Rand v. Eyemart Express LLC

Opinion

IN THE UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF TEXAS DALLAS DIVISION

RACHELLE RAND, et al., § § § Plaintiffs, § § v. § Civil Action No. 3:24-CV-621-N § EYEMART EXPRESS, LLC, § § Defendant. §

MEMORANDUM OPINION AND ORDER

This Order addresses Defendant Eyemart Express, LLC’s (“Eyemart”) Motion to Dismiss Plaintiffs’ First Amended Complaint [32]. Because plaintiffs have failed to plead facts sufficient to state a claim for violation of the Federal Electronic Communications Privacy Act, the Missouri Wiretap Act, the Illinois Eavesdropping Statute, breach of contract, breach of implied contract, or intrusion upon seclusion, the Court grants the motion. I. ORIGINS OF THE MOTION Plaintiffs are five Meta (f/k/a Facebook) users who accessed the Eyemart website to search for prescription eyewear products and to search for eye doctors in their areas. Pls.’ Am. Compl. ¶¶ 26–30 [29]. Eyemart operates a retail website and a chain of physical stores where customers may browse for eyewear, both prescription and non-prescription. Id. ¶ 31. Customers may purchase eyewear directly from the site or in store. Id. ¶ 1. For an online purchase, when a customer selects eyewear to purchase, the customer is prompted to select the type of lens for the selected frames and, if the customer selects prescription lenses, he or she is then prompted to enter prescription information. Id. ¶¶ 29–30, 70–71. The website also offers the ability to locate an eye doctor with whom the customer

may schedule an appointment. Id. ¶¶ 1, 3. The website provides links to “online scheduling, phone numbers to call the locations, and addresses to visit the locations” of the eye doctors. Id. ¶ 3. Eyemart’s website utilizes Meta Pixel technology, which tracks predetermined user interaction “events” on a website, such as when a user clicks a designated button, adds an

item to a digital cart, or searches for a location. Id. ¶¶ 106–08. The Pixel provides anonymized data to the website owner to learn how customers interact with the website. Id. ¶ 89. The Pixel also shares the data with Meta in exchange for use of the tool. Id. ¶¶ 88–89. Meta users who have previously agreed to the Meta Privacy and Cookie Policy have a user identification cookie stored on their device by Meta. Id. ¶ 103; Def.’s Mot.

14–15. This cookie is included in metadata when Pixel events are triggered, attaching a unique identifier to otherwise anonymized data. Pls.’ Am. Compl. ¶¶ 103, 109, 123. This user identification cookie can then be used by anyone who understands the unique numeric identifier to de-anonymize information related to the user’s interactions on the site. Id. ¶¶ 103–105.

Plaintiffs all visited the Eyemart website with the intent to look at prescription eyeglasses. Id. ¶¶ 26–30. Plaintiff Rand additionally had the intent to schedule an appointment for an eye exam. Id. ¶ 26. Plaintiffs Lash and Mees purchased prescription eyewear from the website. Id. ¶¶ 29–30. All five of the named plaintiffs had Facebook accounts and had previously consented to Meta storing a user identification cookie on their devices; therefore, all the metadata collected about their interactions on the website contained a cookie that made it capable of being de-anonymized. Id. ¶¶ 26–30, 104–05.

Plaintiffs brought this suit on behalf of themselves and all others similarly situated. Plaintiffs assert violations of the Federal Electronic Communications Privacy Act, the Missouri Wiretap Act, the Illinois Eavesdropping Statute, breach of contract, breach of implied contract, and intrusion upon seclusion. The Court dismissed the first complaint for failure to state a claim. The plaintiffs

amended the complaint, adding two new named plaintiffs. Eyemart now moves to dismiss Plaintiffs’ Amended Class Action Complaint for failure to state a claim. II. RULE 12(B)(6) STANDARD When deciding a Rule 12(b)(6) motion to dismiss, a court must determine whether the plaintiff has asserted a legally sufficient claim for relief. Blackburn v. City of Marshall,

42 F.3d 925, 931 (5th Cir. 1995). A viable complaint must include “enough facts to state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). To meet this “facial plausibility” standard, a plaintiff must “plead[] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A court

generally accepts well-pleaded facts as true and construes the complaint in the light most favorable to the plaintiff. Gines v. D.R. Horton, Inc., 699 F.3d 812, 816 (5th Cir. 2012). But a plaintiff must provide “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 (internal citations omitted). “Factual allegations must be enough to raise a right to relief above the speculative level . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Id. (internal citations omitted).

