Identifiable Health-Related Website Tracking Can Establish Privacy Injury and Survive Dismissal

1. Introduction

In Rand v. Eyemart Express, the Fifth Circuit addressed whether consumers adequately alleged a legally cognizable privacy injury when an eyewear provider allegedly transmitted identifiable information about their prescription-eyewear browsing, purchases, and eye-examination scheduling to Meta through its tracking software. The court held that the allegations established Article III standing and that the district court had applied an unduly narrow understanding of health information and an improperly restrictive approach to pleading.

The plaintiffs—Rachelle Rand, Esperanza Gottschau, Ramon Soto, Georgianna Lash, and Aaron Mees—brought a putative class action against Eyemart Express, L.L.C. Their claims arose under the Federal Wiretap Act, the Missouri Wiretap Act, and the Illinois Eavesdropping Act, together with intrusion upon seclusion and breach of contract theories. Meta Platforms, Inc., the alleged recipient of their information, was not a defendant in this appeal.

The decision’s central contribution is twofold. First, unauthorized disclosure of identifiable health-related online activity can constitute a concrete privacy injury even without financial loss or proof of every element of a traditional privacy tort. Second, health information is not confined to diagnoses or prescription values: identifiable information about seeking healthcare products or services can fall within the statutory definition the parties used to frame the dispute.

The ruling remains a pleading-stage decision. It does not establish that Eyemart actually transmitted the alleged information, violated HIPAA, or satisfied every element of the plaintiffs’ substantive claims.

2. Background and Procedural History

The alleged tracking arrangement

Eyemart operates physical stores and a website through which customers can browse products, buy prescription eyewear, and schedule eye examinations. According to the amended complaint, Eyemart installed Meta’s “Pixel,” a tracking tool that collects website activity and transmits information to Meta. Meta can combine that information with Facebook account data to identify users and deliver targeted advertising. Participating websites, in turn, obtain advertising insights and opportunities to improve their marketing.

The plaintiffs alleged that Eyemart neither obtained their consent to this tracking nor notified them of it. They asserted that the Pixel captured searches, clicks, product-viewing activity, purchasing information, and appointment-related information.

Two groups of plaintiffs

• Search Plaintiffs: These plaintiffs browsed or searched for prescription glasses. One also scheduled an eye examination and alleged that the name and location of the relevant Eyemart store were transmitted to Meta.
• Prescription Plaintiffs: These plaintiffs purchased prescription eyewear and entered prescription information into the website. They alleged that their prescriptions and other health information were transmitted to Meta.

All plaintiffs were Facebook users who had previously supplied Meta with identifying information. The alleged privacy invasion therefore involved not simply anonymous browsing data, but website activity capable of being connected to particular individuals.

The district court’s rulings

On Eyemart’s first dismissal motion, the district court found standing but dismissed the claims with leave to amend. After amendment, Eyemart again sought dismissal for failure to state a claim, without renewing its standing challenge.

The district court dismissed the amended complaint with prejudice. It concluded that the Search Plaintiffs had not adequately alleged that they supplied individually identifiable health information to Eyemart. Although the Prescription Plaintiffs had supplied such information, the court found their allegations insufficient to show that Meta received it. Those conclusions defeated all claims at a common threshold.

On appeal, Eyemart defended the dismissal and alternatively renewed its jurisdictional argument. The Fifth Circuit addressed standing first, affirmed the existence of jurisdiction, and rejected both grounds supporting the merits dismissal.

3. Summary of the Opinion

1. Standing existed. Alleged unauthorized disclosure of the plaintiffs’ identifiable health information was a concrete, particularized privacy injury closely related to traditionally actionable harms.
2. A common-law analogy need not reproduce every tort element. Standing required similarity in the kind of harm, not a showing that the allegations independently established every element of intrusion upon seclusion or public disclosure of private facts.
3. Health information was not limited to diagnoses and prescriptions. Under the HIPAA definition adopted for this dispute, information relating to healthcare services could qualify even without disclosing a specific diagnosis.
4. The Search Plaintiffs pleaded sufficient health-related activity. Their allegations concerning prescription-eyewear searches and examination scheduling, combined with individual identification through Meta, crossed the pleading threshold.
5. The disclosure allegations had to be assessed collectively. An illustrative screenshot did not negate broader allegations that the Pixel transmitted health-related product, purchase, and appointment information.
6. Further proceedings remained necessary. The district court must reconsider the substantive claims without the erroneous threshold conclusions. The appellate court did not decide whether every claim was otherwise adequately pleaded.

