Hospital Tracking Claims Survive in Michigan. Is Any State Off Limits?

What Did the Court Decide?

The patients allege that McLaren and Karmanos embedded the Meta Pixel, Google Analytics, Google Tag Manager (notably, a container that loads other tags rather than an advertising tool itself), and the LinkedIn Insight Tag on their websites. According to the complaint, those tools sent searches for symptoms and treatments, physician selections, and appointment scheduling activity to Meta, Google, and LinkedIn without the patients' knowledge or consent.

Judge Matthew Leitman of the Eastern District of Michigan allowed two of the patients' claims to proceed to discovery, the stage where both sides exchange evidence. The first is under the ECPA, the federal wiretapping law. The second is unjust enrichment, a claim that the providers profited unfairly from the patients' information.

Most of the patients' other claims were dismissed because Michigan law requires proof of a present injury, which the patients had not alleged. The two claims that survived do not require that proof. The ECPA sets damages by statute. Unjust enrichment focuses on what the providers gained.

How Does the Crime-Tort Exception Work?

The ECPA is a one-party consent law. Under 18 U.S.C. section 2511(2)(d), a party to a communication may intercept it, and both sides in this case agreed that the providers were parties to their patients' website visits. However, the same provision withdraws that protection when the communication is intercepted "for the purpose of committing any criminal or tortious act." In these cases, the question is whether the provider intended to share the information, not whether it meant to break the law.

The patients argued that the crime was a violation of HIPAA. Under 42 U.S.C. section 1320d-6, a person who knowingly discloses individually identifiable health information in violation of HIPAA commits a federal crime. Judge Leitman noted that courts have split on this theory, but he found "the reasoning of this majority view persuasive at this stage." He also wrote that he would revisit the question later in the case, because new opinions on the issue "are being released on a seemingly daily basis."

Why Does the Risk Reach Beyond California?

Many businesses assume that website tracking lawsuits only happen in California or in states with comprehensive privacy laws. The patients and the providers in this case are all in Michigan, which has no comprehensive privacy law. Michigan's privacy bill, SB 359, has not advanced since June 2025.

The ECPA is a federal law, so it applies to websites in every state. Unlike most state privacy laws, it applies to businesses of any size and lets individuals sue directly. Damages are set by statute at the greater of $100 a day or $10,000. The judge also relied on rulings from federal courts in Illinois, New York, and Georgia that accepted the same argument, so it has support in several parts of the country.

The unjust enrichment claim did not depend on any privacy statute at all. It rests on common law that exists in most states, and the order cited courts in Ohio, Pennsylvania, and Georgia that allowed similar claims to proceed.

What Does This Mean for Healthcare Websites?

The crime-tort theory has worked mainly against healthcare providers, because sharing patient information without permission can violate HIPAA. These complaints focus on pages where patients search for conditions, choose doctors, or book appointments.

I recommend that healthcare organizations identify every tag on those pages, confirm what each one sends and to whom, and remove or restrict tags that send patient activity to advertising platforms. Organizations outside healthcare should not assume they are safe either, because the ECPA, state wiretapping laws, and common law claims apply regardless of where the business is located.