Rand v. Eyemart Express

Case: 25-10784 Document: 72-1 Page: 1 Date Filed: 10/23/2026 United States Court of Appeals for the Fifth Circuit United States Court of Appeals Fifth Circuit ____________ FILED October 23, 2026 No. 25-10784 Thomas B. Plunkett, III ____________ Clerk Rachelle Rand; Esperanza Gottschau; Ramon Soto; Georgianna Lash; Aaron Mees, Plaintiffs—Appellants, versus Eyemart Express, L.L.C., Defendant—Appellee. ______________________________ Appeal from the United States District Court for the Northern District of Texas USDC No. 3:24-CV-621 ______________________________ Before Haynes, Higginson, and Ho, Circuit Judges. Stephen A. Higginson, Circuit Judge: This is an appeal from the dismissal of a putative class action concerning the alleged unauthorized disclosure of Plaintiffs’ private health information from Defendant Eyemart Express, LLC (“Eyemart”) to third party Meta Platforms, Inc. (“Meta”). For the reasons discussed below, we REVERSE and REMAND for further proceedings consistent with this opinion.  Case: 25-10784 Document: 72-1 Page: 2 Date Filed: 10/23/2026 No. 25-10784 I. Eyemart seeks to provide customers with “all the eye and vision care services” they need “in one place.” Eyemart owns and operates a chain of physical stores as well as a website (“the Site”) on which users can browse products, purchase prescription eyewear, and schedule eye exams. On its Site, Eyemart utilizes an Internet tracking tool from Meta (Facebook’s parent company) called “the Pixel,” which tracks and shares information across websites using that software.1 Meta developed the Pixel to improve targeted advertising by collecting data on Meta users from third-party websites, such as Eyemart’s Site. Through agreements with Meta, websites add the Pixel to their pages and can control what information the Pixel collects and whether any data is encrypted. With this browsing information, Meta creates profiles, which it then uses to send targeted advertisements to users. In return, websites like Eyemart gain more insights into their own advertising efforts and can improve their targeted advertising by purchasing ads through Meta. This arrangement incentivizes both Meta and sites like Eyemart to collect as much information as possible. As relevant here, the Pixel tracks users’ searches, clicks, product viewing information, and appointment scheduling information from the Site, giving that data to Meta. Eyemart does not receive users’ consent to track their information, nor does it notify users about the Pixel’s tracking on the Site. _____________________ 1 The facts in this opinion, including the descriptions of the Pixel and related technology, derive from Plaintiffs’ complaint. At this stage, we accept all factual allegations as true and construe the complaint in the light most favorable to Plaintiffs. See Heinze v. Tesco Corp., 971 F.3d 475, 479 (5th Cir. 2020). 2  Case: 25-10784 Document: 72-1 Page: 3 Date Filed: 10/23/2026 No. 25-10784 Plaintiffs are five Facebook users who used the Site. They brought suit under the Federal Wiretap Act, the Missouri Wiretap Act, and the Illinois Eavesdropping Act, in addition to an intrusion upon seclusion tort claim and breach of contract claims. They contend that the information the Pixel tracked from the Site—related to viewing and purchasing prescription eyeglasses and scheduling eye exams—is private health information that Eyemart should not have permitted Meta to access without Plaintiffs’ knowledge or consent. More specifically, Plaintiffs allege that this information meets the definition of individually identifiable health information (“IIHI”) protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and is therefore the type of private information entitled to protection from unauthorized disclosure. 2 HIPAA defines IIHI as “any information, including demographic information collected from an individual,” that “is created or received by a health care provider, health plan, employer, or health care clearinghouse” and “relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual” and “identifies the individual” or “with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” 42 U.S.C. § 1320d(6) (emphasis added). _____________________ 2 To be clear, Plaintiffs do not assert a HIPAA claim, nor could they. See Acara v. Banks, 470 F.3d 569, 570–71 (5th Cir. 2006) (“We hold there is no private cause of action under HIPAA . . . .”). HIPAA is relevant to Plaintiffs’ claims at this stage because IIHI is a useful definition of private health information, which is central to Plaintiffs’ claims. Plaintiffs also allege that Eyemart holds itself out as a HIPAA-covered entity, and rely on HIPAA in their Wiretap Act claim, In remanding for the district court to reconsider all of Plaintiffs’ substantive claims, we do not address those arguments here. 3 Case: 25-10784 Document: 72-1 Page: 4 Date Filed: 10/23/2026 No. 25-10784 Plaintiffs divide themselves into two categories: the “Search Plaintiffs” and the “Prescription Plaintiffs.” The Search Plaintiffs allege that they used the Site to browse and search for prescription glasses, which triggered the Pixel to track their activity on the Site and share it with Meta. One Search Plaintiff also alleges that when she used the Site to schedule an eye exam, the Pixel sent the name and location of the Eyemart store she visited to Meta. The Prescription Plaintiffs allege that they purchased prescription eyewear from Eyemart, which required them to enter their prescription information into the Site, and in turn led to their prescriptions and other health information being shared with Meta through the Pixel. Both sets of Plaintiffs had already shared other personal information with Meta through their Facebook accounts—including their names and photos, and other information varying by Plaintiff, such as gender, location, and relationship status—before using the Site. With this information, Meta could combine Plaintiffs’ personal details with their data from Eyemart’s Site to identify them and then send them targeted ads. The district court considered two motions to dismiss in this case. In the first motion to dismiss, Eyemart asserted that Plaintiffs lacked standing and failed to state a claim. The district court determined that Plaintiffs had standing but had failed to state a claim and afforded Plaintiffs an opportunity to amend their complaint. Plaintiffs then filed the operative complaint (“the Amended Complaint”). Eyemart again moved to dismiss for failure to state a claim but did not renew its standing arguments. The district court granted the second motion to dismiss in full and dismissed the case with prejudice. The district court found that the Search Plaintiffs failed to state a claim for relief because they did not adequately 4  Case: 25-10784 Document: 72-1 Page: 5 Date Filed: 10/23/2026 No. 25-10784 allege that they shared any IIHI with Eyemart.3 As to the Prescription Plaintiffs, the district court acknowledged that they shared IIHI with Eyemart by entering their prescription information but found that they had failed to show that any IIHI was disclosed to Meta. Without sufficient allegations that any Plaintiff’s IIHI was shared with Meta, the district court concluded that each of Plaintiffs’ claims necessarily failed. On appeal, Plaintiffs argue that they adequately alleged both that they shared their IIHI with Eyemart and that the Pixel on Eyemart’s Site conveyed that IIHI to Meta without their knowledge or consent. Plaintiffs ask us to reverse, reinstate all of their claims, and remand. Eyemart opposes, asserting that the district court correctly determined that Plaintiffs failed to plausibly allege any sharing of their IIHI with Meta. In the alternative, Eyemart renews its standing argument from its first motion to dismiss and asks us to reverse and remand with instructions to dismiss for lack of standing. II. We review a district court’s grant of a motion to dismiss de novo, whether for lack of standing under Rule 12(b)(1) or for failure to state a claim under Rule 12(b)(6). Jack v. Evonik Corp., 79 F.4th 547, 561 (5th Cir. 2023); Lane v. Halliburton, 529 F.3d 548, 557 (5th Cir. 2008). _____________________ 3 The district court used the acronym “PHI” (rather than IIHI) to refer to private health information, and the parties sometimes use that acronym to represent “personal health information,” or “protected health information” as well. Because the parties and the district court accept HIPAA’s definition of IIHI as representing PHI in this case— regardless of whether it references private, personal, or protected health information—we use IIHI throughout this opinion for clarity. 5 Case: 25-10784 Document: 72-1 Page: 6 Date Filed: 10/23/2026 No. 25-10784 In reviewing a motion to dismiss under Rule 12(b)(1), we may consider “(1) the complaint alone; (2) the complaint supplemented by undisputed facts evidenced in the record; or (3) the complaint supplemented by undisputed facts plus the court’s resolution of disputed facts.” In re S. Recycling, L.L.C., 982 F.3d 374, 379 (5th Cir. 2020) (quoting Barrera- Montenegro v. United States, 74 F.3d 657, 659 (5th Cir. 1996)). “To survive a motion to dismiss [under Rule 12(b)(6)], the plaintiff’s complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Jack, 79 F.4th at 561 (internal quotation marks omitted) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). At this stage, we accept all factual allegations as true and make all reasonable inferences in the light most favorable to the plaintiffs. Id. We