Privacy LitigationWeb Tracking
Med Spa Websites Are Facing Tracking Lawsuits. Is Yours Exposed?
Med spas and laser hair removal chains are being named in website tracking lawsuits. A class action filed in Los Angeles in September 2026 alleges that a national chain's consultation questionnaire sent visitors' treatment selections to Meta, TikTok, and other advertising companies. Notably, these websites tend to collect visitors' answers about the treatments they want, which wiretapping claims treat as the contents of a private communication.
By Alex Proctor
Published October 10, 2026
Summary
The complaint relies only on the California Invasion of Privacy Act (CIPA), which provides statutory damages of $5,000 per violation and applies to websites of any size. Two similar cases against another med spa chain and a waxing chain reached settlements of $3.5 million and up to $5 million earlier in 2026. Advertising pixels often record button clicks and form activity by default, so these websites may be sharing visitors' answers unintentionally. I recommend that med spas confirm which tracking tools run on their booking forms, and make a deliberate risk decision about their use.
What Does the Complaint Allege?
The complaint was filed in Los Angeles Superior Court in September 2026 as a proposed class action. It describes the defendant as one of the largest medical spa chains in the country, with more than 200 locations that offer treatments such as laser hair removal, Botox, CoolSculpting, and dermal fillers.
According to the complaint, the chain's website invites visitors to book a consultation by completing a questionnaire. The questionnaire asks which treatments visitors want, whether they have had them before, which areas of the body they want treated, and their reasons for seeking treatment. It then asks for their age and contact information.
The complaint alleges that the Meta Pixel, the TikTok pixel, Mixpanel, and Google's Floodlight were installed on the website. It says that each click and selection in the questionnaire was sent to those companies in real time, including clicks on options such as "CoolSculpting" or "Tattoo Removal." It also alleges that visitors were not given notice or asked for consent.
The only claim is under Section 631(a) of CIPA, which is California's wiretapping provision. The complaint seeks statutory damages of $5,000 per violation on behalf of California residents who requested a consultation through the questionnaire.
Why Are Med Spa Websites Exposed?
Starting in 2027, private CIPA claims over website tracking will be primarily focused on the contents of a communication. California's SB 690 ends private lawsuits under the pen register provision, which covers record information such as IP addresses. The answers to consultation questionnaires are likely to qualify as such contents, because each answer is a statement from visitors about the treatments they want.
A typical booking flow can reveal different information at each step:
| Step | What it can reveal |
|---|---|
| Treatment pages | The procedures that visitors are considering |
| Questionnaire selections | The treatments that visitors want and have had before |
| Contact forms | Names, phone numbers, and email addresses |
| Booking confirmations | The appointments made, and at which locations |
Based on the complaint and on how booking flows commonly work, as of October 2026.
Med spas tend to rely on social media advertising, so advertising pixels are common on their websites. The pixels are typically installed to measure which ads lead to bookings, which means they are often active on the booking pages themselves.
These pixels can also collect visitors' answers without being configured to do so. For example, Meta's documentation says that its pixel automatically sends button click data and page metadata unless that setting is turned off. The complaint's example, a click on a button labeled with a treatment name, is consistent with that behavior.
Is This Limited to One Company?
The Los Angeles complaint is not an isolated case. Earlier in 2026, another national med spa chain agreed to a $3.5 million settlement over tracking tools on its website. The settlement class covers people who used the website to schedule consultations. A national waxing chain agreed to a settlement of up to $5 million over similar claims.
Both of those cases were filed in Florida, so the exposure is not limited to California. A separate complaint filed in Los Angeles in September 2026 makes similar allegations about the consultation forms on a plastic surgery practice's website. Taken together, these cases suggest that plaintiffs are focused on websites where visitors book aesthetic and personal care services.
The Los Angeles complaint also does not rely on HIPAA or any other health privacy law. Healthcare providers have faced a separate theory under the federal Wiretap Act that depends on HIPAA. However, CIPA requires no such connection.
What Does This Mean for Med Spas?
I recommend that med spas start by confirming which advertising and analytics tools are active on their consultation and booking forms, and what those tools receive. Some practices may decide to keep the tools on those pages, but that should be a choice made with counsel rather than a default setting.
Consent banners can reduce that risk, but only if they block the underlying tracking scripts when visitors decline. Website owners also need to decide whether their banners use an opt-in or opt-out model, which is part of the same risk decision. A dedicated consent management platform is the practical way to handle both. My recommendation is Captain Compliance, the platform I help build.
Additionally, privacy notices should describe the tools that the websites use. Chains should also confirm that the same controls apply to every location page and to any third-party scheduling tools.
Questions
Does HIPAA apply to med spa websites?+
Often not. HIPAA applies to healthcare providers that transmit health information electronically in connection with certain standard transactions, such as insurance claims. Many med spas do not bill insurers, so HIPAA may not apply to them. However, wiretapping laws such as CIPA apply regardless, and the Los Angeles complaint does not rely on HIPAA.
Do these claims reach med spas outside California?+
Yes. CIPA claims are generally brought on behalf of website visitors located in California, regardless of where the business is based. The two settlements described above came from cases filed in Florida. Plaintiffs have also brought website tracking claims under the federal Wiretap Act.
Are single-location med spas at risk, or only large chains?+
Both are at risk. Wiretapping laws such as CIPA have no size thresholds, so they can be used against any website. The Los Angeles complaint names a large chain, but other recent complaints have named small online stores and a plastic surgery practice. The exposure depends on the tools on the websites and the information that visitors enter, not on the size of the business.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.