In ruling on a Rule 12(b)(6) motion, a court generally limits its review to the face of the pleadings, accepting as true all well-pleaded facts and viewing them in the light most favorable to the plaintiff. See Spivey v. Robertson, 197 F.3d 772, 774 (5th Cir. 1999). However, a court may also consider documents outside of the pleadings if they fall within certain limited categories. First, “[a] court is permitted . . . to rely on ‘documents

incorporated into the complaint by reference, and matters of which a court may take judicial notice.’” Dorsey v. Portfolio Equities, Inc., 540 F.3d 333, 338 (5th Cir. 2008) (quoting Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322 (2007)). Second, “[a] written document that is attached to a complaint as an exhibit is considered part of the complaint and may be considered in a 12(b)(6) dismissal proceeding.” Ferrer v. Chevron

Corp., 484 F.3d 776, 780 (5th Cir. 2007). Third, a “court may consider documents attached to a motion to dismiss that ‘are referred to in the plaintiff’s complaint and are central to the plaintiff’s claim.’” Sullivan v. Leor Energy, LLC, 600 F.3d 542, 546 (5th Cir. 2010) (quoting Scanlan v. Tex. A&M Univ., 343 F.3d 533, 536 (5th Cir. 2003)). Finally, “[i]n deciding a 12(b)(6) motion to dismiss, a court may permissibly refer to matters of public

record.” Cinel v. Connick, 15 F.3d 1338, 1343 n.6 (5th Cir. 1994) (citation omitted); see also, e.g., Funk, 631 F.3d at 783 (stating, in upholding district court’s dismissal pursuant to Rule 12(b)(6), that “[t]he district court took appropriate judicial notice of publicly-available documents and transcripts produced by the [Food and Drug Administration], which were matters of public record directly relevant to the issue at hand”).

III. THE COURT GRANTS THE MOTION All the claims here are premised upon the allegation that Eyemart shared plaintiffs’ private health information (“PHI”) with Meta. Therefore, the Court looks at the allegations of each plaintiff to determine whether he or she has sufficiently alleged (1) that the plaintiff shared any PHI with Eyemart, and (2) that Eyemart shared that PHI with Meta. The Court first looks at Rand, Gottshau, and Soto to determine if their amended pleadings overcomes

the previously found insufficiency, then the Court looks at the pleadings of the two new plaintiffs. Plaintiffs Rand, Gottshau, and Soto The Court previously granted Eyemart’s first motion to dismiss, finding that Rand, Gottshau, and Soto, the only named plaintiffs in the first complaint, “failed to plead facts

that plausibly establish that they shared any private health information with Eyemart that could be shared with Meta.” Order at 9 [28]. In their amended complaint, these plaintiffs added only their subjective intent for visiting the Eyemart website, but again failed to plead any actual actions that would have shared any PHI. In the amended complaint, Gottshau and Soto did not amend their factual

allegations. Rand adds only that she visited the website with the intent to “purchase prescription eyewear as well as schedule an appointment for an eye exam,” and that her visit to the website “result[ed] in the disclosure of the name and location of the Eyemart location Ms. Rand used to obtain examinations and prescription eyewear from Eyemart.” Pls.’ Am. Compl. ¶ 26. The Court has already held that her subjective intent for visiting the website, whether to purchase prescription eyewear or nonprescription sunglasses, does not constitute sharing of PHI. See Mem. Order & Op., Oct. 1, 2024, at 8 (“Courts have

found that HIPAA does not extend liability for entities to guard against ‘visitors’ subjective motives for visiting the page.’” (citing Am. Hosp. Ass’n v. Bercerra, 2024 WL 3075865 at *12 (N.D. Tex. 2024))). The alleged disclosure of the location of the Eyemart store most convenient for Rand to visit and ultimately make her purchases does not constitute any shared PHI. The amended complaint alleges that all plaintiffs affirmatively shared their

locations with Meta through their Facebook accounts, Pls.’ Am. Compl. ¶¶ 26–30, so identifying the storefront near her where she could visit the same retailer in person that she was visiting online gives no new information to Meta. Nor does her identification of a storefront near her share any information with Meta beyond an implication that she planned to visit a retailer that sells both prescription and non-prescription eyeglasses.

