Class Action Says DaVita.com Visitors’ Private Data Secretly Passed to Facebook, Other Third Parties

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims dialysis services provider DaVita has unlawfully shared website visitors’ personal data with third parties, including Facebook, without consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 61-page lawsuit, DaVita has installed on its website the Meta pixel and Facebook’s Conversions application programming interface (API), which are tools businesses can embed into their websites to allow the social media company to track visitors’ activity in real time as they interact with the pages.

Through the use of the Meta pixel and Conversions API, DaVita secretly shares with Facebook every move visitors make on DaVita.com, including the buttons they click, search queries, pages viewed, IP addresses and more, the case contends.

The complaint also claims that DaVita utilizes additional tracking tools, such as Google Analytics and Google Tag Manager, to disclose users’ personal information to Google and other third parties.

As the filing tells it, when a patient visits DaVita.com—where they can search for a specialist, find facility locations, research medical treatments and services and pay bills—the tracking tools collect and share with third parties the visitor’s confidential information, including the type of medical treatment sought, their health condition, demographic data, contact details, birth date, insurance provider information and more.

The Facebook tracking tools also disclose a visitor’s Facebook ID—a unique identifier that can be used to locate an individual’s social media profile, the lawsuit explains. By sharing a person’s Facebook ID, DaVita thereby shares enough data to link a user’s identity to their online communications and activity, the suit notes.

“This is precisely the type of information that [the Health Insurance Portability and Accountability Act] requires healthcare providers to anonymize to protect the privacy of patients,” the case states. “[The plaintiff’s] and Class Members [sic] identities can easily be determined based on their Facebook ID, IP address, digital fingerprint, or reverse lookup from the collection of other identifying information that was improperly disclosed.”

The plaintiff, a California resident, says she has used DaVita.com in the past to find dialysis locations, research types of treatment and communicate with health professionals about her medical care. While doing so, the woman had her private data unlawfully captured and disclosed to third parties without her knowledge or consent, the complaint alleges.

The lawsuit looks to represent any California residents who, during the applicable statute of limitations period, were patients of DaVita and used DaVita.com.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.