4. Legal Reasoning

A. Article III recognizes the alleged privacy invasion as a concrete injury

Article III standing requires injury in fact, traceability, and redressability. Eyemart contested only injury, but the court considered all three requirements because standing determines federal judicial power.

The alleged injury was intangible: loss of privacy through unauthorized disclosure rather than a direct monetary loss. That did not make it abstract. Following Supreme Court and Fifth Circuit authority, the court asked whether the injury bore a close relationship to a harm traditionally recognized at common law.

Two traditional privacy torts supplied the comparison. Intrusion upon seclusion addresses invasions of private affairs; public disclosure of private facts addresses dissemination of private information. The court referenced the Restatement (Second) of Torts §§ 652B and 652D in identifying those protected interests.

Eyemart argued that the plaintiffs could not rely on intrusion upon seclusion because they had not sufficiently pleaded that tort. The court rejected the argument as confusing jurisdiction with the merits. A modern injury may resemble a traditional harm sufficiently for standing even if the plaintiff has not established the traditional tort’s complete elements.

This distinction also explains why disclosure to Meta could support standing without requiring a determination that the disclosure satisfied every publicity requirement associated with a common-law cause of action. The inquiry concerned the nature of the privacy harm, not an exact element-by-element match.

The injury was particularized because the disclosed information allegedly concerned each plaintiff. It was traceable to Eyemart because Eyemart allegedly enabled Meta’s access through the Pixel. The court also found redressability satisfied by the requested damages and injunctive relief, including removal of the Pixel or obtaining consent to tracking.

B. Health information extends beyond diagnostic labels and prescription values

The parties and district court used HIPAA’s definition of “individually identifiable health information,” or IIHI, as the relevant framework. Under 42 U.S.C. § 1320d(6), the definition encompasses information created or received by specified healthcare-related entities that relates to an individual’s health, healthcare provision, or payment for healthcare and identifies the individual or reasonably can be used to do so.

At oral argument, Eyemart conceded that the Pixel information was individually identifiable because it could be linked to specific Facebook users. The principal remaining dispute concerned whether the information was health-related.

Eyemart urged a narrow approach centered on diagnoses, symptoms, or completed transactions inherently revealing a condition. The court instead emphasized the statutory phrase relates to. Information need not identify a particular disease or reproduce a prescription to concern healthcare. Seeking prescription eyewear or arranging an eye examination can relate to the provision of medical services.

The court relied on the allegations’ combined context: Eyemart supplied healthcare products and services; the plaintiffs interacted with prescription products and examination scheduling; and Meta allegedly connected those interactions to identifiable people. Eyemart’s privacy policy, as described in the complaint, also stated that scheduling an appointment involved requesting personal health information.

The district court’s treatment of previously shared location information was likewise too restrictive. The alleged disclosure was not merely a location already known to Meta. It connected an identifiable person with an eye-care interaction at a particular provider. Existing knowledge of one data point did not resolve whether the newly disclosed association was health information.

Importantly, the opinion did not create a private HIPAA action. HIPAA supplied a definitional framework for the issues presented; it did not itself provide the plaintiffs’ cause of action. The court also reserved other arguments concerning Eyemart’s asserted HIPAA status and the plaintiffs’ reliance on HIPAA within their Wiretap Act theory.

C. The complaint had to be read as a whole

The district court’s analysis of the Prescription Plaintiffs concentrated on a screenshot labeled Figure 13. That figure illustrated an “AddToCart” event generated through counsel’s example activity, rather than documenting an actual plaintiff’s purchase.

The district court examined fields including a content identifier, “Plastic,” “2LensAdvizor,” and price. It inferred meanings for some fields and concluded that the image failed to demonstrate transmission of prescription information.

