Rand v. Eyemart Express

United States Court of Appeals for the Fifth Circuit

____________

No. 25-10784 ____________

Rachelle Rand; Esperanza Gottschau; Ramon Soto; Georgianna Lash; Aaron Mees,

Plaintiffs—Appellants,

versus

Eyemart Express, L.L.C.,

Defendant—Appellee. ______________________________

Appeal from the United States District Court

for the Northern District of Texas USDC No. 3:24-CV-621

______________________________

Before Haynes, Higginson, and Ho, Circuit Judges.

Stephen A. Higginson, Circuit Judge:

This is an appeal from the dismissal of a putative class action

concerning the alleged unauthorized disclosure of Plaintiffs’ private health

information from Defendant Eyemart Express, LLC (“Eyemart”) to third

party Meta Platforms, Inc. (“Meta”). For the reasons discussed below, we

REVERSE and REMAND for further proceedings consistent with this

opinion.

United States Court of Appeals Fifth Circuit

FILED October 23, 2026

Thomas B. Plunkett, III Clerk

Case: 25-10784 Document: 72-1 Page: 1 Date Filed: 10/23/2026

No. 25-10784

2

I.

Eyemart seeks to provide customers with “all the eye and vision care

services” they need “in one place.” Eyemart owns and operates a chain of

physical stores as well as a website (“the Site”) on which users can browse

products, purchase prescription eyewear, and schedule eye exams. On its

Site, Eyemart utilizes an Internet tracking tool from Meta (Facebook’s

parent company) called “the Pixel,” which tracks and shares information

across websites using that software.1

Meta developed the Pixel to improve targeted advertising by

collecting data on Meta users from third-party websites, such as Eyemart’s

Site. Through agreements with Meta, websites add the Pixel to their pages

and can control what information the Pixel collects and whether any data is

encrypted. With this browsing information, Meta creates profiles, which it

then uses to send targeted advertisements to users. In return, websites like

Eyemart gain more insights into their own advertising efforts and can

improve their targeted advertising by purchasing ads through Meta. This

arrangement incentivizes both Meta and sites like Eyemart to collect as much

information as possible.

As relevant here, the Pixel tracks users’ searches, clicks, product

viewing information, and appointment scheduling information from the Site,

giving that data to Meta. Eyemart does not receive users’ consent to track

their information, nor does it notify users about the Pixel’s tracking on the

Site.

_____________________

1 The facts in this opinion, including the descriptions of the Pixel and related technology, derive from Plaintiffs’ complaint. At this stage, we accept all factual allegations as true and construe the complaint in the light most favorable to Plaintiffs. See Heinze v. Tesco Corp., 971 F.3d 475, 479 (5th Cir. 2020).

Case: 25-10784 Document: 72-1 Page: 2 Date Filed: 10/23/2026

No. 25-10784

3

Plaintiffs are five Facebook users who used the Site. They brought

suit under the Federal Wiretap Act, the Missouri Wiretap Act, and the

Illinois Eavesdropping Act, in addition to an intrusion upon seclusion tort

claim and breach of contract claims. They contend that the information the

Pixel tracked from the Site—related to viewing and purchasing prescription

eyeglasses and scheduling eye exams—is private health information that

Eyemart should not have permitted Meta to access without Plaintiffs’

knowledge or consent.

More specifically, Plaintiffs allege that this information meets the

definition of individually identifiable health information (“IIHI”) protected

under the Health Insurance Portability and Accountability Act of 1996

(“HIPAA”) and is therefore the type of private information entitled to

protection from unauthorized disclosure.2 HIPAA defines IIHI as “any

information, including demographic information collected from an

individual,” that “is created or received by a health care provider, health

plan, employer, or health care clearinghouse” and “relates to the past,

present, or future physical or mental health or condition of an individual, the

provision of health care to an individual, or the past, present, or future

payment for the provision of health care to an individual” and “identifies the

individual” or “with respect to which there is a reasonable basis to believe

that the information can be used to identify the individual.” 42 U.S.C.

