Cybersecurity Policy Report, N.D. Tex.: Eyemart consumers unable to allege Meta obtained personal information, (Jun 3, 2025)

By Jody Coultas, J.D.

Meta Pixel technology used by Eyemart on its website did not run afoul of the Federal Electronic Communications Privacy Act.

The federal district court in Dallas, Texas dismissed privacy and intrusion claim against eyewear retailer Eyemart Express, LLC. Meta users accessed the Eyemart website to search for prescription eyewear products and to search for eye doctors in their areas. The consumers alleged that Eyemart illegally shared their private health information with Meta. The court held that the consumers failed to plead facts that plausibly establish that they shared any private health information with Eyemart that could be shared with Meta (Rand v. Eyemart, No. 3:24-cv-00621-N (N.D. Tex. May. 27, 2025)).

Eyemart operates a retail website and a chain of physical stores where customers may browse for eyewear, both prescription and non-prescription. Customers may purchase eyewear directly from the site or in store. Eyemart’s website utilizes Meta Pixel technology, which tracks predetermined user interaction “events” on a website, such as when a user clicks a designated button, adds an item to a digital cart, or searches for a location. All five of the consumers had Facebook accounts and had previously consented to Meta storing a user identification cookie on their devices.

The consumers alleged that Eyemart shared the consumers’ private health information (“PHI”) with Meta in violation of the Federal Electronic Communications Privacy Act, the Missouri Wiretap Act, and the Illinois Eavesdropping Statute. The court previously granted Eyemart’s first motion to dismiss, finding that the original three users failed to plead facts that plausibly establish that they shared any private health information with Eyemart that could be shared with Meta.

Amended pleadings. Because the only named plaintiffs in the original complaint failed to add any material factual allegations to show they shared PHI with Meta, the court dismissed the claims. In their amended complaint, the consumers added only their subjective intent for visiting the Eyemart website. Subjective intent for visiting the website, whether to purchase prescription eyewear or nonprescription sunglasses, did not constitute sharing of PHI. The alleged disclosure of the location of the Eyemart store most convenient for the consumers to visit did not constitute any shared PHI. The consumers agreed to share their locations with Meta through their Facebook accounts, so identifying the storefront near her where the consumers could visit the same retailer in person gave no new information to Meta. Nor did the identification of a storefront near the consumers share any information with Meta. Because the consumers failed to add any material factual allegations that would lead to a different outcome, the court found they failed to plead facts to support the claims.

New plaintiffs. The amended complaint included two named plaintiffs. Both consumers alleged that they purchased prescription eyewear from the Eyemart website and shared their prescription information with Eyemart. These consumers plausibly established that they shared PHI with Eyemart.

However, the consumers failed to sufficiently allege that any PHI was disclosed to Meta through the Pixel. Because Eyemarts’ frames are available for prescription lenses, sunglass lenses, or fashion lenses, information about the frames or the styles customers browse did not convincingly share any PHI. Users only input prescription information on the ordering screen. Also, the consumers did not allege that any PHI was disclosed when the AddToCart event was triggered or that the AddToCart event was triggered differently if prescription or non-prescription lenses are added to the frames. The figures showing the metadata and identifying specifically what information is sent to Meta belied any conclusory statements that the prescription information is included, because it wa notably absent from the data seen to be tracked there.

The Federal Electronic Privacy Act. Eyemart cannot eavesdrop on communications directed at it “unless such communication is intercepted for the purpose of committing any criminal or tortious act.” The consumers alleged that the crime-tort exception applied because to the extent that any communication contained PHI, the interception was a violation of HIPAA. The consumers failed to plead facts to plausibly establish that any PHI was shared with Meta. Therefore, because no facts support a violation of HIPAA, the crime-tort exception did not apply. Because the ECPA is a one-party consent statute and Eyemart consented to the tracking on its site, the consumers failed to state a claim under the ECPA.

Missouri Wiretap Act. The Missouri wiretap statute is modeled off the ECPA and is similarly a one-party consent statute with a crime-tort exception. The only Missouri plaintiff failed to state a claim under this statute for the same reasons plaintiffs have failed to state a claim under the ECPA.

Illinois Eavesdropping Act. The Illinois Eavesdropping Act (IEA) requires that the interception be “in a surreptitious manner” and without “the consent of all other parties to the private conversation.” The consumer alleged that he “reasonably expected” his PHI “to be private under HIPAA” and therefore his actions on the site related to his PHI were “private conversations” under the statute. Because the Illinois consumers did not plausibly plead facts to show he shared any PHI with Eyemart, he has failed to establish that he had any private conversation that could have been intercepted.

Remaining claims. The breach of contract claims and intrusion upon seclusion claims alleged any disclosure of PHI was contrary to Eyemart’s Terms of Use and the implied contract not to disclose PHI without consent. Because the consumers failed to plausibly show that any PHI was shared with Meta, the claims failed.

The case is No. 3:24-cv-00621-N.

Judge: Godbey, D.

Cases: CaseDecisions FederalLegislation EHRNews HITNews HealthReformNews CyberPrivacyFeed DataPrivacy TexasNews DataSecurity