The Court previously found that Rand, Gottshau, and Soto “failed to plead facts that plausibly establish that they shared any private health information with Eyemart that could be shared with Meta.” Order at 9. Because these plaintiffs have failed to add any material factual allegations that would lead to a different outcome, the Court finds that they have failed to plead facts to support their claims.

Plaintiffs Lash and Mees In the amended complaint, plaintiffs added two named plaintiffs, Lash and Mees. Lash and Mees both allege that they purchased prescription eyewear from the Eyemart website and as part of the ordering process, they “entered [their] prescription information into the Website.” Pls.’ Am. Compl. ¶¶ 29, 30. Because they entered prescription information on the Eyemart website, the Court finds that these plaintiffs have plausibly established that they shared PHI with Eyemart. Thus, the Court next looks to whether these

plaintiffs have sufficiently alleged that their PHI was unlawfully shared with Meta. Plaintiffs’ amended complaint discusses how the Pixel does not track every interaction on the site but is limited to those which the website owner or operator designates. Id. ¶ 93. Plaintiffs allege that the custom designed Pixel events include “when users add items to a digital cart,” “when users seek to find the location for an eye exam or

a location to purchase their glasses,” and “may include the category or name of a product being searched.” Id. ¶¶ 107, 113. Because Lash and Mee’s allegations are limited to the prescription information provided when ordering prescription eyeglasses, plaintiffs’ arguments about PHI tracking on other parts of the site are irrelevant to the Court’s analysis here.

As plaintiffs’ amended complaint describes, Eyemart’s online store blurs the lines between ordinary retail and healthcare retail with both prescription and non-prescription glasses on the same portion of the website. Pls.’ Am. Compl. ¶ 81–82 (“While a brick- and-mortar store may more effectively separate its optometry and normal business in a physical space, the lines are blurred for online stores. Notably, products one would expect

to find in the optometry section of a store are found by navigating the normal portions of the website.”) Based on the descriptions of the Eyemart website in the amended complaint, it does not appear that the information of whether a customer was searching for prescription glasses, sunglasses, or fashion glasses, would be apparent until after an item is added to cart and more options are selected. See id. fig. 8 (showing that for a given style of frames, the website offers clear lens options or options for gray, brown, black, green, blue, yellow, lavender, or pink lenses). Because Eyemarts’ frames appear to be versatile and available

for prescription lenses, sunglass lenses, or fashion lenses, information about the frames or the styles customers browse does not convincingly share any PHI. Only after the frames have been selected do users input their prescription information on the ordering screen. See id. ¶¶ 67–72 and figs. 3, 4, 5 & 6. Plaintiffs allege that adding an item to a virtual cart triggers an “AddToCart event

[which] discloses when a Tracked User adds frames and prescription lenses to their cart for purchase as depicted in Figures 12 and 13.” Id. ¶ 114. However, plaintiffs do not sufficiently allege that any PHI is disclosed when the AddToCart event is triggered or that the AddToCart event is triggered differently if prescription or non-prescription lenses are added to the frames.

Figures 12 and 13 identify the specific information that is sent to Meta in the AddToCart event: the name of the item, the product ID, the item price, the make and model, the material, and the third-party fulfillment entity. See id. ¶ 122 and figs. 12 & 13; see also id. ¶ 128 (describing it as a “specific description of the frames and lenses”). Figure 13’s caption says it depicts when an “AddToCart event discloses when Tracked Users add

prescription lenses to digital cart”; however, the figure shows that the data includes only (1) the content ID, which plaintiffs do not explain or establish any connection to how it would disclose prescription information; (2) “Plastic,” which appears to be a description of the frame material; (3) “2LensAdvizor,” which appears to be a third party fulfillment entity; and (4) the price of the item. Id. fig. 13. Because nothing in Figure 13 depicts disclosure to Meta of prescription information or that the lenses are prescription lenses, the Court finds that this does not sufficiently allege that any PHI was shared with Meta.

