A California appeals court has published a ruling that makes tracking-pixel cases easier to bring as class actions. In Doe v. Adventist Health, it accepted expert evidence that the Meta Pixel and Google Analytics code was “designed to behave uniformly for all users”, so whether it shared URLs and identifiers can be proved once for everyone — and it reversed the trial court’s refusal to certify two groups of patients. Days later, the Third Circuit in Santoro v. Tower Health held that patients have standing to sue over a hospital’s Meta Pixel, but still threw the case out because the complaint was too vague. Neither is a finding that anyone broke the law. Together they say: the per-visitor defence is weaker than it was, and what your tags actually send is what decides the case.
Most of the recent wave of tracking litigation never reaches a verdict. It is decided at two earlier gates: whether the plaintiffs have standing at all, and whether the case can proceed as a class action. Two appellate courts addressed exactly those gates in July and August 2026.
Doe v. Adventist Health: certification reversed
Patients of Adventist Health System/West sued over tracking code on the hospital’s websites — “the Meta Pixel and/or Google Analytics”, installed on a public health-risk-assessment (HRA) site and its logged-in patient portal — under the California Invasion of Privacy Act and California’s medical-privacy statute (CMIA). The trial court refused to certify a class. The Court of Appeal’s opinion, filed on 24 July and certified for publication on 24 August 2026, reversed most of that:
“We reverse the court’s order denying class certification for the HRA form subclass and the surviving claims for the patient portal subclass and remand the matter for further proceedings.”
It affirmed the rest: the patient-portal group’s CMIA claims stay uncertified, because the court agreed that the URLs sent from the portal did not all contain “medical information” as that statute defines it.
Why it matters: the code is the common proof
Class certification turns on whether the key questions can be answered with evidence common to everyone. Defendants in pixel cases usually argue they cannot: what a tag sent depends on each visitor’s pages and clicks. The opinion records the evidence that defeated that argument for the two subclasses. The plaintiffs’ expert said the tracking code “operates deterministically, meaning it consistently executes in the same manner” and is “designed to behave uniformly for all users”. Adventist’s own expert said she was unaware of any instance where the pixels did not “share at least a baseline of information,” including URLs. A witness from the hospital’s marketing agency testified that Google Tag Manager containers carrying Google and Meta tags were on the HRA pages.
For a site operator, that is the uncomfortable part. The same property that makes a tag useful — it fires the same way for every visitor — is what lets a court treat thousands of visitors as one case.
And why the class matters
The court was blunt about the economics. The plaintiffs sought $5,000 per person in CIPA statutory damages and $2,500 under CMIA. “With at most $7,700 (plus attorney fees) at stake, it is hard to imagine how the average person could afford to pursue these claims individually,” the opinion says — while as a class action the aggregate “would consist of millions of dollars”. That is the arithmetic behind every demand letter in this area.
Santoro v. Tower Health: standing yes, case still dismissed
The Third Circuit’s precedential opinion of 28 August 2026 points the other way on outcome. Patients alleged that a hospital’s Meta Pixel shared their health information with Meta. The court held they had standing — but limited that to “patients [who] shared information about their own health conditions with their healthcare provider, which surreptitiously shared that individually-identifiable information with a third party.” It then affirmed dismissal with prejudice: the plaintiffs did not argue their complaint survived, and the court upheld the refusal to let them amend again because of undue delay. The trial court had found they did not adequately specify what health information the pixel shared.
Put next to Adventist, the lesson is consistent. Courts are increasingly willing to let these cases in. Whether a case goes anywhere depends on concrete evidence of what the code transmitted — which URLs, which identifiers, which page.
What to do with this
- Know what each tag sends, page by page. In Adventist, the fact that a results page’s URL reached Meta and Google was the issue. A tag that is harmless on a homepage is not harmless on a page whose URL describes a condition, a search or an account. Our guide to attributing what a script set and reading the network tab show how to see it.
- Keep marketing tags out of logged-in areas unless there is a specific reason and consent. The portal subclass existed because analytics ran behind the login.
- Gate tags on consent where you can, and check that the gate works before the first page view — see the pre-consent tracking checklist.
- Don’t over-read SB 690. California’s new law moves website pen-register claims to the Attorney General from 2027; Adventist was a Sec. 631 wiretap and CMIA case, which SB 690 does not touch. See SB 690 is signed.
Nothing here is legal advice. Adventist is a ruling on class certification, not on liability, and the case now goes back to the trial court.
In both cases the question was what the tags actually transmitted. Get an independent, timestamped record of what a site sends to third parties with CookieInspector.