Data Breach: Cerebral Illegally Disclosed Patient Info to Facebook, Google, TikTok, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

A New York Cerebral user alleges in a proposed class action that the online healthcare platform has secretly shared his and other consumers’ personal information with Facebook, Google, TikTok and other third parties via hidden tracking pixels.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The 63-page complaint relays that a consumer can use Cerebral to, among other things, talk with healthcare providers, research conditions and treatments, schedule and attend appointments and fill out mental health assessments. According to the suit, pixels on the back end of the Cerebral platform collect user information and “surreptitiously” direct it to third parties—who can then view, process and analyze the information before assimilating it into their own data sets for targeted advertising purposes. 

According to the lawsuit, Cerebral disclosed to the United States Department of Health and Human Services (DHHS) that the private information—including names, phone numbers, email addresses, birth dates, IP addresses, client ID numbers and other details— of at least three million people was improperly and illegally disclosed to Facebook, Google, TikTok and other third parties without consent. 

Neither the plaintiff nor other Cerebral users consented to have their private information viewed by third parties, the case stresses. 

In collecting consumers’ information, Cerebral has “statutory, regulatory, contractual, fiduciary, and common law” duties to safeguard the data from disclosure and ensure that it remains private and confidential, the suit says. According to HealthSecurity.com, Cerebral has used tracking pixels on its website since the company began operations in October 2019. 

In its March 6, 2023 notice about the data breach, Cerebral admitted that it secretly enabled the unauthorized transmission of users’ valuable private information to third parties, per the case. 

“The Private Information that Defendant discloses through the Tracking Pixel and similar technologies is valuable to internet marketing companies like Facebook, Google, TikTok, and others as they receive, view, analyze, and aggregate the information to build consumer profiles to assist advertisers in targeting desired demographics.” 

The filing claims Cerebral uses tracking pixel data to “improve and save costs” with regard to marketing, and to improve data analytics, attract new patients and market new services and/or treatments to existing patients.

“In other words, Defendant implemented the Tracking Pixel to bolster its profits,” the suit summarizes. 

Under federal law, a healthcare provider may not disclose personal, non-public medical information about a patient, potential patient or member of a patient’s household for marketing purposes without express written authorization, the case states. 

The lawsuit looks to cover all United States residents whose private information was disclosed to a third party without authorization or consent through the tracking pixel on Cerebral’s website. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.