The Fifth Circuit identified three related errors:

• An unduly narrow definition: The relevant health information was not confined to prescription values entered on an ordering screen.
• Defendant-favorable inferences: The district court interpreted the screenshot against the plaintiffs, contrary to the Rule 12(b)(6) standard.
• Fragmented review: It treated a limited example as dispositive while disregarding other factual allegations about site-wide tracking, prescription purchases, appointment activity, and customer-list uploads.

The complaint alleged that the Pixel operated across relevant website pages, transmitted descriptions of products viewed or purchased, and captured examination-related activity. It also alleged that Eyemart uploaded customer lists containing email addresses and prescription-eyewear purchase or viewing information so Meta could match users to Facebook profiles.

Read together, these allegations plausibly supported transmission of IIHI. The absence of prescription details from one illustrative screenshot was not an affirmative contradiction of the broader allegations.

D. Plausibility is not proof

The court distinguished testing a complaint’s sufficiency from adjudicating what the tracking technology actually did. Factual allegations must be accepted as true at this stage, although legal conclusions and conclusory assertions need not be.

The decision did not dispense with factual specificity. Rather, it found that these plaintiffs supplied enough factual detail about the tracking mechanism, information categories, and identification process to proceed past the challenged threshold grounds.

The court also recognized the plaintiffs’ limited access to information before discovery. They could not reasonably be expected to establish the complete technical operation of Eyemart’s integration at the outset. Nevertheless, discovery was not ordered unconditionally: the opinion contemplated discovery if the district court found the substantive claims otherwise adequately pleaded.

5. Precedents Cited and Their Influence

A. Constitutional standing and traditional privacy harms

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)

This Supreme Court decision supplied both the three-part standing framework and the central treatment of intangible injury. Its recognition that reputational harm, disclosure of private information, and intrusion upon seclusion can provide concrete injuries allowed the Fifth Circuit to treat the alleged disclosure as a real constitutional harm without requiring economic loss.

Spokeo, Inc. v. Robins, 578 U.S. 330 (2016)

Cited through the discussion in TransUnion LLC v. Ramirez, this decision provided the historical foundation for evaluating intangible injuries. Its influence lay in asking whether the alleged harm was closely related to one traditionally recognized by American courts, rather than assuming that intangible injuries are necessarily insufficient.

Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816 (5th Cir. 2022)

This was the decisive circuit authority distinguishing the kind of harm from the degree needed to establish a traditional cause of action. It directly answered Eyemart’s contention that the plaintiffs had to plead a complete intrusion-upon-seclusion claim before that tort could serve as a standing analogue.

Cranor v. 5 Star Nutrition, L.L.C., 998 F.3d 686 (5th Cir. 2021)

The court cited this decision for its focus on types of harms protected at common law. It reinforced the methodology used to compare modern digital tracking with established privacy interests without demanding an exact historical counterpart.

Cochenour v. 360Training.com, Inc., No. 1:25-CV-7, 2025 WL 3251719 (W.D. Tex. Nov. 3, 2025)

This district court decision illustrated the application of the Fifth Circuit’s standing principles to Pixel tracking. It supplied a factually relevant application of the same approach, rather than an independent controlling rule.

B. Appellate decisions involving online tracking

Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025)

The Sixth Circuit recognized injury from Pixel-based disclosure of private video-viewing history. Its comparison to intrusion upon seclusion and public disclosure of private information supported the same analogy here. The Fifth Circuit also relied on its explanation that a historical analogue need not match every tort element, and cited it concerning traceability and redressability.

Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025)

This decision treated unauthorized transmission of private viewing history as a concrete injury. Its analogies—a magazine seller investigating someone’s mailbox and a stranger using disclosed viewing history to solicit purchases—made the privacy invasion understandable outside its technological setting. The Fifth Circuit considered those comparisons even more compelling when the information concerned health.

Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024)

The Second Circuit found Pixel-based disclosure of personal viewing information sufficiently analogous to public disclosure of private facts. It reinforced the inter-circuit support for recognizing identifiable browsing disclosures as concrete injuries and also supported tracing a disclosure to the website operator enabling it.

In re BPS Direct, LLC; Cabela's LLC Wiretapping Litigation, 175 F.4th 423 (3d Cir. 2026)

This case involved online purchases and alleged disclosure of banking information through tracking code. Its recognition of an injury analogous to intrusion upon seclusion showed that the developing doctrine extended beyond viewing histories. The Fifth Circuit placed health-information tracking within that broader privacy framework.