do not accept legal conclusions and conclusory allegations as true. Id. III. Because it is jurisdictional, we begin by addressing Plaintiffs’ standing to bring this case. Article III standing has three well-known requirements: plaintiffs must “show (i) that [they] suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816, 821 (5th Cir. 2022) (quoting TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021)). Plaintiffs here clear all three bars. We begin with injury, which is the only element Eyemart challenges. The district court easily disposed of the injury argument Eyemart levied in its first motion to dismiss, reasoning that disclosure of IIHI without an individual’s permission is a cognizable harm. It further determined that such 6 Case: 25-10784 Document: 72-1 Page: 7 Date Filed: 10/23/2026 No. 25-10784 injury was concrete and particularized because disclosure of Plaintiffs’ health information affected each Plaintiff’s privacy. We agree. Plaintiffs have suffered an actionable injury in fact in the unauthorized disclosure of their IIHI to Meta. Although this injury is intangible, it is cognizable. As the Supreme Court explained in TransUnion LLC v. Ramirez, “[c]hief among” the intangible harms that are sufficiently concrete for standing purposes “are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” 594 U.S. at 425 (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 340–41 (2016)). “Those include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. Our court has since expanded on what this means for a plaintiff to successfully plead an injury in fact: “[A] plaintiff doesn’t need to demonstrate that the level of harm he has suffered would be actionable under a similar, common-law cause of action. But he does need to show that the type of harm he’s suffered is similar in kind to a type of harm that the common law has recognized as actionable.” Perez, 45 F.4th at 822 (emphasis added); see also Cranor v. 5 Star Nutrition, L.L.C., 998 F.3d 686, 690–91 (5th Cir. 2021) (“[O]ur inquiry is focused on types of harms protected at common law . . . .” (citation omitted)); Cochenour v. 360Training.com, Inc., No. 1:25- CV-7, 2025 WL 3251719, at *3–4 (W.D. Tex. Nov. 3, 2025) (applying Perez and Cranor to a Pixel tracking case). Post-TransUnion, our sister circuits have consistently held that unauthorized disclosure of individuals’ private browsing activity, along with identifiable personal information, constitutes an injury in fact. For example, in Salazar v. Paramount Global, 133 F.4th 642, 647 (6th Cir. 2025), the Sixth Circuit held that disclosure of an individual’s private video-viewing history—via the defendant’s use of the Pixel—bore a close relationship to 7 Case: 25-10784 Document: 72-1 Page: 8 Date Filed: 10/23/2026 No. 25-10784 the traditional common law torts of public disclosure of private information and intrusion upon seclusion. In Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219, 1227–31 (D.C. Cir. 2025), another Pixel case, the D.C. Circuit concluded the same, holding that “having one’s private viewing history provided without consent to a third party is a concrete injury” that is “closely analogous to the harm of intrusion upon seclusion” and “the longstanding tort of publicity given to private life.” In Salazar v. National Basketball Ass’n, 118 F.4th 533, 544 (2d Cir. 2024), the Second Circuit held that unauthorized disclosure of “personal viewing information,” via the Pixel, was sufficiently analogous to “the harm flowing from the public disclosure of private facts common-law analog.” And most recently, in In re BPS Direct, LLC; Cabela’s LLC Wiretapping Litigation, 175 F.4th 423, 433– 34 (3d Cir. 2026), the Third Circuit determined that plaintiffs who had made purchases from an online retailer—resulting in disclosure of online shoppers’ banking information to third parties through tracking code—suffered an injury analogous to intrusion upon seclusion. Examining these cases, we have no difficulty concluding that the unauthorized tracking of Plaintiffs’ private health information and disclosure of that information to Meta is an invasion of privacy mirroring the harm addressed by these common law torts. The circuit authorities just addressed concern plaintiffs’ online media consumption and shopping habits. Here, Plaintiffs allege unauthorized disclosure of their private health information, which is inherently sensitive and personal. Sharing this information without Plaintiffs’ permission parallels the harms underlying both intrusion upon seclusion and public disclosure of private facts. Eyemart argues that Plaintiffs cannot rest on intrusion upon seclusion as a valid analog because “no Plaintiff sufficiently alleged an intrusion upon seclusion.” That contention misunderstands Perez. At