§ 1320d(6) (emphasis added).

_____________________

2 To be clear, Plaintiffs do not assert a HIPAA claim, nor could they. See Acara v. Banks, 470 F.3d 569, 570–71 (5th Cir. 2006) (“We hold there is no private cause of action under HIPAA . . . .”). HIPAA is relevant to Plaintiffs’ claims at this stage because IIHI is a useful definition of private health information, which is central to Plaintiffs’ claims. Plaintiffs also allege that Eyemart holds itself out as a HIPAA-covered entity, and rely on HIPAA in their Wiretap Act claim, In remanding for the district court to reconsider all of Plaintiffs’ substantive claims, we do not address those arguments here.

Case: 25-10784 Document: 72-1 Page: 3 Date Filed: 10/23/2026

No. 25-10784

4

Plaintiffs divide themselves into two categories: the “Search

Plaintiffs” and the “Prescription Plaintiffs.” The Search Plaintiffs allege

that they used the Site to browse and search for prescription glasses, which

triggered the Pixel to track their activity on the Site and share it with Meta.

One Search Plaintiff also alleges that when she used the Site to schedule an

eye exam, the Pixel sent the name and location of the Eyemart store she

visited to Meta. The Prescription Plaintiffs allege that they purchased

prescription eyewear from Eyemart, which required them to enter their

prescription information into the Site, and in turn led to their prescriptions

and other health information being shared with Meta through the Pixel. Both

sets of Plaintiffs had already shared other personal information with Meta

through their Facebook accounts—including their names and photos, and

other information varying by Plaintiff, such as gender, location, and

relationship status—before using the Site. With this information, Meta

could combine Plaintiffs’ personal details with their data from Eyemart’s Site

to identify them and then send them targeted ads.

The district court considered two motions to dismiss in this case. In

the first motion to dismiss, Eyemart asserted that Plaintiffs lacked standing

and failed to state a claim. The district court determined that Plaintiffs had

standing but had failed to state a claim and afforded Plaintiffs an opportunity

to amend their complaint. Plaintiffs then filed the operative complaint (“the

Amended Complaint”). Eyemart again moved to dismiss for failure to state

a claim but did not renew its standing arguments.

The district court granted the second motion to dismiss in full and

dismissed the case with prejudice. The district court found that the Search

Plaintiffs failed to state a claim for relief because they did not adequately

Case: 25-10784 Document: 72-1 Page: 4 Date Filed: 10/23/2026

No. 25-10784

5

allege that they shared any IIHI with Eyemart.3 As to the Prescription

Plaintiffs, the district court acknowledged that they shared IIHI with

Eyemart by entering their prescription information but found that they had

failed to show that any IIHI was disclosed to Meta. Without sufficient

allegations that any Plaintiff’s IIHI was shared with Meta, the district court

concluded that each of Plaintiffs’ claims necessarily failed.

On appeal, Plaintiffs argue that they adequately alleged both that they

shared their IIHI with Eyemart and that the Pixel on Eyemart’s Site

conveyed that IIHI to Meta without their knowledge or consent. Plaintiffs

ask us to reverse, reinstate all of their claims, and remand. Eyemart opposes,

asserting that the district court correctly determined that Plaintiffs failed to

plausibly allege any sharing of their IIHI with Meta. In the alternative,

Eyemart renews its standing argument from its first motion to dismiss and

asks us to reverse and remand with instructions to dismiss for lack of

standing.

II.

We review a district court’s grant of a motion to dismiss de novo,

whether for lack of standing under Rule 12(b)(1) or for failure to state a claim

under Rule 12(b)(6). Jack v. Evonik Corp., 79 F.4th 547, 561 (5th Cir. 2023);

Lane v. Halliburton, 529 F.3d 548, 557 (5th Cir. 2008).