C. Health information and healthcare websites

Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967 (S.D. Cal. 2023)

The district court treated searches for conditions, physician-directory filtering, specialist searches, and appointment booking on a hospital website as plausibly conveying protected health information at the pleading stage. This closely supported the conclusion that seeking healthcare can reveal health-related information without entering a diagnosis or prescription.

R.C. v. Walgreen Co., 733 F. Supp. 3d 876 (C.D. Cal. 2024)

This decision concerned Pixel disclosures associated with healthcare products, including pregnancy tests and diabetes test kits. Product information combined with customer identity could constitute personal medical information supporting an invasion-of-privacy claim. Its importance was contextual: product interactions may reveal health-related information even when the customer does not explicitly state a medical condition.

American Hospital Ass'n v. Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024)

Eyemart relied on this ruling concerning HHS guidance and the statutory limits of IIHI. The guidance addressed combinations involving IP addresses, visits to health-related webpages, and the reason for visiting. The Fifth Circuit distinguished that regulatory, summary-judgment dispute from allegations of detailed product and provider activity linked to Facebook identities. It did not overrule the decision or hold that any visit to a health-related webpage necessarily creates IIHI.

Acara v. Banks, 470 F.3d 569 (5th Cir. 2006)

This binding authority establishes that HIPAA contains no private cause of action. It imposed an important boundary: the plaintiffs could use HIPAA’s definition in litigating their existing claims, but could not sue directly under HIPAA. The appellate ruling left that limitation intact.

D. Jurisdictional review and pleading standards

Heinze v. Tesco Corp., 971 F.3d 475 (5th Cir. 2020)

Cited at the outset, this decision justified treating the complaint’s factual account—including its description of the Pixel—as true and construing it favorably to the plaintiffs. It underscored that the opinion’s technological narrative was not a set of findings after trial.

Jack v. Evonik Corp., 79 F.4th 547 (5th Cir. 2023)

This authority supported de novo review and articulated the governing plausibility standard. Its distinction between factual allegations and unsupported legal conclusions framed the appellate court’s independent review of the complaint.

Lane v. Halliburton, 529 F.3d 548 (5th Cir. 2008)

The court cited this case alongside Jack v. Evonik Corp. for de novo review of dismissal. The appellate panel therefore owed no deference to the district court’s legal conclusions concerning standing or pleading sufficiency.

In re S. Recycling, L.L.C., 982 F.3d 374 (5th Cir. 2020), and Barrera- Montenegro v. United States, 74 F.3d 657 (5th Cir. 1996)

These cases supplied the Rule 12(b)(1) framework: jurisdiction may be assessed from the complaint alone, the complaint supplemented by undisputed record facts, or those materials together with the court’s resolution of disputed jurisdictional facts. They explained the permissible scope of standing review, although the opinion’s substantive analysis centered on the pleaded privacy injury.

Ashcroft v. Iqbal, 556 U.S. 662 (2009)

The Supreme Court’s plausibility standard, quoted through Jack v. Evonik Corp., required enough factual matter to state a facially plausible claim. The Fifth Circuit applied that standard without converting it into a demand for conclusive proof of Meta’s data receipt.

E. Whole-complaint review and illustrative exhibits

Arbuckle Mountain Ranch of Tex., Inc. v. Chesapeake Energy Corp., 810 F.3d 335 (5th Cir. 2016)

This decision supplied the direct instruction to assess pleadings in their entirety. It was central to rejecting the district court’s narrow focus on Figure 13 while ignoring allegations elsewhere in the amended complaint.

Funk v. Stryker Corp., 631 F.3d 777 (5th Cir. 2011), and Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308 (2007)

The court cited the whole-complaint principle stated in Funk v. Stryker Corp., which quoted Tellabs, Inc. v. Makor Issues & Rts., Ltd.. Their role was to reinforce holistic review, not to import a different substantive pleading regime into the privacy claims.

