NorthBay Healthcare, a California health system, faced a class action after patients alleged that website and patient-portal tracking tools (often called “pixels”) sent information to third parties such as Facebook and Google between Nov. 29, 2020, and May 14, 2024. These tools are widely used across industries to measure ad performance and user behavior, but in healthcare they can become especially sensitive because routine web interactions—like scheduling, portal logins, or browsing condition-related pages—may be linked to a person’s identity or health context. The proposed settlement covers California residents whose personal and/or health information was allegedly disclosed without authorization through these tracking technologies. The lawsuit was filed because plaintiffs claim NorthBay’s disclosures occurred without patient consent and violated California privacy laws, underscoring growing scrutiny of how healthcare organizations use marketing analytics on consumer-facing sites. Without admitting wrongdoing, NorthBay agreed to an undisclosed settlement fund that provides eligible class members a one-time $15 payment and a one-year subscription to CyEx Privacy Shield Pro, with claim, opt-out, and objection deadlines in March 2026 and a final approval hearing scheduled that same month. The case’s significance is less about the modest payout and more about forcing healthcare providers to reevaluate tracking configurations, vendor contracts, and notice/consent practices on websites and portals. More broadly, this fits into a national wave of litigation and enforcement risk around “pixel” tracking in healthcare, where plaintiffs argue that sharing data with ad platforms can amount to unauthorized disclosure of medical information, even when the data is not an obvious diagnosis code. In California, regulations and statutes such as the Confidentiality of Medical Information Act (CMIA) and consumer-privacy frameworks like the CCPA/CPRA heighten expectations around transparency, purpose limitation, and safeguards, while federal HIPAA rules can also be implicated depending on whether the data is handled by covered entities and their business associates. Similar cases against hospitals and telehealth providers have pushed the industry toward tighter controls—minimizing trackers on patient journeys, using privacy-preserving analytics, and ensuring any necessary tools are deployed with clear consent and strict data-sharing limits.