Third Circuit Affirms Dismissal of Pixel-Tracking Privacy Class Action

The Third Circuit’s decision in Cole v. Quest Diagnostics Inc. provides an overview of how federal appellate courts are approaching privacy claims involving website pixel-tracking.

Covington reports that the court reviewed allegations that Quest Diagnostics unlawfully enabled a third-party pixel provider to collect user activity data from its web pages, in violation of the California Invasion of Privacy Act (CIPA) and the Confidentiality of Medical Information Act (CMIA).

After examining the claims, the panel concluded that the complaint did not state a viable theory of liability under either statute.

The case centered on a website interaction in which plaintiffs asserted they accessed online test-result pages while an embedded pixel transmitted certain information to an external service. Plaintiffs alleged this amounted to an interception of medical communications and disclosure of medical information.

The district court dismissed the CMIA claim without prejudice because the data at issue did not constitute protected medical information. It dismissed the CIPA claim with prejudice.

In affirming the dismissals, the Third Circuit applied its precedent from In re Google Inc. Cookie Placement Consumer Privacy Litigation. The court concluded that the pixel provider qualified as a direct participant in the exchange because each browser request generated an independent communication to the provider’s servers.

On that basis, no actionable wiretapping and no aiding-and-abetting liability was found.

Turning to CMIA, the panel determined that the alleged disclosure of a webpage URL associated with viewing test results did not convey any patient’s medical history, condition, or treatment. The court reasoned that merely revealing that someone accessed a page containing results indicated only that the person was a patient, which did not meet the statutory definition of “medical information.”

For attorneys, the ruling signals that privacy claims premised solely on metadata or generalized website-activity information may face substantial statutory hurdles, at least in the Third Circuit. It illustrates the importance of distinguishing between substantive health-related content and incidental indicators of patient status when evaluating exposure under California’s privacy framework.