Privacy LitigationWeb Tracking
Why Is the Meta Pixel at the Center of So Many Tracking Lawsuits?
The Meta Pixel appears in website tracking lawsuits across industries, including claims against hospitals, telehealth companies, med spas, and media websites. The pixel draws these claims because it is widely installed, it collects a broad range of information, and Meta can often tie what it collects to a specific person.
By Alex Proctor
Published October 11, 2026
Summary
The Meta Pixel is a piece of code that sends information about website visitors to Meta, where it is used for advertising. By default, it sends the labels of the buttons that visitors click, along with a Facebook cookie that can connect the activity to a profile. Plaintiffs rely on those features in wiretapping claims, arguing that Meta received communications from identifiable visitors without their consent. I recommend that businesses confirm where the pixel runs on their websites and which of its features are active, and make a deliberate risk decision about its use.
What Is the Meta Pixel?
Meta describes the pixel as "a snippet of JavaScript code that allows you to track visitor activity on your website." Businesses usually add the code to the header of every page, either directly or through a tag manager. When visitors load a page, the code runs in their browsers and sends information about the visit directly to Meta.
Meta calls each reported action an event. A page view is one event. Businesses can add others for actions such as adding a product to a cart, completing a sign-up form, booking an appointment, or making a purchase.
Businesses use these events to measure which ads led to sales or bookings. When people click an ad on Facebook or Instagram, Meta adds an identifier to the link that brings them to the website. The pixel saves that identifier in a cookie called _fbc and sends it to Meta with later events, so Meta can connect a later purchase or booking to that ad. It also saves its own browser identifier in a first-party cookie called _fbp, which it sends to Meta with its events.
Businesses also use the events to build audiences from their website visitors, so that their ads reach people who have already shown interest. Meta uses the same events to find other people who are likely to take those actions.
The pixel is widely used. In 2022, an investigation by The Markup found it on more than 30 percent of the most popular websites. The same investigation found the pixel sending details about appointment requests to Meta from the websites of 33 of the top 100 hospitals in the United States.
Why Do Plaintiffs Focus on It?
Plaintiffs often focus on the Meta Pixel because it sends Meta a record of what visitors did on a website, along with information that can identify them. Four types of information are central to these claims:
| What the pixel collects | How plaintiffs use it |
|---|---|
| Page addresses and referrers | To show which pages visitors viewed |
| Button clicks and their labels | To show what visitors selected there |
| Cookies such as _fbp and _fbc | To tie activity to a Facebook profile |
| Emails and phone numbers, if enabled | To tie activity to a named person |
Based on Meta's developer documentation, as of October 2026.
In a recent complaint against a med spa chain, a click on a button labeled with a treatment name was allegedly sent to Meta. Meta's documentation says that the pixel collects "any buttons clicked by site visitors, the labels of those buttons and any pages visited as a result of the button clicks." The pixel does this by default unless a business turns the setting off.
Plaintiffs also point to what Meta does with the information. They argue that Meta uses it for its own advertising business, which would make Meta a third party to the communication and not merely a service provider.
In 2025, a federal jury found that Meta itself violated the California Invasion of Privacy Act (CIPA) by obtaining health information from the users of a period-tracking app. That case involved Meta's code in a mobile app rather than the pixel, but the code reported users' activity to Meta in a similar way.
Which Laws Do These Claims Rely On?
Most of the claims rely on wiretapping laws. Under CIPA and the federal Wiretap Act, plaintiffs regularly allege that Meta intercepts the contents of visitors' communications with websites. These lawsuits are often filed against the businesses that installed the pixel, rather than against Meta. Healthcare providers face an additional theory that relates to HIPAA.
Websites with video also face claims under the Video Privacy Protection Act, which restricts the disclosure of what a person watched. Plaintiffs argue that the Facebook cookie makes viewing records identifiable. On October 14, 2026, the Supreme Court heard argument in a case in which a sports website allegedly sent a subscriber's video-watching history to Facebook.
Regulators have also taken action over the pixel. California's privacy agency treated the use of the pixel as a sale and sharing of personal information in its $1.1 million action against PlayOn Sports. In 2023, GoodRx agreed to pay the FTC a $1.5 million penalty for sharing health information with Facebook and other advertising companies after promising that it would not.
What Does This Mean for Businesses?
The Meta Pixel is a lawful tool that many businesses depend on to measure their advertising. The lawsuits concern the pages it runs on, the features that are active by default, whether visitors were given notice and a choice to opt out, and whether that choice is respected by website tracking tools. Regulators have also treated its use as a sale of personal information, so privacy notices need to describe it accurately.
I recommend that businesses confirm where the pixel runs on their websites and which of its features are active. Pages with forms, health-related content, or video deserve particular attention. Businesses that keep the pixel on those pages should do so with the litigation risk in view.
Consent banners can reduce that risk, but only if they block the underlying tracking scripts when visitors decline. A dedicated consent management platform is the practical way to make sure that happens. My recommendation is Captain Compliance, the platform I help build.
Questions
Does the Meta Pixel collect what visitors type into forms?+
Not by default. Meta's documentation says that the pixel collects the names of form fields, and that it captures the values only when a business includes them. A feature called advanced matching does so. It sends details such as email addresses and phone numbers to Meta in a hashed form.
Does moving to the Conversions API avoid these claims?+
Not necessarily. The Conversions API sends similar information to Meta from a business's own servers, rather than from visitors' browsers. That may change how a wiretapping claim is framed, but the information is still shared with Meta, so notice, consent, and state privacy law requirements still apply.
Are other pixels named in these lawsuits?+
Yes. Recent complaints also name the TikTok pixel, the Pinterest tag, the LinkedIn Insight Tag, and advertising tools from Google and Snapchat. The same questions about notice and consent apply to each of them.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.