Duly Health and Care, a large Illinois-based provider, faced a class action after patients alleged that a Meta tracking pixel—a snippet of code commonly used for advertising measurement and website analytics—was active on parts of Duly’s authenticated patient website. The claim centers on the idea that when patients logged in between July 24, 2020 and April 10, 2023, information about that logged-in activity was allegedly transmitted to Meta without clear, informed consent. Because patient portals can reveal highly sensitive details about care, appointments, or account actions, the presence of consumer-style tracking tools in these environments has become a flashpoint in digital health privacy. The lawsuit was filed on the theory that this kind of data sharing is unexpected in a healthcare portal and may violate privacy laws and duties that apply to health information, even if patients can’t show direct financial harm. Duly denies wrongdoing, but agreed to a $1.88 million settlement to avoid the cost and uncertainty of litigation; eligible users must submit a claim by March 2, 2026, with payouts depending on how many valid claims are approved. The significance extends beyond this one provider: similar “pixel” lawsuits have targeted hospitals and telehealth companies, reflecting wider regulatory pressure—especially under HIPAA’s rules for protected health information and the FTC’s Health Breach Notification Rule—pushing healthcare organizations to scrutinize third‑party tracking, obtain meaningful consent where required, and limit sharing that could link online behavior to an identifiable patient.