Class Action Says Santa Clara Valley Medical Center Shares Website Visitors’ Info with Facebook, Others

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Santa Clara Valley Medical Center secretly transmits the private data of website visitors to Facebook and other third parties without consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 90-page amended complaint says the County of Santa Clara—which operates the San Jose, California hospital and several other affiliated medical facilities and clinics—has embedded a host of invisible web-tracking tools into its website and patient portal. According to the case, this technology “purposefully and intentionally” shares visitors’ personal data with third parties, who then “exploit” the information for targeted advertising purposes.

The lawsuit explains that the tracking codes—which include at least Facebook’s Meta pixel and the Google Analytics pixel—are designed to capture every movement a visitor makes on a website in real time. By using such back-end tools on SCVMC.SCVH.org, the medical center has violated state law and illegally disclosed patients’ personally identifiable information with third-party marketing companies, including co-defendant Meta Platforms (formerly Facebook), Google, YouTube and software company New Relic, the suit alleges.

Per the case, patients can use the website to access the hospital’s patient portal, find doctors, research treatments, pay bills, refill prescriptions, communicate with providers and more. However, unbeknownst to website visitors, Santa Clara Valley Medical Center discloses to third parties its patients’ every interaction with the page, including details about their healthcare providers, search queries, buttons clicked, IP addresses, website URLs, physical locations and the contents of any communications exchanged via the website, the complaint claims.

“In essence, Santa Clara encourages its patients to use a tapped device, and once the webpage is loaded into a patient’s browser, the software-based wiretap is quietly waiting for private communications on the webpage to trigger the tap, which intercepts those communications intended only for Santa Clara and transmits those communications to Facebook and other third parties,” the filing charges.

In addition, the defendant shares with Meta patients’ Facebook IDs, a unique identifier that can be used to pinpoint an individual’s Facebook profile, the lawsuit alleges. This combination of data allows Facebook—or, indeed, any internet user—to easily link a patient’s identity to their online activity and preferences, the suit stresses.

The case contends that the medical center’s “malicious” actions violate numerous privacy protection statutes afforded by state law.

“Santa Clara made the decision to barter its patients’ personal health information to Facebook because it wanted access to the Meta Pixel tool,” the complaint states. “While that bargain may have benefited Santa Clara and Facebook, it also violated the privacy rights of [the plaintiff] and Class Members.”

The lawsuit looks to represent any patient or prospective patient of Santa Clara Valley Medical Center or any of its affiliates who, since August 25, 2018, exchanged communications on SCVMC.SCVH.org or any other Santa Clara Valley Medical Center-affiliated website, including patient portals.

The complaint embedded below is an amended version of a case initially filed on August 25, 2023 in the U.S. District Court for the Northern District Of California.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.