Last month, the United States Court of Appeals for the Third Circuit, in an unpublished decision, undercut the latest attempt of the plaintiffs' bar to penalize the common business practice of using tracking pixels on websites. These pixels are pieces of code created by third-party advertisers and analytics companies that can collect information about website visits such as a visitor's IP address, when the visit occurred, and what links were clicked on within the site. Despite being used by most major U.S. businesses, tracking pixels have been increasingly targeted by plaintiffs for their alleged disclosure of certain information back to the company that operates them. Squire Patton Boggs' Data Disputes team has significant experience defending these claims in litigation and arbitration (and obtaining dismissals for clients).
Read on for more about the Third Circuit's decision in this case.
Legal Background
In this case, Plaintiffs brought claims under both CIPA and the California Confidentiality of Medical Information Act (CMIA).
The CIPA claim was brought under CIPA Section 631(a) which provides a right of action "against any person who willfully and without the consent of all the parties to the communication reads the contents or meaning of any message, report, or communication while the same is in transit." Cole (Cole III), No. 25-1449, 2025 WL 3172640, at *2 (3d Cir. Nov. 13, 2025) (quoting Cal. Penal Code § 631(a)). While the statute prohibits "eavesdropping, or the secret monitoring of conversations by third parties," it does not apply to "participant[s] to a conversation." Id. (citations omitted).
The CMIA claim was brought under CMIA Section 56.10(a), which prohibits the disclosure of a patient's "medical information" without "first obtaining an authorization." Id. at *3 (citing Cal. Civ. Code § 56.10(a)). Medical information is defined by the statute as identifiable information "in possession of or derived from a provider of health care . . . regarding a patient's medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment." Id. (quoting Cal. Civ. Code § 56.05(j)(1)). It does not, however, include "demographic or numeric informationthat does not reveal medical history, diagnosis, or care." Id. (citations omitted). Case law has held that the information disclosed must be "substantive." Cole (Cole I), No. 2:23-CV-20647-WJM, 2024 WL 3272789, at *5 (D. N.J. July 2, 2024) (citing cases).
Case Background
The case arose out of the defendant, a medical testing company, operating two websites that used a tracking pixel run by a social media company, which communicated information about site visitors back to that company. Plaintiffs filed a class action alleging that Defendant violated CIPA by "aid[ing], agree[ing] with, and conspir[ing] with [the social media company] to track and intercept" internet communications from the plaintiffs, and that it violated CMIA by disclosing "'the URL of the webpage [Plaintiffs] accessed to review test results,' along with Plaintiffs' identifying information connected to their [accounts with the social media company].'" Cole III, 2025 WL 3172640, at *1.
The district court, in separate rulings, dismissed both claims. It held that CIPA had not been violated because the social media company had not engaged in "eavesdropping, or the secret monitoring of conversations." See Cole (Cole II), No. 2:23-CV-20647-WJM, 2025 WL 88703, at *2-3 (D. N.J. Jan. 14, 2025). Instead, it had received information "directly" from the plaintiffs' browsers. Id. at *3. This meant it was not a third party and that there was "no need" for it to engage in eavesdropping. Id.
The lower court further dismissed the CMIA claim because the defendant had not revealed what kind of medical tests were performed or what their results were, but only that the plaintiffs were accessing medical test results generally. This was not the sort of "substantive" medical information that CMIA was meant to protect. Cole I, 2024 WL 3272789, at *5. Plaintiffs appealed.
Third Circuit Affirms Lower Court's Order, Holding That Defendant Had Not Violated Either Statute
The Third Circuit affirmed the district court's order. First, it agreed that the social media company had not eavesdropped as defined by CIPA. It pointed out that Plaintiffs had "sen[t] a separate message to [the social media company's] servers . . . concurrent with the communications with [Defendant]." Cole III, 2025 WL 3172640, at *3. Thus, "[a]s the recipient of a direct communication from Plaintiffs' browsers," the social media company was not listening in on conversations between the websites and the plaintiffs because it was a participant in those conversations. Id.
Next, the court upheld the lower court's ruling on the CMIA claim. It explained that, while CMIA does prohibit medical providers from sharing "medical information" without authorization, the mere fact that treatment occurred does not constitute such information under relevant precedent. Id. at *3 (citing cases). If the defendant had disclosed the "nature or results" of the medical tests taken by the plaintiffs, "or any other substantive medical information," then the conclusion may have been different. Id.
Conclusion
By affirming dismissal, the Third Circuit showed impatience with the increasingly vexatious nature of pixel litigation. This is part of a growing trend of frustration from courts across the country. Nevertheless, businesses should carefully consider their policies around pixel use, especially in the medical context, to minimize the risk of lawsuits. For those looking to get additional background on the legal landscape, Privacy World has recently covered pixel litigation under the Video Privacy Protection Act (VPPA) and the California Invasion of Privacy Act (CIPA), and their use has also been at issue in recent mass arbitrations. See https://www.privacyworld.blog/2025/12/2025-mass-arbitration-year-in-review/
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
