Williams v. Duke Health: a Meta Pixel case that ran all the way to judgment and payout

Most of the pixel cases we track are still open — claims pending, approval hearings months away. Williams v. Duke University Health System is different: it's finished. Duke agreed to pay $3,743,600 over tracking technology, including the Meta Pixel, embedded on its website, its Duke MyChart patient portal, and its mobile app — and the case has since cleared final approval, had judgment entered, and paid class members out.

That makes it unusually valuable as a reference point. You can see the whole arc: the complaint, the federal wiretap theory, a settlement, final approval, and money actually reaching patients. It's also a textbook example of the exposure that comes with the single riskiest surface in healthcare — the authenticated patient portal, where tracking touches the most sensitive data a provider holds.

What the case is about

Duke University Health System runs the full digital stack a modern health system does: a public marketing website, the Duke MyChart patient portal where people manage appointments, messages, and records, and the MyDuke Health mobile app. The lawsuit, brought by lead plaintiff Afrika Williams, alleged that tracking technologies — including the Meta Pixel — were embedded across those properties and transmitted patients' personal and health-related information to Meta when they used Duke's online services.

The core allegation is the one at the heart of every healthcare pixel case: that a tracker fired on sensitive pages and sent identifying, health-related activity to a third-party advertising platform without patients' consent. What distinguishes Duke is where the tracking allegedly reached — not just the public site, but the authenticated portal and app, behind the login.

Duke denied wrongdoing throughout, and the settlement it ultimately reached contains no admission that any law was broken. But unlike most of the cases in this space, Duke's didn't stop at a proposed deal: it went through final approval on August 27, 2026, the court entered judgment, and payments to class members were issued on October 29, 2026. The case is closed.

The statute: the federal Wiretap Act (ECPA)

This is a North Carolina federal case, not a California one — so it doesn't turn on CIPA. The lead claim is the federal Electronic Communications Privacy Act, which contains the Wiretap Act at 18 U.S.C. §2510 and following, pleaded alongside common-law theories: invasion of privacy, breach of contract, negligent misrepresentation, and negligence.

The Wiretap Act prohibits intentionally intercepting the contents of an electronic communication. In the pixel context, the theory is that when tracking code captures what a patient does on a health page and routes it to a third party in real time, that transmission is an interception. The statute's party exception — a party can't wiretap its own communication — is the usual fight, and it often turns on whether the third-party recipient (here, Meta) was a legitimate party or an eavesdropper, and whether consent applies.

The breach-of-contract and negligence claims are worth noting because they add a dimension CIPA cases often lack. A patient portal typically comes with privacy promises — notices, terms, HIPAA-adjacent assurances. When tracking allegedly contradicts those promises, plaintiffs can frame it not just as interception but as a broken commitment, which resonates with a jury and broadens the theories a defendant must defeat.

How the $3.74 million worked

The $3,743,600 fund was distributed pro rata: patients who filed a valid, timely claim shared the net fund after attorneys' fees, costs, and administration.

Because the case is closed, the structure is more than a projection — it actually played out. Class members who filed by August 16, 2026 received their pro-rata share when payments went out on October 29, 2026. For once, the "per-person figure" question has a real-world answer baked into the claim rate rather than a hypothetical: the fund was finite, the class was the set of identified portal and app users, and the net divided among those who claimed.

Who was covered

The class was defined tightly around identified users of Duke's authenticated services: U.S. residents whom Duke Health identified as having logged into the Duke MyChart portal or the MyDuke Health app at least once during the class period of February 18, 2019 through June 17, 2022. Because the class was drawn from Duke's own records of portal logins, eligibility wasn't a guessing game — the health system could identify the class directly, which is part of why notice and payout were able to run cleanly to completion.

The operative deadlines (now passed): opt-out and objection by July 20, 2026; claims by August 16, 2026; final approval hearing August 27, 2026 in Greensboro, NC. Class members who did nothing were bound by the release. The claims window is closed, so this section is a record of how the case ran, not a call to file.

What this closed case teaches

1. Portals and apps are the exposure, not just the website. Duke's class was built from portal and app logins. Behind-the-login tracking is where health data is most sensitive and the defense is weakest.
2. ECPA reaches outside California. A North Carolina federal wiretap claim produced a $3.74M settlement. You don't need a CIPA state for a pixel case to have teeth.
3. Contract and negligence claims compound the risk. Portal privacy promises let plaintiffs add breach-of-contract and negligence theories on top of wiretap — more fronts for a defendant to defend.
4. The Meta Pixel is still the recurring culprit. Years after the risk became known, the specific tag at the center of this case is the one most providers installed by default. Legacy deployments are the live exposure.
5. These cases do reach judgment and payout. Duke's ran the full course — final approval, judgment, money to patients. The settlements aren't theoretical; they conclude, and they cost.

What to do if you run a patient portal or health app

1. Treat the portal and app as the top priority. Inventory every third-party tag, pixel, and SDK on your authenticated surfaces first — that's where the Duke exposure lived.
2. Keep advertising tags off authenticated pages entirely. Behind-the-login areas should carry no third-party advertising or analytics trackers. This is the single most important control for portal and app risk.
3. Map what every tag transmits. For each tracker, document the data it sends and the recipient. A pixel firing on a portal page and sending identifiers to an ad platform is the exact Duke fact pattern.
4. Align your privacy promises with reality. If your portal's notices and terms promise confidentiality, make sure your tracking actually honors them — the gap is what fuels breach-of-contract claims.
5. Gate non-essential tags on the public site behind consent. Even outside the portal, advertising and analytics trackers should not fire until a visitor gives valid, informed consent.
6. Re-audit on a schedule. A new campaign or vendor update can drop a tag onto a sensitive surface. Periodic scanning catches it before it becomes a class period.

Key takeaways

Frequently asked questions

The bottom line

Williams v. Duke Health is the rare pixel case you can study end to end: a complaint under the federal Wiretap Act, tracking that reached the Duke MyChart patient portal and app, a confirmed Meta Pixel, a $3.74 million settlement, and — unlike most of its peers — final approval, judgment, and actual payments to patients. It's the full lifecycle of a healthcare tracking case, and it ended with money out the door.

The lesson it leaves is pointed. The exposure concentrated exactly where it always does: the authenticated surface, behind the login, where health data is most sensitive and advertising tags have no business firing. Keep those surfaces clean, inventory what every tag sends, gate the non-essential ones behind consent — and the interception fact pattern that carried Duke all the way to judgment isn't there to plead against you.

Sources