CIPA Cases

GoodRx is the case that broadens the story beyond hospitals — and it is really two separate matters that are easy to confuse. One is a landmark $1.5 million FTC enforcement action, the first ever under the Health Breach Notification Rule, and it is final. The other is a private class action with a much larger headline number that a federal court has repeatedly declined to approve. Keeping them apart is the whole point.

Advocate Aurora Health paid $12.25 million to settle a consolidated class action covering roughly 2.5 million patients — one of the largest exposed populations in the healthcare pixel wave. And it began in an unusual way: not with a plaintiff’s discovery, but with the health system reporting the problem on itself to federal regulators.

Before “pixel litigation” was a category anyone tracked, Mass General Brigham paid $18.4 million to settle a class action over cookies and tracking pixels on its public informational websites. Finalised in early 2022, it was one of the first eight-figure healthcare tracking settlements — the case that showed the plaintiffs’ bar this theory could command serious money.

Inova Health agreed to a $3.15 million settlement over Meta and Google pixels on its public-facing websites — but the reason this case matters isn’t the number. It’s the law. The surviving claim was brought under the federal Electronic Communications Privacy Act (ECPA), and it cleared a motion to dismiss on a theory that reaches straight into HIPAA.

Penn Medicine agreed to a settlement of up to $9.5 million over Meta and Google tracking pixels on its myPennMedicine patient portal — and the claim wasn’t brought under California’s CIPA. It was brought under Pennsylvania’s own wiretap statute. This case is the clearest proof yet that pixel-as-wiretap theory is not a California problem.

BetterHelp is the case that put the most sensitive data of all — mental-health therapy information — at the centre of a federal enforcement action. The online-counseling firm paid $7.8 million to settle FTC charges that it shared what users disclosed while seeking therapy with Facebook, Snapchat, and other advertisers, after promising to keep it private.

A New York federal judge refused to dismiss a CIPA pen-register class action over the adtech trackers on CNN.com — and it was the second time the same judge told CNN the case could proceed. Where Rounds v. DDI shows how these claims die, D’Antonio shows how they survive.

A California federal judge refused to dismiss a CIPA pen-register class action over the TikTok and Microsoft Bing pixels on adidas.com — and delivered the lesson most sites still haven’t learned: privacy-policy links buried in your footer are not consent. This is the case that makes a real cookie banner non-negotiable.

The Ninth Circuit revived a CIPA wiretapping class action over the session-replay code on bloomingdales.com — rejecting the “record data” defense that had killed the case below — and five months later, Bloomingdale’s settled. It is the clearest arc in the whole tracker: survive dismissal, and you pay.

Meta lost the argument that it doesn’t “use” its own Pixel — then won the case anyway, on procedure. In March 2026 a federal court denied class certification after plaintiffs broadened their class definition and ran into CIPA’s one-year statute of limitations. It’s the most instructive defense win of the year, and the most dangerous one to misread.

Sutter Health paid $21.5 million over Google Analytics and the Meta Pixel running on a patient-portal login page. Nothing was tracked inside the portal. No usernames or passwords were shared. One page, before anyone logged in — and it produced one of the largest website-tracking settlements in US healthcare.

The difference between session cookies vs persistent cookies comes down to one thing: how long they live. But that single distinction decides whether a cookie needs consent, how it’s regulated, and whether it puts your website at legal risk. This guide explains both types clearly — plus how sessions differ from cookies, how to view them in Chrome, and the tools that scan and audit them.