_____________________

3 The district court used the acronym “PHI” (rather than IIHI) to refer to private health information, and the parties sometimes use that acronym to represent “personal health information,” or “protected health information” as well. Because the parties and the district court accept HIPAA’s definition of IIHI as representing PHI in this case— regardless of whether it references private, personal, or protected health information—we use IIHI throughout this opinion for clarity.

Case: 25-10784 Document: 72-1 Page: 5 Date Filed: 10/23/2026

No. 25-10784

6

In reviewing a motion to dismiss under Rule 12(b)(1), we may consider

“(1) the complaint alone; (2) the complaint supplemented by undisputed

facts evidenced in the record; or (3) the complaint supplemented by

undisputed facts plus the court’s resolution of disputed facts.” In re S.

Recycling, L.L.C., 982 F.3d 374, 379 (5th Cir. 2020) (quoting Barrera-

Montenegro v. United States, 74 F.3d 657, 659 (5th Cir. 1996)).

“To survive a motion to dismiss [under Rule 12(b)(6)], the plaintiff’s

complaint must contain sufficient factual matter, accepted as true, to state a

claim to relief that is plausible on its face.” Jack, 79 F.4th at 561 (internal

quotation marks omitted) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678

(2009)). At this stage, we accept all factual allegations as true and make all

reasonable inferences in the light most favorable to the plaintiffs. Id. We do

not accept legal conclusions and conclusory allegations as true. Id.

III.

Because it is jurisdictional, we begin by addressing Plaintiffs’ standing

to bring this case. Article III standing has three well-known requirements:

plaintiffs must “show (i) that [they] suffered an injury in fact that is concrete,

particularized, and actual or imminent; (ii) that the injury was likely caused

by the defendant; and (iii) that the injury would likely be redressed by judicial

relief.” Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816, 821

(5th Cir. 2022) (quoting TransUnion LLC v. Ramirez, 594 U.S. 413, 423

(2021)). Plaintiffs here clear all three bars.

We begin with injury, which is the only element Eyemart challenges.

The district court easily disposed of the injury argument Eyemart levied in

its first motion to dismiss, reasoning that disclosure of IIHI without an

individual’s permission is a cognizable harm. It further determined that such

Case: 25-10784 Document: 72-1 Page: 6 Date Filed: 10/23/2026

No. 25-10784

7

injury was concrete and particularized because disclosure of Plaintiffs’ health

information affected each Plaintiff’s privacy.

We agree. Plaintiffs have suffered an actionable injury in fact in the

unauthorized disclosure of their IIHI to Meta.

Although this injury is intangible, it is cognizable. As the Supreme

Court explained in TransUnion LLC v. Ramirez, “[c]hief among” the

intangible harms that are sufficiently concrete for standing purposes “are

injuries with a close relationship to harms traditionally recognized as

providing a basis for lawsuits in American courts.” 594 U.S. at 425 (citing

Spokeo, Inc. v. Robins, 578 U.S. 330, 340–41 (2016)). “Those include, for

example, reputational harms, disclosure of private information, and intrusion

upon seclusion.” Id. Our court has since expanded on what this means for a

plaintiff to successfully plead an injury in fact: “[A] plaintiff doesn’t need to

demonstrate that the level of harm he has suffered would be actionable under

a similar, common-law cause of action. But he does need to show that the

type of harm he’s suffered is similar in kind to a type of harm that the common

law has recognized as actionable.” Perez, 45 F.4th at 822 (emphasis added);

see also Cranor v. 5 Star Nutrition, L.L.C., 998 F.3d 686, 690–91 (5th Cir.

2021) (“[O]ur inquiry is focused on types of harms protected at common

law . . . .” (citation omitted)); Cochenour v. 360Training.com, Inc., No. 1:25-

CV-7, 2025 WL 3251719, at *3–4 (W.D. Tex. Nov. 3, 2025) (applying Perez

and Cranor to a Pixel tracking case).

