The Deaconess Health System has settled a proposed class action in Illinois that accused one of its hospitals of sharing patient data with Meta and Google without consent, in violation of the Electronic Communications Privacy Act.
The settlement was announced on October 23, 2026, when the two plaintiffs and Deaconess filed a joint stipulation in the Southern District of Illinois, saying that the settlement was final and that the plaintiffs’ individual claims were dismissed with prejudice.
The terms of the settlement are not public and neither is the way the data of the two plaintiffs was shared with the tech giants, or what changes the hospital may have agreed to make going forward.
The hospital website in question is that of Deaconess Illinois Union County Hospital, a 25-bed facility in Anna, Illinois, whose patients can use it to get test results, book appointments, pay bills, and research providers.
The court heard that the site had “code-based tracking devices known as ‘trackers’ or ‘tracking technologies,’” installed on it, and that these sent data to Meta, Google, DoubleClick Ads, and Microsoft.
The complaint alleged that “by installing the Meta Pixel on its Website, Defendant effectively planted a bug on Plaintiff’s and Class Members’ web browsers.”
The trackers named in the complaint are Meta Pixel, Google Analytics, Google Tag Manager, DoubleClick Ads, and Microsoft’s Azure Monitor Application Insights, “which operate similarly to the Meta Pixel.”
The court summarized the claim as the trackers reporting “discrete online activity events, including those in which visitors searched for treatments and providers to address their health concerns.”
One example of this was when a visitor clicked on “VIEW MORE” on a page featuring a doctor, and a SubscribedButtonClick event was sent to Meta. Another example was when a patient logged into the patient portal, and the hospital “transmitted PageView and Microdata events informing Facebook about the patient’s action.”
The complaint said that each event sent to Meta contained the “c_user” cookie, “which Facebook uses to identify users.”
The plaintiff, who had been a Facebook user since 2007, said that she “began receiving medical advertisements in her Facebook feed regarding the medical conditions and symptoms she searched for and viewed.”
The reason, according to the complaint, is that Meta uses Pixel data “to build data profiles for the purpose of creating targeted online advertisements and enhanced marketing services, which it sells to additional third parties for profit.”
The filing was not the only one of its kind against Deaconess Health System, as another, almost identical, was lodged, this time over the Deaconess Red Bud hospital.
In that case, the plaintiff, Juenger, claimed that the hospital’s online tools “collected and transmitted patients’ Private Information to Facebook and Google, possibly other third parties, without patients’ knowledge or authorization.”
In September 2025, Chief Judge Nancy J. Rosenstengel granted in part Deaconess’ motion to dismiss.
The negligence, negligence per se, and the Wiretap Act interception claim survived.
Regarding the latter, Rosenstengel wrote that the disclosure of the data “plausibly violated HIPAA” and that “the disclosure, not the interception itself, is the secondary act that supports the crime-tort exception.”
The judge was not convinced by the hospital’s argument that it was not liable because it was making money off the data, citing an earlier case that said, “Many crimes and torts are motivated by a desire to make money, and it defies common sense that a clearly harmful act could escape liability as long as it was done for profit.”
However, the court also noted that the searches done on the hospital’s site “are far from a sure thing” as health information, since people often research symptoms for others.
As for the claim that the hospital violated the Illinois Eavesdropping Statute, the judge said that “Deaconess, however, was a party to these communications.”
In December 2025, the court set a class certification hearing for June 10, 2027, in the consolidated case, but the settlement means that this will not produce any decision regarding the two plaintiffs.
Reclaim The Net has previously reported about the use of Meta’s Pixel on hospital websites, and the fact that this was happening in a number of US hospitals. In 2022, a federal suit was filed in San Francisco against Meta, alleging that the company was receiving sensitive medical information from hospital websites, through its tracking tool.
At the time, it was reported that The Markup found Meta Pixel on 33 of the top 100 hospitals in the US, as ranked by Newsweek. The lawsuit said that at least 664 healthcare systems and providers had installed the tracker on their sites.
Meta responded by saying that it had a filter “designed to prevent that data from being ingested into our ads ranking and optimization systems.”
In 2023, a patient sued another hospital, Overlake Hospital Medical Center near Seattle, for using Meta Pixel and Conversions API. The hospital told Reclaim The Net at the time that it takes “our responsibility to protect patient information very seriously.”
A hospital website is a place where people often look up health conditions and doctors they would rather not reveal to anyone, including family and friends. The fact that this data is being turned into marketing data, tied to a Facebook account, and that this is done by the very institution people trust with their health, is something that the public deserves to know about. But private settlements like this one, that reveal nothing, are clearly not the way to shed light on this practice.