this stage, we compare the harm that intrusion upon seclusion claims address and the harm 8 Case: 25-10784 Document: 72-1 Page: 9 Date Filed: 10/23/2026 No. 25-10784 Plaintiffs have suffered, not whether Plaintiffs have adequately alleged each element of the tort. See Perez, 45 F.4th at 822; Paramount Glob., 133 F.4th at 648 n.6 (“[F]inding ‘a close historical or common-law analogue’ for the modern injury or harm does not require an exact match for each element of the common-law tort.” (citation omitted)). Intrusion upon seclusion protects against an invasion of privacy, and public disclosure of private facts protects against dissemination of private information. See Restatement (Second) of Torts §§ 652B, 652D (A.L.I. 1977). In Pileggi, the D.C. Circuit used two apt hypotheticals to explain why these torts provide sufficient analogs for injuries stemming from the Pixel. First, the court described Pixel tracking as similar to “a magazine seller nos[ing] around in someone’s mailbox to learn what periodicals to press the owner to buy,” matching the harm addressed by intrusion upon seclusion claims. 146 F.4th at 1228. Then, in comparing the harm to that of public disclosure of private facts, it explained: If [the defendant] had sent [the plaintiff’s] video viewing history to a stranger, and that stranger repeatedly approached [the plaintiff] asking her to buy things based on the videos she had viewed, most would agree that [the plaintiff’s] privacy had been invaded. Id. at 1229–30. These analogies apply with even more force to the disclosure of personal health information at issue here. We join the other courts to consider this issue in similar circumstances and find that Plaintiffs have suffered a cognizable injury in the unauthorized disclosure of their IIHI to Meta. That injury is both concrete (disclosure of private information) and particularized (it is their information). Traceability and redressability go unchallenged by Eyemart and are both easily satisfied. The unauthorized disclosure of Plaintiffs’ health information naturally traces to Eyemart, which is the entity that gave Meta 9 Case: 25-10784 Document: 72-1 Page: 10 Date Filed: 10/23/2026 No. 25-10784 access to its users’ private information without their knowledge or consent. See, e.g., Paramount Glob., 133 F.4th at 645; Nat’l Basketball Ass’n, 118 F.4th at 544. And Plaintiffs’ harm is redressable by the injunctive relief (requiring Eyemart to remove the Pixel or obtain users’ consent to tracking) and damages that Plaintiffs seek. See, e.g., Paramount Glob., 133 F.4th at 647–48; Pileggi, 146 F.4th at 1231. Accordingly, Plaintiffs have Article III standing, and we turn to the merits. IV. The district court dismissed all of Plaintiffs’ claims based on two threshold decisions. The district court determined that Plaintiffs failed to adequately plead that (A) the Search Plaintiffs shared IIHI with Eyemart, and that (B) the Prescription Plaintiffs’ IIHI on the Site was shared with Meta. Without those foundational allegations, each of Plaintiffs’ claims necessarily failed. The district court erred on both fronts. A. First, the district court erred in finding that the Search Plaintiffs did not share any IIHI with Eyemart. The Search Plaintiffs allege that they used the Site to search for and browse prescription eyewear, which they claim caused the Pixel to track and share that activity with Meta. One Search Plaintiff also used the Site to schedule an eye exam, resulting in the name and location of the Eyemart store she visited being shared with Meta. The district court found that the Search Plaintiffs did not convey any IIHI to Eyemart by searching for prescription eyewear and that, because the Search Plaintiff who scheduled an appointment online had already shared her location with Meta on Facebook, 10 Case: 25-10784 Document: 72-1 Page: 11 Date Filed: 10/23/2026 No. 25-10784 the Pixel’s tracking of her activities did not result in Meta receiving any new information. As noted above, we follow the parties’ lead and adopt HIPAA’s definition of IIHI in deciding whether Plaintiffs adequately alleged the sharing of their personal health information with Eyemart and Meta. Stated simply, IIHI is information relating to a medical condition or healthcare services sufficient to identify the individual with the condition or receiving the services. See 42 U.S.C. § 1320d(6). At oral argument, Eyemart’s counsel conceded that the information Meta received through the Pixel was individually identifiable because, through Facebook, the information was linked to specific users. This is by design. Without identifying information, Meta and Eyemart could not improve their targeted advertising. That leaves us to decide whether the Search Plaintiffs adequately alleged that they