New Jersey, Pennsylvania, and the Virgin Islands. Federal courts outside the circuit may find the reasoning persuasive, but they are not bound by it. The decision changes no state statute and creates no new cause of action.

What Happened

Patrick Santoro and Jessica Landis are Tower Health patients. Tower Health is a regional provider that, according to the opinion, operates seven hospitals and 27 urgent care facilities plus home healthcare services, and encourages patients and the public to get health information through its website.

The plaintiffs alleged that Tower Health installed Meta Pixel on that website. As the opinion describes the software, Meta Pixel captures information about a user's characteristics, such as IP addresses, device identifiers and account numbers, along with the content of communications, such as the URLs, buttons, links, pages and tabs a user views, and transmits that information to Meta contemporaneously. The complaint alleged Meta uses the data commercially, including for targeted advertising, forwards it back to Tower Health with an analysis, and pays Tower Health for access. The plaintiffs alleged they never authorized any of it, and that Tower Health had pledged in its notices and confidentiality agreements to keep patient health information private.

They filed a putative class action in 2022. The claims against Meta Platforms were transferred to a different judicial district. Against Tower Health, the plaintiffs pleaded three claims: a violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq.; negligence; and intrusion upon seclusion. Tower Health moved to dismiss three times. The plaintiffs amended once as of right under Federal Rule of Civil Procedure 15(a)(1)(B), amended again with leave, and the Second Amended Complaint drew the third motion.

At oral argument, the district court, Judge John F. Murphy presiding, turned to the plaintiffs and opened by saying, "Your biggest problem is the specificity of the pleadings, so let's start there." The court said it would "show [Plaintiffs] [its] cards" and described struggling to see how to write an opinion sending the case to discovery on what it called "hypothetical" information. Plaintiffs' counsel offered to plead the specific conditions searched, while maintaining that the law did not require it. The court responded that its concern was broader, reaching "the scope of the information" the plaintiffs shared.

Six weeks later the district court dismissed the Second Amended Complaint for failure to state a claim, finding the allegations too "bare-bones," and dismissed with prejudice because the plaintiffs "had three chances to plead their claims, as well as the opportunity to provide more factual details about the information captured by the Meta Pixel at oral argument. The facts simply aren't there, and therefore, amendment would be futile."

Two weeks after that, the plaintiffs moved for reconsideration and attached a proposed Third Amended Complaint listing the Tower Health URLs they had visited and describing medical ads they later saw on Facebook. The district court denied the motion for undue delay. The plaintiffs appealed.

The panel of Judges Hardiman, Freeman and Chung heard argument on October 21, 2025 and filed the opinion, written by Judge Freeman, on August 28, 2026. The disposition is stated at the outset: "we will AFFIRM the District Court's orders dismissing the Second Amended Complaint and denying the reconsideration motion."

The decision is precedential. The Third Circuit filed it as an "OPINION OF THE COURT" in its published opinion archive under the file name 243173p.pdf, the "p" designation the court uses for precedential opinions, and it carries none of the "NOT PRECEDENTIAL" banner the court places at the top of its non-precedential dispositions, which it files separately under an "np" file name. Consistent with that status, the opinion pauses at slip opinion page 13 to "clarify how our precedent guides today's decision" and states a rule for future cases.

What the Law Actually Says

Article III standing came first, because it had to. Before reaching anything else, the court said it "must assure ourselves that the District Court had subject matter jurisdiction." It directed the parties to brief standing in light of Cook v. Gamestop, Inc., 148 F.4th 153 (3d Cir. 2025), and then concluded: "We are satisfied that Plaintiffs' allegations support Article III standing for each of their claims."

Only injury in fact was contested. Quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016), the panel restated that a plaintiff must show "an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical." For intangible harms, the Third Circuit asks whether plaintiffs "have identified a close historical or common-law analogue for their asserted injury," comparing the alleged harm to the harm a comparator tort addresses at common law.

The comparator was intrusion upon seclusion. The court used Restatement (Second) of Torts § 652B (1977) and its own decision in In re BPS Direct, LLC; Cabela's, LLC Wiretapping Litigation, 175 F.4th 423 (3d Cir. 2026), which found the surreptitious viewing of complete card numbers analogous to that tort. Health information, the panel said, occupies the same category, citing United States v. Westinghouse Electric Corp., 638 F.2d 570, 577 (3d Cir. 1980), Doe v. Delie, 257 F.3d 309, 315 (3d Cir. 2001), and Trammel v. United States, 445 U.S. 40, 51 (1980). Its conclusion, at slip opinion page 8: "Because patients expect the medical information they share with their healthcare providers to remain private, a provider's surreptitious disclosure of a patient's confidential medical information is analogous to the kind of harm caused by an intrusion upon seclusion."