At most, plaintiffs have made the conclusory allegation that “add[ing] products to their digital shopping cart” triggered a Pixel event and therefore “resulted in PHI being intercepted.” Id. ¶ 25. However, nowhere in this factual pleading do plaintiffs allege that prescription information is included in the information tracked. Moreover, the figures showing the metadata and identifying specifically what information is sent to Meta belie

any conclusory statements that the prescription information is included, because it is notably absent from the data seen to be tracked there. Plaintiffs argue that they need not “plead the necessary facts to show that the Pixel on the Website actually sent anything to Meta as to these particular plaintiffs” and that it is sufficient they “provide their actions on defendant’s website and allege that such actions

would have resulted in the transmission of their information to Meta.” Pls.’ Resp. at 8–9. However, unlike in the case they cite for that proposition, plaintiffs here fail to plead that their actions would have resulted in the transmission of their PHI to Meta because they fail to plead that the prescription information is captured by the Pixel. See R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 891 (C.D. Cal. 2024) (describing how in that case, the Pixel

captured the items added to users’ shopping carts where the items themselves disclosed medical information). Therefore, the Court finds that Lash and Mees have not sufficiently alleged that any PHI was disclosed to Meta through the Pixel. Because Plaintiffs Have Not Plausibly Alleged that Any PHI was Shared with Meta, Each of the Claims Fails Federal Electronic Communications Privacy Act. — The Federal Electronic Privacy Act (“ECPA”) is a one-party consent statute. 18 U.S.C.A. § 2511(f) (“It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such a person is a party to the communication or

where one of the parties to the communication has given prior consent.”). In other words, Eyemart cannot eavesdrop on communications directed at it “unless such communication is intercepted for the purpose of committing any criminal or tortious act.” Id. Plaintiffs argue that the crime-tort exception applies here, because to the extent that any communication contained PHI, the interception was a violation of HIPAA.

As established above, plaintiffs have failed to plead facts to plausibly establish that any PHI was shared with Meta. Therefore, because no facts support a violation of HIPAA, the crime-tort exception does not apply here. Because the ECPA is a one-party consent statute and Eyemart consented to the tracking on its site, plaintiffs have failed to state a claim under the ECPA. Missouri Wiretap Act. — The Missouri wiretap statute is modeled off the ECPA

and is similarly a one-party consent statute with a crime-tort exception. MO. REV. STAT. § 542.402.2(3); State v. King, 873 S.W.2d 905, 908 (Mo. Ct. App. 1994). Rand, the only Missouri plaintiff, has failed to state a claim under this statute for the same reasons plaintiffs have failed to state a claim under the ECPA. Illinois Eavesdropping Act. — Soto, the only named Illinois plaintiff, has brought a claims under the Illinois Eavesdropping Act (“IEA”) individually and on behalf of all others similarly situated. Pls.’ Am. Compl. ¶ 28. The IEA requires that the

interception be “in a surreptitious manner” and without “the consent of all other parties to the private conversation.” 720 ILL. COMP. STAT. 5/14-2. Soto alleges that he “reasonably expected” his PHI “to be private under HIPAA” and therefore his actions on the site related to his PHI were “private conversations” under the statute. Pls.’ Am. Compl. ¶ 264. The Court has already found that Soto did not plausibly plead facts to show he shared any PHI

with Eyemart. Therefore, he has failed to establish that he had any private conversation that could have been intercepted. Breach of Contract, Breach of Implied Contract, and Intrusion upon Seclusion. — Plaintiffs’ breach of contract claims and intrusion upon seclusion claims are

premised upon the disclosure of plaintiffs’ PHI. They claim any disclosure of PHI is contrary to Eyemart’s Terms of Use and the implied contract not to disclose PHI without consent. Plaintiffs also claim that the sharing of PHI would be highly offensive to a reasonable person. Because plaintiffs have failed to plausibly plead facts to show that any PHI was shared with Meta, there is insufficient factual basis to state a claim for breach of contract, breach of implied contract, or intrusion upon seclusion.

CONCLUSION Because the Court finds plaintiffs have not alleged facts sufficient to state a claim for violation of the ECPA, the Missouri or Illinois wiretapping statutes, breach of contract, breach of implied contract, or intrusion upon seclusion, the Court grants Eyemart’s motion. Plaintiffs have already had an opportunity to replead, therefore the Court dismisses all claims with prejudice.

Signed May 27, 2025.

A C. —C Chief United States District Jud&

MEMORANDUM OPINION & ORDER — PAGE 12