Post-TransUnion, our sister circuits have consistently held that

unauthorized disclosure of individuals’ private browsing activity, along with

identifiable personal information, constitutes an injury in fact. For example,

in Salazar v. Paramount Global, 133 F.4th 642, 647 (6th Cir. 2025), the Sixth

Circuit held that disclosure of an individual’s private video-viewing

history—via the defendant’s use of the Pixel—bore a close relationship to

Case: 25-10784 Document: 72-1 Page: 7 Date Filed: 10/23/2026

No. 25-10784

8

the traditional common law torts of public disclosure of private information

and intrusion upon seclusion. In Pileggi v. Washington Newspaper Publishing

Co., 146 F.4th 1219, 1227–31 (D.C. Cir. 2025), another Pixel case, the D.C.

Circuit concluded the same, holding that “having one’s private viewing

history provided without consent to a third party is a concrete injury” that is

“closely analogous to the harm of intrusion upon seclusion” and “the

longstanding tort of publicity given to private life.” In Salazar v. National

Basketball Ass’n, 118 F.4th 533, 544 (2d Cir. 2024), the Second Circuit held

that unauthorized disclosure of “personal viewing information,” via the

Pixel, was sufficiently analogous to “the harm flowing from the public

disclosure of private facts common-law analog.” And most recently, in In re

BPS Direct, LLC; Cabela’s LLC Wiretapping Litigation, 175 F.4th 423, 433–

34 (3d Cir. 2026), the Third Circuit determined that plaintiffs who had made

purchases from an online retailer—resulting in disclosure of online shoppers’

banking information to third parties through tracking code—suffered an

injury analogous to intrusion upon seclusion.

Examining these cases, we have no difficulty concluding that the

unauthorized tracking of Plaintiffs’ private health information and disclosure

of that information to Meta is an invasion of privacy mirroring the harm

addressed by these common law torts. The circuit authorities just addressed

concern plaintiffs’ online media consumption and shopping habits. Here,

Plaintiffs allege unauthorized disclosure of their private health information,

which is inherently sensitive and personal. Sharing this information without

Plaintiffs’ permission parallels the harms underlying both intrusion upon

seclusion and public disclosure of private facts.

Eyemart argues that Plaintiffs cannot rest on intrusion upon seclusion

as a valid analog because “no Plaintiff sufficiently alleged an intrusion upon

seclusion.” That contention misunderstands Perez. At this stage, we

compare the harm that intrusion upon seclusion claims address and the harm

Case: 25-10784 Document: 72-1 Page: 8 Date Filed: 10/23/2026

No. 25-10784

9

Plaintiffs have suffered, not whether Plaintiffs have adequately alleged each

element of the tort. See Perez, 45 F.4th at 822; Paramount Glob., 133 F.4th at

648 n.6 (“[F]inding ‘a close historical or common-law analogue’ for the

modern injury or harm does not require an exact match for each element of

the common-law tort.” (citation omitted)).

Intrusion upon seclusion protects against an invasion of privacy, and

public disclosure of private facts protects against dissemination of private

information. See Restatement (Second) of Torts §§ 652B, 652D

(A.L.I. 1977). In Pileggi, the D.C. Circuit used two apt hypotheticals to

explain why these torts provide sufficient analogs for injuries stemming from

the Pixel. First, the court described Pixel tracking as similar to “a magazine

seller nos[ing] around in someone’s mailbox to learn what periodicals to

press the owner to buy,” matching the harm addressed by intrusion upon

seclusion claims. 146 F.4th at 1228. Then, in comparing the harm to that of

public disclosure of private facts, it explained:

If [the defendant] had sent [the plaintiff’s] video viewing history to a stranger, and that stranger repeatedly approached [the plaintiff] asking her to buy things based on the videos she had viewed, most would agree that [the plaintiff’s] privacy had been invaded.

Id. at 1229–30. These analogies apply with even more force to the disclosure

of personal health information at issue here.

We join the other courts to consider this issue in similar circumstances

and find that Plaintiffs have suffered a cognizable injury in the unauthorized

disclosure of their IIHI to Meta. That injury is both concrete (disclosure of

private information) and particularized (it is their information).