Two limits sit right next to that sentence. Footnote 4 rejects the plaintiffs' alternative analogy to public disclosure of private facts, because they alleged no public disclosure. Footnote 5 confines the standing holding to these allegations and adds that "despite our standing determination, we do not address whether these allegations suffice to state a claim upon which relief can be granted." Standing is a doorway, not a verdict.

The wiretap theory, as the opinion frames it. The plaintiffs did not plead a HIPAA cause of action. They pleaded ECPA, and used HIPAA as the unlawful purpose. The district court read the claim as turning on whether Tower Health intercepted communications for the purpose of violating HIPAA, noting that HIPAA makes it a crime to knowingly disclose "individually identifiable health information to another person" under 42 U.S.C. § 1320d-6(a)(3), and that 45 C.F.R. § 160.103 defines that term to include information created or received by a health care provider that relates to an individual's past, present or future physical or mental health or condition. Readers comparing this to the enforcement path they already know can review how HIPAA breach reporting works and what the Electronic Communications Privacy Act covers.

The statutory text carrying that unlawful purpose concept is 18 U.S.C. § 2511(2)(d), which makes interception lawful for a party to the communication "unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State." The opinion does not cite that subsection by number. The district court held the allegations too thin to clear it and dismissed the tort claims for the same lack of specificity.

Then the appeal narrowed. At slip opinion page 9 the panel wrote: "They do not contend that any claims in the SAC withstand Rule 12(b)(6) scrutiny. Instead, they challenge only the District Court's decision to dismiss the SAC with prejudice." Under footnote 6, a Rule 12(b)(6) dismissal draws de novo review, but a decision to dismiss with prejudice draws abuse-of-discretion review. By raising only the second issue, the plaintiffs left the panel reviewing only for abuse of discretion. At page 14 the court closed the loop: "Puzzlingly, Plaintiffs opted not to raise that argument in their appellate brief. Thus, we take no position on whether the SAC stated a claim upon which relief could be granted."

Leave to amend. The plaintiffs never properly requested leave before dismissal, because under Fletcher-Harlee Corp. v. Pote Concrete Contractors, Inc., 482 F.3d 247, 252 (3d Cir. 2007), a party in a non-civil-rights case must submit a draft amended complaint. Conditional remarks at argument did not satisfy that rule. After judgment, the reconsideration motion was treated as a Rule 59(e) motion, which routes the amendment question back through Rule 15's instruction that a court "should freely give leave when justice so requires," subject to the familiar grounds for refusal including undue delay.

The district court gave three reasons why the plaintiffs were on notice of their pleading deficiencies. The Third Circuit rejected the first and the third. A defendant's arguments, however persistent, do not put a plaintiff on notice that the court will agree. Neither do rulings elsewhere: "To state the obvious: Other district courts' rulings in other cases do not bind the parties or the District Court in this case." The panel added that "the District Court did not cite a single appellate court opinion (let alone an opinion of this Court) that aligned with the reasoning of those other district-court dismissals."

The second reason carried the day. "During oral argument, the District Court made its views of the SAC abundantly clear," the panel wrote, and that record supplied the "clear indication" that the general rule contemplates. The plaintiffs then waited eight weeks, until two weeks after the ruling they had been warned about. On that record, denying leave for undue delay was not an abuse of discretion.

The rule the court states for future cases sits at pages 13 and 14: "in this Circuit we do not require plaintiffs to read tea leaves to discern whether their pleadings are deficient," but where a plaintiff receives a clear pre-ruling indication, "a plaintiff who wishes to amend based on facts available to him shall seek leave to do so promptly after receiving the clear indication."

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The standing discussion is the part of this opinion most likely to be quoted, and the part most likely to be described inaccurately. The panel resolved standing because it was required to confirm jurisdiction before touching the merits, and it fenced the holding in with footnotes on both sides. Read together, the disposition and footnote 5 say something narrow: patients who allege that their provider surreptitiously routed their identifiable health information to a third party have alleged a real injury, and that gets them into federal court. Whether such a complaint survives a motion to dismiss is a separate question this panel deliberately left open.