Stevenson v. Tocé, 113 F.4th 494 (5th Cir. 2024)

Eyemart invoked this case for the principle that an exhibit controls over contradictory allegations. The Fifth Circuit found no contradiction: a limited illustration of certain URL data did not claim to exhaust everything transmitted by the Pixel. The case therefore did not justify displacing the complaint’s broader factual account.

George v. SI Grp., Inc., 36 F.4th 611 (5th Cir. 2022)

This decision supplied the concluding procedural principle that Rule 12(b)(6) tests pleading sufficiency, not the merits. It supported leaving factual verification of the alleged transmissions for later proceedings, subject to adequate pleading of the underlying claims.

6. Potential Impact and Limits

A. A significant extension of online-tracking standing doctrine

The opinion aligns the Fifth Circuit with other circuits recognizing concrete privacy injuries from identifiable online-activity disclosures. Its particular contribution is applying that reasoning to health-related tracking. The court described health information as inherently sensitive and personal, making the historical privacy analogies especially persuasive.

Future defendants therefore cannot assume that the absence of financial loss defeats standing in a comparable case. Nor can they require plaintiffs to prove every element of a common-law privacy tort merely to establish constitutional injury.

B. Greater attention to data combinations and healthcare context

The decision directs attention to what combined data reveals. A product identifier, appointment location, or browsing action may acquire health significance when connected to an identified person and a healthcare interaction.

That approach may influence disputes involving other healthcare products, provider directories, appointment systems, and similar services. But the opinion does not establish that every visit to any health-related page is protected health information. Its reasoning rested on the pleaded activities, Eyemart’s healthcare role, and the linkage to specific Facebook users.

C. Guidance for technical pleading disputes

Plaintiffs need not necessarily attach a complete transmission log documenting their own activity to survive dismissal. Detailed allegations concerning collection, transmission, and identity matching can suffice. Conversely, an illustrative technical exhibit should not be treated as exhaustive unless its content actually contradicts the allegations.

The decision does not eliminate exhibit-based dismissal. It requires a genuine contradiction rather than an inference drawn from what a limited example does not show.

D. Substantial issues remain open

• Whether each statutory, tort, and contract claim satisfies its independent elements.
• Whether evidence will establish the alleged data collection and disclosures.
• The unresolved arguments concerning HIPAA’s relevance beyond the agreed definitional framework.
• Whether a class should be certified.
• Whether liability, damages, or injunctive relief will ultimately be warranted.

Accordingly, the opinion is best understood as removing erroneous jurisdictional and pleading barriers, not as imposing final liability for using tracking technology.

7. Complex Concepts Simplified

Article III standing

The constitutional requirement that a plaintiff have a real, personal injury connected to the defendant and capable of being addressed by a court.

Concrete but intangible injury

A real harm that is not necessarily physical or financial. Unauthorized loss of privacy can qualify.

Common-law analogue

A historically recognized harm used to assess whether a modern injury is sufficiently real. The comparison need not match every element of the old tort.

Individually identifiable health information

Under the statutory framework used here, health- or healthcare-related information that identifies someone or reasonably can be used to identify them. It is not limited to medical records or diagnoses.

Intrusion upon seclusion and public disclosure of private facts

The first addresses invasions of private affairs; the second addresses dissemination of private information. The court used both to understand the alleged harm without deciding that every tort element was established.

Rule 12(b)(1) versus Rule 12(b)(6)

The former challenges the court’s jurisdiction. The latter asks whether the complaint adequately states a legal claim. Establishing jurisdiction does not itself establish a valid substantive claim.

De novo review

The appellate court decides the legal issue afresh rather than deferring to the district court’s conclusion.

Reversal and remand

The appellate court sets aside the challenged dismissal and sends the case back for further proceedings. It does not award the plaintiffs a final victory on liability.

8. Conclusion

Rand v. Eyemart Express establishes that plausibly alleged disclosure of identifiable, health-related website activity can support Article III standing and cannot be rejected merely because the information lacks a diagnosis or explicit prescription details. It also reaffirms that complaints must be evaluated as a whole, with reasonable inferences favoring plaintiffs at the dismissal stage.

The decision meaningfully advances digital-health privacy litigation while preserving important limits: HIPAA creates no private action, the alleged transmissions remain unproven, and the substantive claims require further examination on remand.