shared information relating to their health conditions or the provision of healthcare by using Eyemart’s Site. We find that they did. Eyemart argues that the Search Plaintiffs “never alleged that they entered diagnoses or symptoms, or completed a transaction or appointment request, that inherently disclosed a condition,” and therefore, they have not sufficiently alleged that they shared health information. IIHI is not so narrow. Again, IIHI covers information “collected from an individual” that “relates to” an individual’s “past, present, or future physical or mental health or condition,” “the provision of health care to an individual,” or “the past, present, or future payment for the provision of health care.” 42 U.S.C. § 1320d(6) (emphasis added). It need not reveal a specific diagnosis or condition; that it pertains to a condition or provision of healthcare is sufficient. 11 Case: 25-10784 Document: 72-1 Page: 12 Date Filed: 10/23/2026 No. 25-10784 The Search Plaintiffs allege that the Pixel tracked their browsing activity on the Site and shared it with Meta, which then monetized that information. More specifically, the Search Plaintiffs claim that the Pixel is active across the Site, and when they viewed or interacted with medical products on the Site, the Pixel intercepted that information for Meta. They assert that each time they clicked on products or tried to schedule exams, those actions “resulted in [IIHI] being intercepted by the Meta Pixel.” Indeed, according to the Amended Complaint, Eyemart’s Privacy Policy itself provides that personal health information is requested when scheduling an appointment on the Site, as one Search Plaintiff did here. The Search Plaintiffs also claim that Eyemart identifies users by “upload[ing] customer lists to Meta that contain Tracked Users’ email addresses and purchase information, including what prescription eyewear they purchased or viewed. [Eyemart] uploads these lists to Meta so that Meta can match Tracked Users to their Facebook profiles.” By virtue of its position as a healthcare products and services provider, activity on Eyemart’s Site pertains to individuals’ vision. Because, as stated in the Amended Complaint, Plaintiffs’ tracked information from the Site relates to their health and the provision of healthcare services, the Search Plaintiffs have adequately alleged that they shared private health information with Eyemart. And because Meta received this data from the Pixel and paired it with Plaintiffs’ identifying information, that information constitutes IIHI. Although the parties have not provided any circuit court cases addressing Pixel tracking of health information—and we are not aware of any to date—the parties discuss several district court cases. For example, Plaintiffs point to Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967 (S.D. Cal. 2023). There, the court concluded that the plaintiffs’ activity on the defendant’s hospital website—which used the Pixel—fell within the scope of protected IIHI, at least at the pleading stage. Id. at 973. The court found that 12 Case: 25-10784 Document: 72-1 Page: 13 Date Filed: 10/23/2026 No. 25-10784 searching for information about conditions, filtering the results of a physician directory, searching for doctors specializing in certain conditions, and booking an appointment on the defendant’s site all “plausibly convey[ed] information about a present medical condition and the provision of medical care covered by HIPAA.” Id. Similarly, in R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 885–86 (C.D. Cal. 2024), the court determined that the plaintiffs searching for and adding certain healthcare products to their carts on the drug store Walgreens’s website resulted in the transmission of the plaintiffs’ personally identifiable information and protected health information to Meta, via the Pixel. The website collected the names of healthcare products, the fact that certain customers were purchasing those products, and the customers’ names. See id. The court reasoned that plaintiffs purchasing “sensitive healthcare products”—including items such as pregnancy tests and diabetes test kits— “related to specific health conditions” because they could be used to diagnose or treat a condition. Id. at 893, 887. Thus, the court found that the tracked activity was personal medical information, sufficient to support an invasion of privacy claim. Id. at 890–91, 894. Rather than distinguish these authorities, Eyemart points to a single district court case from a different context: American Hospital Ass’n v. Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024). In Becerra, the court ruled on cross motions for summary judgment regarding the authority of the Department of Health and Human Services to promulgate certain guidance about IIHI under HIPAA. Id. at 788–89. The guidance took the form of a bulletin, which listed as an example of IIHI the combination of an individual’s IP address with a visit to certain websites addressing specific health information or providers and the user’s reason for visiting the site. Id. at 789. The district court concluded that this bulletin “appeared to shoehorn 13 Case: 25-10784 Document: 72-1 Page: 14 Date Filed: 10/23/2026 No. 25-10784 additional information into the IIHI definition” and consequently exceeded HHS’s statutory authority. Id. at 789, 804. In Becerra, the technology discussed only connected an IP address with an individual’s visit to a site. Id. at 789. Here, Plaintiffs’ information shared with Meta goes beyond that. Plaintiffs contend that Meta captured their activity about seeking healthcare services on the Site—including searching for specific products and providers—and paired it with their personal information from Facebook to curate targeted ads. Additionally, as noted, according to the Amended Complaint, Eyemart’s Privacy Policy itself asserts that protected health information is requested when scheduling an appointment on the Site. This broader scope of information distinguishes Plaintiffs’ data from the data discussed in Becerra and makes this case more akin to Cousin and R.C. At this early stage, taking Plaintiffs’ factual allegations as true, the Search Plaintiffs’ shopping and scheduling information “relates to” their health and the provision of healthcare services, within HIPAA’s definition of IIHI. 42 U.S.C. § 1320d(6). Thus, we hold that the district court erred in finding the Search Plaintiffs had not shared any personal health information with Eyemart. B. Next, the district court correctly found that the Prescription Plaintiffs shared their IIHI with Eyemart but erred in finding that Plaintiffs failed to plead that their IIHI was shared with Meta. In considering whether the Prescription Plaintiffs’ IIHI was shared with Meta, the district court parsed Plaintiffs’ allegations and focused on a few distinct features of the Amended Complaint while ignoring important allegations. First, the district court determined that only the Prescription Plaintiffs’ “prescription information provided when ordering prescription 14 Case: 25-10784 Document: 72-1 Page: 15 Date Filed: 10/23/2026 No. 25-10784 eyeglasses” was significant. It disregarded the rest of Plaintiffs’ tracking allegations as “irrelevant.” Then, looking solely at allegations about ordering prescription eyeglasses, the district court decided that only after an item is added to a user’s cart could a customer share IIHI on the Site by “input[ting] prescription information on the ordering screen.” Next, the district court found that Plaintiffs did not sufficiently allege that the Pixel tracks any IIHI when items are added to a Site user’s cart, whether they are prescription or nonprescription items. To support that conclusion, the district court considered Figure 13 from the Amended Complaint in detail. Figure 13 is a screenshot that represents an example of data (created by Plaintiffs’ attorney, not representing Plaintiffs’ activity) allegedly shared through the Pixel. It purports to show URL data the Pixel would receive from some certain activity on the Site, but it does not show any data related to any Plaintiff’s actual purchase or other activity on the Site. Despite the limitations of this image, the district court made several impermissible inferences about the figure: Figure 13’s caption says it depicts when an “AddToCart event discloses when Tracked Users add prescription lenses to digital cart”; however, the figure shows that the data includes only (1) the content ID, which plaintiffs do not explain or establish any connection to how it would disclose prescription information; (2) “Plastic,” which appears to be a description of the frame material; (3) “2LensAdvizor,” which appears to be a third party fulfillment entity; and (4) the price of the item. The district court then reasoned, “Because nothing in Figure 13 depicts disclosure to Meta of prescription information or that the lenses are prescription lenses, the Court finds that this does not sufficiently allege that any PHI was shared with Meta.” 15 Case: 25-10784 Document: 72-1 Page: 16 Date Filed: 10/23/2026 No. 25-10784 We take issue with several features of this analysis. First, as discussed above, IIHI is not so narrow that it applies only to specific prescription information. As stated in the Amended Complaint, Plaintiffs’ interactions on the Site relate to Plaintiffs’ health, making the data generated from Plaintiffs’ activity on the Site IIHI. Second, as reflected in the quote above, the district court made several inferences about the