Why the MDL exists

When the same defendant is sued by many plaintiffs in many federal courts over related claims, federal procedure allows the cases to be consolidated for pretrial purposes. That’s what an MDL is.

After The Markup's June 2022 investigation, dozens of plaintiffs filed suit against Meta and against individual hospitals. The cases against Meta were consolidated into a single MDL in the Northern District of California, where Meta is headquartered. The cases against individual hospitals — Advocate Aurora, MarinHealth, Novant, etc. — proceeded separately in their respective home districts.

So there are really two parallel tracks. One is hospital-by-hospital cases, mostly settling for $3M-$12.25M each. The other is the MDL against Meta itself, which is much larger and still active.

What the plaintiffs claim

The MDL's lead complaint, consolidated from numerous individual cases, alleges Meta:

  • Knowingly received patient data through the Meta Pixel
  • Used that data to build targeting profiles for advertising
  • Did not have BAAs with the hospitals whose data it received
  • Misrepresented to hospitals that the Pixel could be configured to filter out sensitive data
  • Continued receiving patient data even after public reporting (The Markup investigation, congressional inquiries) made the issue widely known

The legal claims include violations of the federal Wiretap Act, the Stored Communications Act, the California Invasion of Privacy Act, common-law invasion of privacy, intrusion upon seclusion, breach of confidence, and unjust enrichment.

The 664 hospitals figure

Plaintiffs' experts produced an analysis identifying hospital systems whose websites sent patient data to Meta during the relevant period. The number that became public — more than 664 — is from court filings.

That number includes:

  • Major academic medical centers
  • Community hospital systems
  • Large multi-state systems
  • Some independent hospitals and physician groups

The Markup's earlier investigation identified 33 hospitals among the top 100 in the U.S. The 664+ figure is broader because it covers all hospital systems, not just the largest, and uses additional data sources beyond what The Markup had.

The motion-to-dismiss ruling

Meta moved to dismiss in 2022-2023, arguing among other things that:

  • It had no obligation to know whether the data it received was PHI
  • The hospitals (not Meta) were responsible for what they sent
  • Plaintiffs hadn't shown actual injury
  • The wiretap claims didn't apply because Meta was a "party" to the communications

The court rejected most of these arguments. Specifically, the court held that:

  • Meta's knowledge that hospitals were sending health-related data was plausibly alleged
  • The hospital's role didn't insulate Meta from liability for receiving PHI
  • The unauthorized disclosure was itself a concrete harm
  • The Wiretap Act's "party exception" didn't shield Meta when the underlying purpose of the data collection was for the benefit of a third party (advertisers)

The case proceeded to discovery in 2024.

Where it stands now

As of early 2026, the case is in discovery. Plaintiffs are seeking documents from Meta about its knowledge of the issue, its internal communications about healthcare clients, and its product decisions related to Pixel filtering features.

Class certification proceedings are ongoing. If the class is certified, the case becomes one of the largest privacy class actions in U.S. history by class size. Even modest per-class-member damages would total in the hundreds of millions.

Why this matters for hospitals

Three reasons.

First, hospitals named in the MDL are also defendants in their own state-court class actions. Their lawyers are coordinating, but the litigation is two-front.

Second, the discovery in the MDL is producing documents that will be useful to plaintiffs in every individual case. Anything Meta is forced to produce can be cited in hospital-specific cases.

Third, if there's an eventual MDL settlement, it may not cover the hospital-defendant cases at all. The MDL is against Meta. Individual hospitals will continue settling separately.

What's likely to happen

Predictions on MDLs are unreliable. But the typical pattern: 2-4 years of discovery, class certification battle, summary judgment motions, possible global settlement before trial. Even an aggressive timeline puts a Meta MDL settlement somewhere in 2027-2028.

For hospitals, the practical implication is to assume the litigation environment doesn't get easier. New filings continue. Settlements continue at the hospital-by-hospital level. Removing pixels and tightening governance is the only thing that matters.