Traceability and redressability go unchallenged by Eyemart and are

both easily satisfied. The unauthorized disclosure of Plaintiffs’ health

information naturally traces to Eyemart, which is the entity that gave Meta

Case: 25-10784 Document: 72-1 Page: 9 Date Filed: 10/23/2026

No. 25-10784

10

access to its users’ private information without their knowledge or consent.

See, e.g., Paramount Glob., 133 F.4th at 645; Nat’l Basketball Ass’n, 118 F.4th

at 544. And Plaintiffs’ harm is redressable by the injunctive relief (requiring

Eyemart to remove the Pixel or obtain users’ consent to tracking) and

damages that Plaintiffs seek. See, e.g., Paramount Glob., 133 F.4th at 647–48;

Pileggi, 146 F.4th at 1231.

Accordingly, Plaintiffs have Article III standing, and we turn to the

merits.

IV.

The district court dismissed all of Plaintiffs’ claims based on two

threshold decisions. The district court determined that Plaintiffs failed to

adequately plead that (A) the Search Plaintiffs shared IIHI with Eyemart, and

that (B) the Prescription Plaintiffs’ IIHI on the Site was shared with Meta.

Without those foundational allegations, each of Plaintiffs’ claims necessarily

failed. The district court erred on both fronts.

A.

First, the district court erred in finding that the Search Plaintiffs did

not share any IIHI with Eyemart.

The Search Plaintiffs allege that they used the Site to search for and

browse prescription eyewear, which they claim caused the Pixel to track and

share that activity with Meta. One Search Plaintiff also used the Site to

schedule an eye exam, resulting in the name and location of the Eyemart store

she visited being shared with Meta. The district court found that the Search

Plaintiffs did not convey any IIHI to Eyemart by searching for prescription

eyewear and that, because the Search Plaintiff who scheduled an

appointment online had already shared her location with Meta on Facebook,

Case: 25-10784 Document: 72-1 Page: 10 Date Filed: 10/23/2026

No. 25-10784

11

the Pixel’s tracking of her activities did not result in Meta receiving any new

information.

As noted above, we follow the parties’ lead and adopt HIPAA’s

definition of IIHI in deciding whether Plaintiffs adequately alleged the

sharing of their personal health information with Eyemart and Meta. Stated

simply, IIHI is information relating to a medical condition or healthcare

services sufficient to identify the individual with the condition or receiving

the services. See 42 U.S.C. § 1320d(6).

At oral argument, Eyemart’s counsel conceded that the information

Meta received through the Pixel was individually identifiable because,

through Facebook, the information was linked to specific users. This is by

design. Without identifying information, Meta and Eyemart could not

improve their targeted advertising. That leaves us to decide whether the

Search Plaintiffs adequately alleged that they shared information relating to

their health conditions or the provision of healthcare by using Eyemart’s Site.

We find that they did.

Eyemart argues that the Search Plaintiffs “never alleged that they

entered diagnoses or symptoms, or completed a transaction or appointment

request, that inherently disclosed a condition,” and therefore, they have not

sufficiently alleged that they shared health information. IIHI is not so

narrow. Again, IIHI covers information “collected from an individual” that

“relates to” an individual’s “past, present, or future physical or mental health

or condition,” “the provision of health care to an individual,” or “the past,

present, or future payment for the provision of health care.” 42 U.S.C.

§ 1320d(6) (emphasis added). It need not reveal a specific diagnosis or

condition; that it pertains to a condition or provision of healthcare is

sufficient.

Case: 25-10784 Document: 72-1 Page: 11 Date Filed: 10/23/2026

No. 25-10784

12

The Search Plaintiffs allege that the Pixel tracked their browsing

activity on the Site and shared it with Meta, which then monetized that

information. More specifically, the Search Plaintiffs claim that the Pixel is

active across the Site, and when they viewed or interacted with medical

products on the Site, the Pixel intercepted that information for Meta. They

assert that each time they clicked on products or tried to schedule exams,

those actions “resulted in [IIHI] being intercepted by the Meta Pixel.”

