A recent lawsuit in the United States reportedly alleges that Facebook parent company Meta accessed the private medical data of millions of people without their permission and used the data to serve accurate ads about drugs and medical information on the Facebook platform. The lawsuit, filed last week in the Northern District Court of California, is the second such lawsuit in recent memory alleging that hospitals in the United States violated the Health Insurance Portability and Accountability Act (HIPAA) by providing sensitive patient information to Meta.
The indictment alleges that the hospitals used Meta’s Pixel tool. The tool would access patients’ password-protected, non-public health services portals and share sensitive health information therein, which Meta then sold to Facebook advertisers.
The Pixel tool supports companies in measuring and building audiences for advertising campaigns. In June, The Markup, a nonprofit news organization, found that 33 of the top 100 hospitals in the United States were using Pixel.
The indictment details the experience of one Facebook user. She entered her medical condition for heart and knee problems on UCSF Medical Center’s non-public patient portal and then began receiving precise ads promoting related medications.
Meta’s policy states that advertisers should not share sensitive information they know with Meta, including users’ health and financial information, among other things. The lawsuit, however, alleges that Meta knowingly collected this sensitive medical data from health care websites.
Meta declined to comment on the lawsuit. The company has also come under fire in the past for its data tracking policies. It was previously reported that Meta was developing a “basic advertising” product that did not rely on users’ personal information.