The second half of the opinion is the practical half, and it cuts in two directions. It protects plaintiffs from being penalized for holding a legal position against a defendant's repeated objections or against rulings in unrelated cases. It also tells them that a judge who says the quiet part out loud from the bench has started a clock. The panel's own framing of the alternative is worth noting: it observed that the plaintiffs were entitled to stand by their position and could have argued on appeal that the Second Amended Complaint survived Rule 12(b)(6), and that they simply did not.

For anyone tracking tracking-pixel litigation, the panel's remark that the district court cited no appellate authority aligned with the other district-court dismissals is a fair description of how thin the appellate layer was in this area. This opinion does not fill that gap on the merits, because the merits question was not presented. We are not predicting how any other pending pixel case will be decided, and this decision does not tell you how one will come out. Health systems in the circuit will read the standing analysis as a reason to expect these suits to reach the pleading stage rather than end at the courthouse door. That is an observation about litigation posture, not a legal conclusion about any particular defendant.

Related privacy obligations continue to run on their own tracks. State law is one of them, and readers can review Pennsylvania's data privacy framework for that layer. Recording Law separately tracks a Meta Pixel privacy settlement involving another health system, which shows that these disputes resolve through several different procedural routes.

How This Affects You

This is general information about a published appellate decision, not guidance about anyone's situation.

If you are a patient in Delaware, New Jersey, Pennsylvania or the Virgin Islands, the practical effect of this opinion is limited. It did not decide whether tracking code on a hospital website violates ECPA. It affirmed a dismissal that ended one case, and it explained when a federal plaintiff in the circuit needs to move promptly to amend a complaint.

If you work on the operator side, the opinion is a record of what a district court found insufficient and what an appellate panel found sufficient for jurisdiction, on one specific set of allegations. Organizations that handle health data also carry separate statutory duties when data is exposed, including Pennsylvania's breach notification rules, which operate independently of any private lawsuit.

Anyone with a question about their own circumstances should consult a licensed attorney in their state.

This article is general legal information, not legal advice. It does not create an attorney-client relationship. Laws and case outcomes change, and how a rule applies depends on facts we do not know. Consult a licensed attorney in your jurisdiction before acting.

Related articles

• Federal wiretap rules and the ECPA framework
• Privacy obligations under Pennsylvania law
• Reporting a HIPAA breach

Last updated: 2026-09-06. Details verified against the slip opinion as of 2026-09-06.

Frequently Asked Questions

Did the patients win this appeal?

No. The Third Circuit affirmed both orders on review, the dismissal of the Second Amended Complaint with prejudice and the denial of the reconsideration motion. The plaintiffs lost the appeal.

If the court found the patients had standing, why did the case still end?

Standing is a jurisdictional threshold, not a merits ruling. The court had to confirm jurisdiction before reviewing anything else. Once past that step, the only issues the plaintiffs raised on appeal were the dismissal with prejudice and the denial of leave to amend, and the court found no abuse of discretion on either. In footnote 5 the panel stated it does not address whether the allegations suffice to state a claim.

Was the dismissal with prejudice?

Yes. The district court dismissed all claims with prejudice, reasoning that the plaintiffs had three chances to plead and that further amendment would be futile. The Third Circuit reviewed that decision for abuse of discretion and affirmed it.

Does this decision let people sue under HIPAA?

No. The plaintiffs did not plead a HIPAA cause of action. They pleaded the Electronic Communications Privacy Act and state tort claims, and invoked HIPAA's criminal disclosure provision, 42 U.S.C. section 1320d-6(a)(3), as the alleged unlawful purpose behind the interception. The opinion describes that provision as making the conduct a crime.

Which courts have to follow this decision?

The federal district courts within the Third Circuit, which 28 U.S.C. section 41 defines as Delaware, New Jersey, Pennsylvania and the Virgin Islands. Courts elsewhere may treat the reasoning as persuasive but are not bound by it.

What happened to the claims against Meta Platforms?

The opinion states that the claims against Meta were transferred to a different judicial district early in the case. This appeal concerned only the claims against Tower Health, and the opinion does not resolve the transferred claims.

What is the practical rule the opinion states for amending a complaint?

A plaintiff generally does not have to guess that a complaint is deficient based on a defendant's arguments or on rulings in other cases. But when a district court gives a clear pre-ruling indication that it views the pleading as deficient, a plaintiff who wants to amend using facts already available should seek leave promptly rather than wait for the decision.