Costco's collection and sharing of data through Meta's tracking pixel

Costco has a pharmacy website that members can use to mail order pharmaceuticals for people and their pets.^[1] Costco uses a back-end tracking code which allows for a broad scope of information to be disclosed to Meta while allowing Costco to improve and save costs on its marketing campaigns and bolster its data analytics to increase revenue, namely by attracting new patients and improving its services for existing ones.

Two lawsuits have been filed against Costco Wholesale over the use of these trackers on the Costco Pharmacy pages of the Costco website, which has allegedly impermissibly disclosed information protected under the Health Insurance Portability and Accountability Act (HIPAA). Both lawsuits claim that Costco encourages patients and prospective patients to use its pharmacy webpages, communicate about their prescriptions, conduct research on medications, order new prescriptions, request refills for current medications, inquire about specific immunizations, search for local Medicare supplemental insurance, and sign up for its Rx mail order program.^[2]

Timeline of the Costco Meta Pixel lawsuits ^[3]:

October 2023: Two related federal cases were filed in the Western District of Washington: Castillo et al. v. Costco (filed Oct 6) and R.S. v. Costco (filed Oct 25).

November 14, 2024: The court largely denied Costco’s motion to dismiss most of the pivotal claims, allowing the case to proceed. Notably:

• Claims under the Wiretap Act and unjust enrichment survived.
• Some claims — such as those under the Washington Privacy Act and common‑law causes like invasion of privacy or breach of implied contract — were dismissed

Present:

• The lawsuit remains active.
• The case remains in the post‑pleading phase, likely awaiting defendants’ response to amended complaint or further briefing.
• There is no recorded next court date currently scheduled or publicly accessible.

• Costco has not publicly denied or confirmed the allegations regarding the Meta Pixel on its pharmacy pages.
• No official representation from Costco, whether disputing the plaintiffs’ claims, explaining its use of tracking, or referencing HIPAA compliance can be found in the public record or complaints.

Case 2:23-cv-01548 Document 1 Filed 10/06/23 UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WASHINGTON AT SEATTLE [[1]]

Plaintiffs and the Class Members never consented to, authorized, or otherwise agreed to allow Defendant to disclose their Sensitive Information to anyone other than those reasonably believed to be part of Costco, acting in some healthcare-related capacity. Despite this, Defendant knowingly and intentionally disclosed Plaintiffs’ and the Class Members’ Sensitive Information to Meta and other undisclosed third parties.

Plaintiffs’ and the Class Members’ exposed Sensitive Information can and will likely be further exposed or disseminated to additional third parties.

As a direct and proximate result of Defendant’s unauthorized exposure of Plaintiffs’ and the Class Members’ Sensitive Information, Plaintiffs and the Class Members have suffered injury including an invasion of privacy; conversion of their private and valuable personal health information for defendant’s gain; loss of the benefit of the bargain Plaintiffs and the Class.

Members considered at the time they bargained for pharmaceutical services and agreed to use Defendant’s Website for services; statutory damages; and the continued and ongoing risk to their Sensitive Information.

DEMAND FOR JURY TRIAL Plaintiffs, on behalf of themselves and the Class, demand a trial by jury of any and all issues in this action so triable of right. DATED this 6th day of October, 2023.

Case 2:23-cv-01628-RSM Document 1 Filed 10/25/23 UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WASHINGTON AT SEATTLE

Plaintiff brings this case to address Defendant’s unlawful practice of disclosing Plaintiff’s and Class Members’ confidential, personally-identifiable information (“PII”) and protected, health information (“PHI”) (collectively referred to as “Private Information”) to unauthorized third parties via tracking technologies and analytics software embedded on its website (“Tracking Tools”). One of the Tracking Tools Defendant installed on its Website is the Facebook pixel, which works in conjunction with related marketing tools and caused patients’ Private Information to be sent to Meta Platforms, Inc. d/b/a Meta (“Facebook”) without patients’ consent when they used Defendant’s website

On information and belief, Defendant’s websites and Tracking Tools have also transmitted patients’ Private Information to additional unauthorized third-parties for marketing and advertising purposes, including Google and Adobe.

DEMAND FOR JURY TRIAL Plaintiff hereby demands that this matter be tried before a jury.