A US eyewear retailer faces a revived privacy lawsuit after a federal appeals court reversed the dismissal of claims that it shared customers’ health-related information with Meta. In Rand v. Eyemart Express, five Facebook users allege that a Meta Pixel tracking tool on the retailer’s website transmitted information about their prescription-eyewear searches, prescription details and eye-exam scheduling activity to Meta without their consent. A Texas federal court dismissed the case with prejudice, but on October 23, 2026, the US Court of Appeals for the Fifth Circuit reversed that decision and remanded the case for further proceedings. The court held that the customers had standing and had adequately alleged that their health information was shared with Meta, sending the case back to the district court to reconsider their claims. The ruling does not determine whether Eyemart Express violated any law. The court noted that the parties cited, and it knew of, no earlier circuit ruling on Pixel tracking of health information specifically.
Eyemart Express Meta Pixel lawsuit: what customers allege about prescription data, eye exams and Facebook tracking
Eyemart Express operates physical stores and a website where customers can browse products, purchase prescription eyewear and schedule eye exams. According to the complaint, the retailer used Meta Pixel, a tracking tool that collects information about users’ activity on third-party websites and helps Meta build profiles for targeted advertising. The plaintiffs allege that the tool transmitted their website activity to Meta without their knowledge or consent. The five plaintiffs divide themselves into two groups. The Search Plaintiffs say they browsed the website for prescription glasses, triggering the Pixel to track their activity. One of them also alleges that, when she scheduled an eye exam, the tool sent Meta the name and location of the Eyemart store she visited. The Prescription Plaintiffs say they purchased prescription eyewear from Eyemart, entered their prescription information on the website and had that information shared with Meta.All five plaintiffs had Facebook accounts containing personal information, including their names and photographs. They allege that Meta could combine this information with activity tracked on Eyemart’s website to identify them and deliver targeted advertisements. They also allege that Eyemart uploaded customer lists containing email addresses and purchase information, including details of prescription eyewear customers had purchased or viewed, so Meta could match those records to Facebook profiles. The customers sued under the federal Wiretap Act, the Missouri Wiretap Act and the Illinois Eavesdropping Act. They also brought claims involving intrusion upon seclusion and breach of contract. These remain allegations, not established findings of liability. In reviewing the dismissal, the Fifth Circuit accepted the complaint’s factual allegations as true, as required at this stage of litigation.
Fifth Circuit ruling on Meta Pixel health data: why the court reversed the dismissal
The panel was Judges Haynes, Higginson and Ho, and Judge Stephen A. Higginson wrote the opinion. The court first addressed standing, the legal requirement that plaintiffs demonstrate a sufficient personal stake in a dispute to bring it before a federal court. Eyemart renewed its argument that the customers lacked standing, but the Fifth Circuit agreed with the district court that the alleged unauthorised disclosure of individually identifiable health information constituted a concrete and particularised injury. It considered the alleged privacy harm comparable to harms recognised in traditional privacy claims. The court therefore held that the plaintiffs had standing to sue.The court then examined the two grounds on which the district court had dismissed the case. The first was that the Search Plaintiffs had not adequately alleged that they shared individually identifiable health information with Eyemart. The second was that the plaintiffs had not adequately alleged that their health information was transmitted to Meta. The Fifth Circuit disagreed on both points. It followed the parties’ approach of using HIPAA’s definition of individually identifiable health information as a framework for assessing the allegations. The court explained that such information need not consist solely of a specific diagnosis or prescription. Information relating to a person’s health or the provision of healthcare services may also fall within the definition when it identifies the individual.The Search Plaintiffs alleged that their searches for prescription eyewear and their interactions with eye-exam scheduling services generated information that the Pixel transmitted to Meta. One plaintiff alleged that the tool shared the name and location of the store she visited when scheduling an appointment. The court concluded that these activities could relate to the plaintiffs’ health and the provision of healthcare services. For the Prescription Plaintiffs, the district court had accepted that they shared health information with Eyemart by entering prescription details but found the allegations of disclosure to Meta insufficient. The appeals court said the lower court had focused too narrowly on sample illustrations in the complaint while overlooking other allegations about tracked product views, purchases, appointment details and customer-list uploads. Taken together, those allegations were sufficient to plead that the Pixel transmitted health-related information to Meta.The court stressed that, without discovery, plaintiffs cannot be expected to know much more at this early stage. It explained that a motion to dismiss tests the sufficiency of the pleadings, not the merits of the case. It did not rule that every element of each claim had been established. Instead, it reversed the dismissal on the two grounds it had considered and remanded the case, sending it back to the district court to reconsider the substantive claims. Discovery will be necessary if the district court finds that the plaintiffs have adequately pleaded the elements of their claims.
What the Eyemart ruling means for online retailers and health data privacy
The decision is limited to the issues addressed at the pleading stage. Eyemart Express can continue to contest the claims in the district court, where the evidence and remaining legal questions can be examined. Meta is not a party to this appeal, which concerns the retailer’s alleged conduct. The case also sits within wider scrutiny of tracking technologies used on websites dealing with health information. The US Department of Health and Human Services has published guidance titled Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, outlining obligations for organisations regulated by HIPAA when using online tracking tools.That guidance has faced a legal challenge. On June 20, 2024, a federal district court in American Hospital Association v. Becerra vacated part of the guidance concerning circumstances in which an online technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing a specific health condition or healthcare provider. The Fifth Circuit noted that decision but distinguished the allegations in Rand, which involved claims that more extensive website activity was linked to identifiable Facebook users. The ruling may be relevant to retailers that sell healthcare-related products or facilitate appointments through websites using advertising trackers. Eyemart provides vision-care products and services, and the court said that activity on its website therefore pertains to customers’ vision.The decision is a pleading-stage ruling from the Fifth Circuit, whose jurisdiction covers Texas, Louisiana and Mississippi. It does not establish a nationwide rule that every visit to an eyewear website constitutes the disclosure of protected health information, nor does it determine whether Eyemart is ultimately liable. The next stage of the case will depend on the district court’s assessment of the plaintiffs’ substantive claims and, if those claims are adequately pleaded, the evidence obtained through discovery.
