Scams & Phishing Did Facebook just read your prescription? Users dragging Meta to court to find out

[Brownie2019]

Content source

https://cybernews.com/news/meta-class-action-lawsuit-health-data/

Meta may know what drugs you are about to buy.
Key takeaways

1. 01A judge allowed Facebook users to combine claims against Meta into one class action lawsuit.
2. 02Users allege Meta received health data from at least 664 hospital systems and provider websites.
3. 03Meta denies wrongdoing and says healthcare providers control how its tracking tools are configured.

Meta is under scrutiny for violating state and federal consumer protection laws by collecting users’ health data through tracking tools, including the Meta Pixel.

Meta Pixel is code embedded in a website or an app to track user activity and measure ad performance.

It’s alleged that data tracking occurred while patients were using healthcare-related platforms. A group of Facebook users says Meta was aware of receiving user data from hundreds of medical providers without users' knowledge or consent.
Users recognized at least 664 hospital systems and health provider websites from which Meta received patient information, according to Cohen Milstein, interim co-lead counsel in this certified class action (via International Business Times).

US District Judge William Orrick of the Northern District of California granted multiple Facebook users’ motion to have their claims consolidated into a class action lawsuit.

Health data allegedly captured through Meta’s tracking tools include:

Patient Status Button-Click Class: users who clicked on buttons or links on healthcare websites.
Patient Health Information Class: users whose information about their condition, treatment, or doctor's name has been collected.
Prescription Drug Information Class: users whose information about their medication prescription has been collected.
Patient Device Intrusion Class: users whose devices were affected by Meta’s tracking tool when visiting health-related websites or apps.
Meta’s response
The company denied the allegations, stating that Meta Pixel configurations are managed by healthcare providers and website operators.

According to its Business Tools terms, developers must have the right to share information and must prohibit sharing sensitive information.

Meta also noted that the situation cannot be resolved in a single litigation, as it involves different cases that need to be evaluated separately, since different healthcare providers and websites implemented its tools differently.

However, Judge Orrick dismissed these arguments, announcing a verdict allowing plaintiffs to consolidate their claims into a single class action lawsuit.

 

[Bot]

Hi Brownie — this is a significant ruling, although “Facebook read your prescription” is a rather tabloid version of it.

The allegation is not that a Meta employee opened somebody’s prescription record. It is that tracking code embedded by healthcare or pharmacy sites automatically transmitted events to Meta’s servers, potentially including a drug name, doctor, condition, appointment action or patient status. Automated collection can still be a serious privacy violation; it does not require a person at Meta to read the information.

One important correction to the quoted article: this was class certification, not a verdict on liability. On October 30, Judge Orrick allowed four defined groups to proceed collectively in the already-consolidated litigation. The certification order expressly leaves disputes about Pixel configuration, default settings, filtering and the information actually received for later stages. Meta has not yet been found liable, and no damages have been awarded.

Other useful distinctions:

• The “664 providers” figure comes from the plaintiffs’ experts. It is not a finding that every one of those providers unlawfully disclosed every category of information.
• The prescription class concerns communications containing a drug name where the Facebook user actually had a prescription. It does not mean everyone who merely browsed a public drug-information page is included.
• Meta’s “the providers configured it” defence may allocate some responsibility to providers, but it does not automatically absolve Meta. A contractual prohibition on sending sensitive data is not a technical barrier preventing Meta from receiving it.
• This is not simply a private HIPAA lawsuit—HIPAA generally has no private right of action. Nevertheless, HHS says tracking technologies on authenticated patient pages can have access to PHI such as prescriptions, diagnoses and billing information, so regulated providers must configure them accordingly. The HHS guidance explains that distinction.

For ordinary users, this is a tracking/privacy issue, not evidence that their Facebook password or medical account was hacked. Reasonable precautions include using a tracker-blocking content extension, opening healthcare portals directly rather than through social-media in-app browsers, and keeping sensitive browsing in a separate browser profile. Incognito mode alone does not stop a site from sending Pixel requests, and clearing cookies cannot recall data already transmitted.

The ruling matters because class certification greatly increases Meta’s litigation exposure. It does not, however, settle who is liable or prove that every visit to one of those healthcare websites disclosed a prescription.

Sources

• ORDER ON 1152 MOTION FOR CLASS CERTIFICATION AND MOTIONS TO EXCLUDE for In Re Meta Pixel Healthcare Litigation :: Justia Dockets & Filings
• Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates | HHS.gov

 

[Deletedmessiah]

Surprised it took this long.