figure’s contents in the light most favorable to Eyemart, rather than to Plaintiffs, making them impermissible at this stage. Third, the district court failed to explain why it would be appropriate to extrapolate from Plaintiffs’ figures—which reflected only a sample of the type of information transmitted by a certain function on the Site, not the Prescription Plaintiffs’ actual purchases—while expressly ignoring other allegations.4 In other words, the district court considered a figure expressly included “[b]y way of example” to be dispositive. When that figure did not unambiguously show that Meta received prescription information, the district court found that Plaintiffs had failed to show Meta received any of Plaintiffs’ IIHI. This limited focus defies the well-established Rule 12(b)(6) dismissal standard. “Under the federal rules, we construe pleadings in their entirety when assessing their sufficiency.” Arbuckle Mountain Ranch of Tex., Inc. v. Chesapeake Energy Corp., 810 F.3d 335, 340 (5th Cir. 2016); see also Funk v. Stryker Corp., 631 F.3d 777, 783 (5th Cir. 2011) (“When reviewing a motion _____________________ 4 Eyemart argues that the figures in the Amended Complaint contradict Plaintiffs’ other allegations, so the district court correctly disregarded those allegations. Eyemart points to Stevenson v. Tocé, 113 F.4th 494, 502–03 (5th Cir. 2024), for the proposition that where an exhibit contradicts an allegation in the complaint, the exhibit controls. But, in that case, we saw “no contradiction” between an exhibit and the relevant complaint. Id. at 503. The same is true here. The figures in the Amended Complaint were solely meant to provide a limited example of URL paths tracked by the Pixel, not to serve as evidence or to displace Plaintiffs’ related factual allegations. 16 Case: 25-10784 Document: 72-1 Page: 17 Date Filed: 10/23/2026 No. 25-10784 to dismiss, a district court ‘must consider the complaint in its entirety . . . .’” (quoting Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007))). Apart from the demonstrative images in the Amended Complaint, Plaintiffs made several factual allegations concerning the disclosure of IIHI to Meta. For example, Plaintiffs assert, “The Pixel is active across the [Site], including prescription product pages and the relevant information associated with Tracked Users’ attempts to schedule eye examinations on the website, as implemented by Eyemart. When a Tracked User views or interacts with those medical products or services on the [Site], those actions are intercepted and monetized by the Tracking Entity.” Similarly, Plaintiffs allege that “when Tracked Users click to find specific items on the [Site] or purchase prescription eyewear, a description of each item is sent to the Tracking Entity (such as make, model, materials, and product ID of frames and lenses), in addition to details about Tracked Users’ attempts to schedule eye exams.” And, as noted above, Plaintiffs claim that Eyemart “uploads customer lists to Meta that contain Tracked Users’ email addresses and purchase information, including what prescription eyewear they purchased or viewed. [Eyemart] uploads these lists to Meta so that Meta can match Tracked Users to their Facebook profiles.” Thus, according to the Amended Complaint, the Pixel (and therefore Meta) received data about the vision products Plaintiffs viewed, their prescription eyewear purchases, their appointment details, and other IIHI. Taking these factual allegations as true, and making all reasonable inferences in Plaintiffs’ favor, Plaintiffs have adequately alleged that, by using the Pixel, Eyemart shared Plaintiffs’ IIHI with Meta without their consent. * * * Finally, we note that, without the benefit of discovery, Plaintiffs cannot be expected to know much more at this early stage. “[A] Rule 17 Case: 25-10784 Document: 72-1 Page: 18 Date Filed: 10/23/2026 No. 25-10784 12(b)(6) motion tests the sufficiency of the pleadings, not the merits of the case.” George v. SI Grp., Inc., 36 F.4th 611, 619 (5th Cir. 2022). Both the Search Plaintiffs and the Prescription Plaintiffs have sufficiently pled that their browsing activity on Eyemart’s Site led to transmission of their IIHI to Meta, without their permission. If the district court finds that Plaintiffs have adequately pled the elements of their claims, discovery will be necessary to test those allegations. V. In accordance with the foregoing, we agree with the district court that Plaintiffs have standing, and REVERSE the district court’s dismissal on the grounds that the Search Plaintiffs had not shared IIHI with Eyemart and that neither the Search Plaintiffs nor the Prescription Plaintiffs’ IIHI was shared with Meta and REMAND for further proceedings consistent with this opinion. 18