Some privacy campaigns need a clever hook, like an otter running off with a box of data. Health privacy campaigns don't. "Your health information may have been shared with Facebook" sells itself.
Below are two screenshots from one campaign: a sponsored Instagram ad from the law firm Labaton Keller Sucharow, and the landing page it leads to. The target is Ro, the telehealth company behind the Roman brand. Together they show how a plaintiffs' firm turns a theory about tracking pixels into a pool of claimants.
The ad
A sponsored post labeled "Attorney Advertisement." The caption says the firm is helping hold Ro Health accountable for leaking users' private information.
The ad is plain: the company's logo in its own brand color, "Health Privacy Violations," and "Compensation up to $5,000 may be available." The photo, a man checking his hairline, signals which of Ro's customers the ad is looking for. When we captured it, it had 401 likes and 15 comments, a lot of engagement for a law firm ad.
The landing page
The case page on Labaton's Lantern site, which describes the allegations and the arbitration claims.
"Learn more" goes to Labaton's case page for Ro↗ on Lantern, the firm's consumer arbitration site. The page alleges that Ro shared members' sensitive information, including health conditions, answers to health questionnaires, and the name, dosage, and price of medications ordered, with third parties "via third party software embedded in the code of its webpages." It names Facebook and TikTok as recipients and says Labaton is pursuing arbitration claims under federal and state privacy and medical information laws.
These are allegations. The page itself says it is not legal advice, and no finding has been made against Ro. When we checked the page in October 2026, it was dated April 4, 2024 and marked "closed to new clients," which suggests the firm already signed up as many claimants as it wanted.
A platform, not a one-off
The Ro page is one listing in a catalog. Lantern's case directory↗ lists campaigns against NerdWallet, Tesla, AutoZone, Dollar General, Glo Yoga, and others, many alleging that personal information was shared with third parties without consent. Each listing has the same parts: a brand, an eligibility test, a potential recovery figure, and a "Get Started" button.
The firm has a track record in this area. Labaton was co-counsel for the class that won a jury verdict against Meta↗ in August 2025 over health data collected from users of the Flo period-tracking app. We covered the lessons from that case in our post on Frasco v. Flo Health.
Arbitration is the point. If a company's terms require individual arbitration, each claimant files separately, and the company can owe fees on every filing. A recruiting ad that brings in a few thousand members can create more pressure than one class action. See our post on CIPA arbitration for how that math works.
Why health sites are the easiest target
The same pixel carries different risk on different pages. On a shoe store's product page, a pixel event says someone looked at sneakers. On a telehealth intake flow, the same kind of event can carry a page URL, a button label, or a form field that names a condition or a prescription.
Regulators have treated that difference seriously for years. In 2023, the FTC took its first Health Breach Notification Rule action against GoodRx↗ for sharing consumers' health information with Facebook, Google, and other companies for advertising. Plaintiffs' firms read the same enforcement actions regulators publish.
What health and wellness brands should check
You don't need to be a telehealth company to have this exposure. Supplement brands, fertility and period products, hair loss, sexual wellness, weight loss, and pharmacy-adjacent stores all have pages where a URL or event name reveals something sensitive. Check:
- What fires on sensitive pages. Load your quiz, intake, and product pages with DevTools open and look at what the Meta, TikTok, and Google requests actually contain: page URLs, event names, custom parameters.
- When it fires. If tags load before a visitor consents, the content of every one of those requests is exposure.
- What your pixel setup sends by default. Automatic event detection and URL-based events can send more than your marketing team configured on purpose.
- Who installed what. Health brands often run several ad platforms, a quiz tool, and a subscription app, each adding its own tags.
See what your site sends before consent
The free CIPA scan records every pixel and third-party script that fires on your site before a visitor consents.
Scan my site →How PieEye closes the gap
No pixels before consent. PieEye's Trap and Trace Shield holds third-party scripts, including ad pixels, until the visitor consents, so nothing from a quiz or intake page reaches an ad platform by default.
Consent that controls the tags. PieEye's consent management ties each category in the banner to the scripts in it, so a visitor who declines advertising cookies actually turns off advertising pixels.
A clear view of the problem. The free CIPA scan shows which trackers load on your site before consent, which is the same starting point an investigator uses before a brand ends up in an ad like this one.
A health brand's customers will click on an ad that says their medical information was leaked. The way to keep your brand out of that ad is to make sure the claim wouldn't be true.
This post is for general information and is not legal advice. The ad and case page described here are allegations by plaintiffs' attorneys, not findings of wrongdoing.