Health Law Daily Wrap Up, HEALTH INFORMATION TECHNOLOGY—N.D. Ill.: Blue Cross Blue Shield website’s pixel use may violate California privacy law, (Aug 13, 2026)

By Leah S. Poniatowski, J.D.

Transmission of browsing data to third-party tech and social media companies was without consent, but conduct did not violate federal or Illinois privacy laws.

A group of federal employees enrolled in Blue Cross Blue Shield Association health care plans sufficiently alleged that they did not consent to having their search information transmitted to third parties when using the insurer’s website under various wiretapping laws and adequately pleaded that the insurer’s use of pixels to transmit data may have violated the California Invasion of Privacy Act. However, there was not enough to sustain claims under the federal Electronic Communications and Privacy Act, the Illinois Eavesdropping Statute, the Illinois Computer Tampering Act, or privacy-related common law claims, a federal district court in Illinois ruled (Gouch v. Blue Cross Blue Shield Association, No. 23 C 15709 (N.D. Ill. Aug. 7, 2026)).

Background. Enrollees of the Blue Cross Blue Shield Association (BCBSA) federal employee health care plan are eligible to access plan coverage, treatment options, and physician specialties on the public website fepblue.org. The enrollees asserted that this website operated as others do by duplicating the HTTP requests sent to BCBSA’s web server and sending that information to third parties, allowing the third party to see the user’s full browsing activity. The code that duplicates the information is known as a “pixel.”

The enrollees specifically contend that BCBSA’s website’s source code used pixels to send their browsing history to social media and tech companies including TikTok, Meta, Google, and LinkedIn through which unique identifiers could be used to create targeted advertising on the enrollees’ individual social media account platforms. Accordingly, the enrollees filed a lawsuit against BCBSA, alleging violations of Electronic Communications and Privacy Act (ECPA), the Illinois Eavesdropping Statute (IES), the Illinois Computer Tampering Act (ICTA), and the California Invasion of Privacy Act (CIPA). The enrollees also asserted common law violations of negligence, invasion of privacy by publication of private fact, and breach of implied contract. BCBSA filed the present motion to dismiss for failure to state valid claims under the applicable law.

Wiretapping statutes. As an initial matter, the court analyzed the enrollees’ claims under the applicable wiretapping statutes, noting that among the California, Illinois, and federal laws, each provided an exception to liability for parties to the recorded communication, and that there is a defense to liability under each if a party consents to the recording.

In the matter at bar, the court determined that the BCBSA was a party to the communications as issue, while the third-party tech companies were not. Under the basic principle of a conversation having a speaker and a listener, the tech companies could not be considered parties to the communications the enrollees sent to the BCBSA website because there was no affirmative transmission by the enrollee to send the information to those companies.

Consent. Critical to the enrollees’ wiretapping theories, they established that they did not consent to the recording within the meaning of statutory term. Specifically, the court agreed that the website’s cookie banner did not provide sufficient notice that the enrollees’ data would be shared with third parties. The existence of the hyperlink to BCBSA’s privacy policy on the banner was not sufficient, nor was the policy itself adequate to notify the user that BCBSA “may use pixel tags . . . on fepblue.org to track the actions of users on the Website” to disclose their information to social media and similar tech companies for advertising purposes. Because there was no specific disclosure about the third-party data sharing, the court agreed with the enrollees that they did not consent to the recording and transmission of their data.

California law. The enrollees sought to recover under the CIPA, which protects individuals from the “interception of wire communications and disclosure of the contents of such intercepted communications” without their consent. Although the CIPA does not hold parties to the communication liable, it does provide for derivate liability against anyone “who aids, agrees with, employs, or conspires with any person or persons to unlawfully do [] any of the acts or things mentioned [] in this section.” Under the facts at this stage in the litigation, the court found that BCBSA was a party, the enrollees did not consent to the recording, and the tech companies were not parties to the communications. In the absence of any arguments to overcome BCBSA’s liability under this statute, the enrollee’s allegations met the pleading requirements.

Illinois laws. However, the enrollees did not meet the requirements for either the IES or the ICTA. The court explained that the IES was functionally similar to the CIPA, but IES requires that a recording be done “in a surreptitious manner.” The court was not persuaded that the tech companies’ conduct met this definition. The enrollees’ argument that the tracking code “secretly operat[ed] in the background, invisible to visitors to the website” was not distinguishable from how computer code generally operates—in the “background” and “invisible.” There were no facts to suggest that the enrollees had been tricked or otherwise deceived into having their information recorded. In the absence of any additional law on the issue, the court held that there was no valid claim under the IES.

Similarly, the court disagreed that there was any tampering with the enrollees’ computers that would “(A) damage or destroy that computer . . . (B) alter, delete, or remove a computer program or data from that computer . . . or (C) cause loss to the users of that computer or the users of a computer which accesses or which is accessed by such program” as provided by the ICTA.

Specifically, the court concluded that BCBSA did not insert any program “into a computer.” There was no evidence that the pixels embedded in BCBSA website’s source code met the statute’s definition of being “inserted into a computer.” Additionally, there was nothing to support the assertion that there was any alteration, deletion, removal, or loss as provided by the statute. In the absence of any legal authority construing the disclosure of private information as “loss,” the enrollees did not meet their pleading burden under this statute.

Federal law. Under the ECPA, BCBSA cannot be liable because it was not a direct violator of the statute, the court explained. Additionally, the crime-tort exception for violating the Health Insurance Portability and Accountability Act (HIPAA) did not save the claim because the search data was not sufficiently specific to be “information that unequivocally provides a window into an individual’s personal medical history” like “personally identifiable patient records.”

Common law. The court held that none of the common law privacy violation claims were adequately pleaded because they depended on disclosure of individually identifiable health information, which had been refuted. The court also discarded the “benefit of the bargain” damages claim, explaining that the filed rate doctrine applied to bar these claims. Therefore, BCBSA’s motion to dismiss was denied vis-a-vis the putative California class of enrollees, and the motion was granted without prejudice to the remaining putative representatives.

The case is No. 23 C 15709.

Judge: Tharp, Jr., J.

Attorneys: Brian C. Gudmundson (Zimmerman Reed PLLP) for Teresa Gouch. Justin O'Neill Kay (Faegre Drinker Biddle & Reath LLP) for Blue Cross Blue Shield Association.

Companies: Blue Cross Blue Shield Association

MainStory: TopStory CaseDecisions EHRNews GCNNews GeneralNews HITNews IllinoisNews