Indeed, according to the Amended Complaint, Eyemart’s Privacy Policy

itself provides that personal health information is requested when scheduling

an appointment on the Site, as one Search Plaintiff did here. The Search

Plaintiffs also claim that Eyemart identifies users by “upload[ing] customer

lists to Meta that contain Tracked Users’ email addresses and purchase

information, including what prescription eyewear they purchased or viewed.

[Eyemart] uploads these lists to Meta so that Meta can match Tracked Users

to their Facebook profiles.”

By virtue of its position as a healthcare products and services provider,

activity on Eyemart’s Site pertains to individuals’ vision. Because, as stated

in the Amended Complaint, Plaintiffs’ tracked information from the Site

relates to their health and the provision of healthcare services, the Search

Plaintiffs have adequately alleged that they shared private health information

with Eyemart. And because Meta received this data from the Pixel and paired

it with Plaintiffs’ identifying information, that information constitutes IIHI.

Although the parties have not provided any circuit court cases

addressing Pixel tracking of health information—and we are not aware of any

to date—the parties discuss several district court cases. For example,

Plaintiffs point to Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967 (S.D. Cal.

2023). There, the court concluded that the plaintiffs’ activity on the

defendant’s hospital website—which used the Pixel—fell within the scope of

protected IIHI, at least at the pleading stage. Id. at 973. The court found that

Case: 25-10784 Document: 72-1 Page: 12 Date Filed: 10/23/2026

No. 25-10784

13

searching for information about conditions, filtering the results of a physician

directory, searching for doctors specializing in certain conditions, and

booking an appointment on the defendant’s site all “plausibly convey[ed]

information about a present medical condition and the provision of medical

care covered by HIPAA.” Id.

Similarly, in R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 885–86 (C.D.

Cal. 2024), the court determined that the plaintiffs searching for and adding

certain healthcare products to their carts on the drug store Walgreens’s

website resulted in the transmission of the plaintiffs’ personally identifiable

information and protected health information to Meta, via the Pixel. The

website collected the names of healthcare products, the fact that certain

customers were purchasing those products, and the customers’ names. See

id. The court reasoned that plaintiffs purchasing “sensitive healthcare

products”—including items such as pregnancy tests and diabetes test kits—

“related to specific health conditions” because they could be used to

diagnose or treat a condition. Id. at 893, 887. Thus, the court found that the

tracked activity was personal medical information, sufficient to support an

invasion of privacy claim. Id. at 890–91, 894.

Rather than distinguish these authorities, Eyemart points to a single

district court case from a different context: American Hospital Ass’n v.

Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024). In Becerra, the court ruled

on cross motions for summary judgment regarding the authority of the

Department of Health and Human Services to promulgate certain guidance

about IIHI under HIPAA. Id. at 788–89. The guidance took the form of a

bulletin, which listed as an example of IIHI the combination of an individual’s

IP address with a visit to certain websites addressing specific health

information or providers and the user’s reason for visiting the site. Id. at 789.

The district court concluded that this bulletin “appeared to shoehorn

Case: 25-10784 Document: 72-1 Page: 13 Date Filed: 10/23/2026

No. 25-10784

14

additional information into the IIHI definition” and consequently exceeded

HHS’s statutory authority. Id. at 789, 804.

In Becerra, the technology discussed only connected an IP address

with an individual’s visit to a site. Id. at 789. Here, Plaintiffs’ information

shared with Meta goes beyond that. Plaintiffs contend that Meta captured

their activity about seeking healthcare services on the Site—including

searching for specific products and providers—and paired it with their

personal information from Facebook to curate targeted ads. Additionally, as

noted, according to the Amended Complaint, Eyemart’s Privacy Policy itself

asserts that protected health information is requested when scheduling an

appointment on the Site. This broader scope of information distinguishes

Plaintiffs’ data from the data discussed in Becerra and makes this case more

akin to Cousin and R.C.

