The Fifth Circuit Revived a Class Action on October 23 Over Website Tracking That Allegedly Sent Eyewear Shoppers’ Health Information to Meta — What the Opinion Holds and Who It Reaches

What Changed, and When

On October 23, 2026 a three-judge panel of the Fifth Circuit decided Rand v. Eyemart Express, L.L.C., No. 25-10784, an appeal from the United States District Court for the Northern District of Texas, USDC No. 3:24-CV-621. The opinion is published and runs 18 pages. Judge Stephen A. Higginson wrote for the court, joined by Judges Haynes and Ho.

The court described the case in its opening paragraph as “an appeal from the dismissal of a putative class action concerning the alleged unauthorized disclosure of Plaintiffs’ private health information from Defendant Eyemart Express, LLC (‘Eyemart’) to third party Meta Platforms, Inc. (‘Meta’),” and concluded: “For the reasons discussed below, we REVERSE and REMAND for further proceedings consistent with this opinion.”

The underlying allegations, as the court summarized them from the complaint, are these. Eyemart operates stores and a website where users can browse products, buy prescription eyewear and schedule eye exams. The site used the Meta pixel, a tracking tool that, per the complaint, recorded users’ searches, clicks, product viewing and appointment scheduling and passed that data to Meta. The opinion states that, on the plaintiffs’ account, Eyemart “does not receive users’ consent to track their information, nor does it notify users about the Pixel’s tracking on the Site.” The five named plaintiffs already had Facebook accounts, so Meta could match the browsing data to their real identities and serve targeted advertising.

The plaintiffs sued under the Federal Wiretap Act, the Missouri Wiretap Act and the Illinois Eavesdropping Act, and brought intrusion upon seclusion and breach of contract claims. The district court dismissed the case with prejudice, reasoning that neither group of plaintiffs had adequately alleged that any individually identifiable health information reached Meta.

The Fifth Circuit disagreed on both of the grounds the district court relied on, and reversed. Two independent outlets reported the result the same day: Bloomberg Law and Law360.

Who in Texas This Reaches

The Fifth Circuit covers Texas, Louisiana and Mississippi. A published panel opinion binds the federal district courts in all three states, so this decision now governs how a federal judge in Dallas, Houston, San Antonio, Austin, Lubbock, El Paso or Corpus Christi approaches a tracking-pixel privacy case.

The people the opinion speaks to most directly fall into a few groups:

• Named plaintiffs and potential class members in this case. The five named plaintiffs are Rachelle Rand, Esperanza Gottschau, Ramon Soto, Georgianna Lash and Aaron Mees. The opinion divides them into “Search Plaintiffs,” who browsed and searched the site or scheduled an exam, and “Prescription Plaintiffs,” who entered prescription information to buy eyewear. No class has been certified, and the opinion does not state how many people a class would cover.
• Texans who used a health-adjacent website that carried tracking code. The reasoning is not limited to eyewear. The court treated data generated by a user’s interaction with health products and services on a website as individually identifiable health information for pleading purposes.
• Texas businesses, clinics and nonprofit organizations that run tracking tools on their own sites. This is the other side of the same ruling, and it follows a Texas Attorney General consumer alert issued on September 17, 2026 about a surge of website privacy demand letters arriving at Texas organizations.

What This Changes Legally

Three holdings do the work, and a fourth point is just as important for understanding what the case is not.

• Unauthorized disclosure of health information is a concrete injury. The court held that the plaintiffs cleared all three Article III standing requirements, writing: “Plaintiffs have suffered an actionable injury in fact in the unauthorized disclosure of their IIHI to Meta.” It reasoned that the harm is “an invasion of privacy mirroring the harm addressed by” the common law torts of intrusion upon seclusion and public disclosure of private facts, applying TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). It placed the Fifth Circuit alongside the Second, Third, Sixth and D.C. Circuits, each of which has reached a comparable conclusion in a pixel case.
• “Health information” is read broadly at the pleading stage. The court rejected the view that only a prescription itself counts, writing that “IIHI is not so narrow that it applies only to specific prescription information” and that the plaintiffs’ interactions on the site “relate to Plaintiffs’ health, making the data generated from Plaintiffs’ activity on the Site IIHI.”
• A complaint is read whole, not through one screenshot. The district court had relied on a single illustrative figure in the complaint and found it did not show prescription data going to Meta. The Fifth Circuit called that approach a departure from the Rule 12(b)(6) standard: “Under the federal rules, we construe pleadings in their entirety when assessing their sufficiency.” It also noted that the district court drew inferences from the figure in the defendant’s favor rather than the plaintiffs’.
• This is not a HIPAA case, and nobody has won anything. The opinion states plainly in a footnote that “Plaintiffs do not assert a HIPAA claim, nor could they,” citing Acara v. Banks, 470 F.3d 569 (5th Cir. 2006), for the rule that HIPAA creates no private cause of action; the statute’s definition of individually identifiable health information was used only as a reference point. The court also wrote that “a Rule 12(b)(6) motion tests the sufficiency of the pleadings, not the merits of the case,” and left it to the district court on remand to reconsider all of the substantive claims. Discovery, class certification and the merits are all still ahead.

What Kind of Option Might Apply

Nothing on this page is advice about any particular website, visit or claim, and a published appellate opinion does not tell any individual reader whether they have a case. The questions a Texas consumer protection or privacy attorney looks at in a matter like this include:

• What information a specific person actually entered or generated on a specific site, and on what dates.
• Whether the site carried tracking code at that time, what the site’s privacy policy and consent banner said, and whether the user agreed to anything.
• Which statutes a court in this circuit will apply — the federal Wiretap Act and state wiretap and eavesdropping statutes each have their own elements, and the state statutes at issue in Rand were Missouri’s and Illinois’.
• Whether the facts fit an existing putative class action or belong in an individual claim.
• For a Texas business, clinic or nonprofit on the receiving end of a demand letter: what the letter actually alleges, which law it invokes, and what a lawyer recommends before anyone responds or pays.

Many people in this situation find the useful first step is simply having someone who reads these opinions for a living look at the facts of their own situation.

Why Acting Quickly Can Matter

Privacy and wiretap claims run on limitations periods that are measured from dated events, and the dates are often buried in records a person no longer has: browser history, order confirmations, appointment emails. Those records can be the difference between a claim a lawyer can evaluate and one nobody can reconstruct. Class actions add their own calendar — certification rulings, notice periods and opt-out windows all run from court orders, and a person who learns about a case late may find a window has already closed.

That is not a reason to act on a news article. It is a reason to have a lawyer look at the dates and the records in one specific situation while the options that depend on them are still open.

Sources

1. United States Court of Appeals for the Fifth Circuit, Rand v. Eyemart Express, L.L.C., No. 25-10784, published opinion filed October 23, 2026 (primary document).
2. 42 U.S.C. § 1320d(6) (definition of individually identifiable health information).
3. 18 U.S.C. § 2511 (Federal Wiretap Act, interception and disclosure of electronic communications).
4. “Eyemart Consumers Revive Lawsuit Over Web Data Sharing With Meta”, Bloomberg Law, October 23, 2026.
5. “5th Circ. Revives Facebook Users’ Eyemart Wiretap Suit”, Law360, October 23, 2026.
6. CourtListener docket for Rand v. Eyemart Express LLC, N.D. Tex. No. 3:24-cv-00621 (filings and dates).
7. Office of the Texas Attorney General, consumer alert of September 17, 2026 on website privacy demand letters, as covered on this site.