Last week, the Third Circuit affirmed dismissal of a putative class action asserting that defendant Quest Diagnostics violated the California Invasion of Privacy Act (“CIPA”) and the Confidentiality of Medical Information Act (“CMIA”) by employing a website pixel to track and collect data about their website activity for advertising purposes.  See Cole v. Quest Diagnostics Inc., No. 25-1449, 2025 WL 3172640 (3d Cir. Nov. 13, 2025).  The Third Circuit held that Quest was not liable under CIPA for aiding and abetting wiretapping because no wiretapping had occurred, nor under CMIA because Plaintiffs had not alleged the disclosure of protected “medical information.”

Plaintiffs Angela Cole and Beatrice Roche asserted that Quest, a provider of diagnostic information services, aided and abetted a third-party pixel provider’s alleged interception of their medical information and communications with Quest’s websites.  The district court had dismissed Plaintiffs’ CMIA claim, without prejudice, on the ground that the information allegedly disclosed—reflecting only that a patient had “received and [was] accessing test results”—was not substantive “medical information” protected by CMIA, and, as we previously reported, dismissed Plaintiffs’ CIPA claim, with prejudice.

The Third Circuit affirmed dismissal of Plaintiffs’ CIPA and CMIA claims on the following grounds:

• CIPA – The Party Exception Applies.  Applying Third Circuit precedent in In re Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), the Court held the third-party pixel provider was a “party to the communication” because Plaintiffs’ browsers had “sen[t] a separate message” to the pixel provider’s servers “concurrent with the communications with [Quest].”  Accordingly, the pixel provider had directly received the communication from Plaintiffs’ browsers, and Quest did not aid or assist any interception or eavesdropping, even where Plaintiffs lacked knowledge of the asserted transmissions.

• CMIA – Failure to Plead Disclosure of “Medical Information.”  The Court further held that Plaintiffs failed to allege the disclosure of substantive “medical information” under CMIA.  Drawing on federal district court and California state court precedent, the Court explained that “medical information” must relate to “medical history, mental or physical condition, or treatment.” While the “nature of treatment” qualifies as “medical information,” the “fact that treatment occurred [does] not.” Here, the Court concluded, Plaintiffs’ allegation that Quest disclosed the website URL that a patient accessed to view test results amounted to, at most, an assertion that “Quest disclosed Plaintiffs had been [Quest’s] patients.”  This was not “medical information” protected under CMIA.