At this early stage, taking Plaintiffs’ factual allegations as true, the

Search Plaintiffs’ shopping and scheduling information “relates to” their

health and the provision of healthcare services, within HIPAA’s definition of

IIHI. 42 U.S.C. § 1320d(6). Thus, we hold that the district court erred in

finding the Search Plaintiffs had not shared any personal health information

with Eyemart.

B.

Next, the district court correctly found that the Prescription Plaintiffs

shared their IIHI with Eyemart but erred in finding that Plaintiffs failed to

plead that their IIHI was shared with Meta.

In considering whether the Prescription Plaintiffs’ IIHI was shared

with Meta, the district court parsed Plaintiffs’ allegations and focused on a

few distinct features of the Amended Complaint while ignoring important

allegations. First, the district court determined that only the Prescription

Plaintiffs’ “prescription information provided when ordering prescription

Case: 25-10784 Document: 72-1 Page: 14 Date Filed: 10/23/2026

No. 25-10784

15

eyeglasses” was significant. It disregarded the rest of Plaintiffs’ tracking

allegations as “irrelevant.” Then, looking solely at allegations about

ordering prescription eyeglasses, the district court decided that only after an

item is added to a user’s cart could a customer share IIHI on the Site by

“input[ting] prescription information on the ordering screen.” Next, the

district court found that Plaintiffs did not sufficiently allege that the Pixel

tracks any IIHI when items are added to a Site user’s cart, whether they are

prescription or nonprescription items.

To support that conclusion, the district court considered Figure 13

from the Amended Complaint in detail. Figure 13 is a screenshot that

represents an example of data (created by Plaintiffs’ attorney, not

representing Plaintiffs’ activity) allegedly shared through the Pixel. It

purports to show URL data the Pixel would receive from some certain

activity on the Site, but it does not show any data related to any Plaintiff’s

actual purchase or other activity on the Site. Despite the limitations of this

image, the district court made several impermissible inferences about the

figure:

Figure 13’s caption says it depicts when an “AddToCart event discloses when Tracked Users add prescription lenses to digital cart”; however, the figure shows that the data includes only (1) the content ID, which plaintiffs do not explain or establish any connection to how it would disclose prescription information; (2) “Plastic,” which appears to be a description of the frame material; (3) “2LensAdvizor,” which appears to be a third party fulfillment entity; and (4) the price of the item.

The district court then reasoned, “Because nothing in Figure 13 depicts

disclosure to Meta of prescription information or that the lenses are

prescription lenses, the Court finds that this does not sufficiently allege that

any PHI was shared with Meta.”

Case: 25-10784 Document: 72-1 Page: 15 Date Filed: 10/23/2026

No. 25-10784

16

We take issue with several features of this analysis. First, as discussed

above, IIHI is not so narrow that it applies only to specific prescription

information. As stated in the Amended Complaint, Plaintiffs’ interactions

on the Site relate to Plaintiffs’ health, making the data generated from

Plaintiffs’ activity on the Site IIHI. Second, as reflected in the quote above,

the district court made several inferences about the figure’s contents in the

light most favorable to Eyemart, rather than to Plaintiffs, making them

impermissible at this stage. Third, the district court failed to explain why it

would be appropriate to extrapolate from Plaintiffs’ figures—which reflected

only a sample of the type of information transmitted by a certain function on

the Site, not the Prescription Plaintiffs’ actual purchases—while expressly

ignoring other allegations.4 In other words, the district court considered a

figure expressly included “[b]y way of example” to be dispositive. When

that figure did not unambiguously show that Meta received prescription

information, the district court found that Plaintiffs had failed to show Meta

received any of Plaintiffs’ IIHI.

This limited focus defies the well-established Rule 12(b)(6) dismissal

standard. “Under the federal rules, we construe pleadings in their entirety

when assessing their sufficiency.” Arbuckle Mountain Ranch of Tex., Inc. v.

Chesapeake Energy Corp., 810 F.3d 335, 340 (5th Cir. 2016); see also Funk v.

Stryker Corp., 631 F.3d 777, 783 (5th Cir. 2011) (“When reviewing a motion

_____________________

4 Eyemart argues that the figures in the Amended Complaint contradict Plaintiffs’ other allegations, so the district court correctly disregarded those allegations. Eyemart points to Stevenson v. Tocé, 113 F.4th 494, 502–03 (5th Cir. 2024), for the proposition that where an exhibit contradicts an allegation in the complaint, the exhibit controls. But, in that case, we saw “no contradiction” between an exhibit and the relevant complaint. Id. at 503. The same is true here. The figures in the Amended Complaint were solely meant to provide a limited example of URL paths tracked by the Pixel, not to serve as evidence or to displace Plaintiffs’ related factual allegations.

Case: 25-10784 Document: 72-1 Page: 16 Date Filed: 10/23/2026

No. 25-10784

17

to dismiss, a district court ‘must consider the complaint in its entirety . . . .’”

(quoting Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007))).

Apart from the demonstrative images in the Amended Complaint,

Plaintiffs made several factual allegations concerning the disclosure of IIHI

to Meta. For example, Plaintiffs assert, “The Pixel is active across the [Site],

including prescription product pages and the relevant information associated

with Tracked Users’ attempts to schedule eye examinations on the website,

as implemented by Eyemart. When a Tracked User views or interacts with

those medical products or services on the [Site], those actions are intercepted

and monetized by the Tracking Entity.” Similarly, Plaintiffs allege that

“when Tracked Users click to find specific items on the [Site] or purchase

prescription eyewear, a description of each item is sent to the Tracking Entity

(such as make, model, materials, and product ID of frames and lenses), in

addition to details about Tracked Users’ attempts to schedule eye exams.”

And, as noted above, Plaintiffs claim that Eyemart “uploads customer lists

to Meta that contain Tracked Users’ email addresses and purchase

information, including what prescription eyewear they purchased or viewed.

[Eyemart] uploads these lists to Meta so that Meta can match Tracked Users

to their Facebook profiles.”

Thus, according to the Amended Complaint, the Pixel (and therefore

Meta) received data about the vision products Plaintiffs viewed, their

prescription eyewear purchases, their appointment details, and other IIHI.

Taking these factual allegations as true, and making all reasonable inferences

in Plaintiffs’ favor, Plaintiffs have adequately alleged that, by using the Pixel,

Eyemart shared Plaintiffs’ IIHI with Meta without their consent.

* * *

Finally, we note that, without the benefit of discovery, Plaintiffs

cannot be expected to know much more at this early stage. “[A] Rule

Case: 25-10784 Document: 72-1 Page: 17 Date Filed: 10/23/2026

No. 25-10784

18

12(b)(6) motion tests the sufficiency of the pleadings, not the merits of the

case.” George v. SI Grp., Inc., 36 F.4th 611, 619 (5th Cir. 2022). Both the

Search Plaintiffs and the Prescription Plaintiffs have sufficiently pled that

their browsing activity on Eyemart’s Site led to transmission of their IIHI to

Meta, without their permission. If the district court finds that Plaintiffs have

adequately pled the elements of their claims, discovery will be necessary to

test those allegations.

V.

In accordance with the foregoing, we agree with the district court that

Plaintiffs have standing, and REVERSE the district court’s dismissal on the

grounds that the Search Plaintiffs had not shared IIHI with Eyemart and that

neither the Search Plaintiffs nor the Prescription Plaintiffs’ IIHI was shared

with Meta and REMAND for further proceedings consistent with this

opinion.

Case: 25-10784 Document: 72-1 Page: 18 Date Filed: 10/23/2026

Superintendent of Documents 2026-10-25T16:23:55-0400 Government Publishing Office, Washington, DC 20401 U.S. Government Publishing Office Government Publishing Office attests that this document has not been altered since it was disseminated by Government Publishing Office