Costco has a serious confidential member data problem

While Costco has a reputation for truly caring about its members, a lawsuit accuses the warehouse club of breaching that trust.

The class-action lawsuit alleges that Costco used a Facebook Meta Pixel on its website to secretly track and disclose the private and protected health information of millions of pharmacy customers to third parties without their knowledge or consent.

“The 58-page lawsuit, filed in Washington on October 6, accuses the member-only warehouse retailer of blatantly violating state and federal privacy laws by failing to disclose, or otherwise intentionally omitting, that it shares information about consumers’ prescription orders and refills, health insurance coverage, immunization questions, Medicare details and other unique identifiers with Meta Platforms,” ClassAction.org reported.

Costco (COST) , the lawsuit charges, had claimed that it offered a secure and confidential pharmacy platform. The legal filing says that although Costco actively encourages patients and prospective patients to use its supposedly secure pharmacy site, Costco.com/pharmacy, the site nevertheless contains a snippet of online tracking code, a Meta Pixel.

This code tracks a user’s activity, logging, among other data, the pages and subpages a person visits, clicks around the site, searches, form submissions and non-anonymized personal information.

Costco has been accused of compromising member data.

Image source: VIEWpress/Getty Images

Costco has lost attempts to throw the lawsuit out

The lawsuit explains what Costco is accused of doing wrong.

“Indeed, [the] Pixel is routinely used to target specific customers by utilizing the data gathered through the Pixel to build profiles for the purpose of future targeting and marketing,” the lawsuit explains. “Here, the information transmitted to third-party Meta, without Plaintiffs’ consent, most certainly included private health information, which is some of the most personal and sensitive data Plaintiffs have.”

The Meta Pixel also logs “the exact content” of a patient’s communications with the Costco pharmacy website and redirects that data to the social media company “in a fashion that identifies the person as a patient,” according to the lawsuit.

Costco’s use of the back-end tracking code allows for “a broad scope of information” to be disclosed to Meta while allowing Costco to “improve and save costs on its marketing campaigns” and bolster its data analytics to increase revenue, namely by attracting new patients and improving its services for existing ones, the court filings allege.

More Retail:

Facebook's parent company Meta (META) is not named in the lawsuit.

Meta has publicly stated that its policy prohibits advertisers from sending sensitive data through its Business Tools, and that it provides guidance to prevent users from doing so.

Timeline of the Costco Meta Pixel lawsuit:

In October 2023, two related federal cases were filed in the Western District of Washington: Castillo et al. v. Costco (filed Oct 6) and R.S. v. Costco (filed Oct 25).
On November 14, 2024, the court largely denied Costco’s motion to dismiss most of the pivotal claims, allowing the case to proceed. Notably:
- Claims under the Wiretap Act and unjust enrichment survived.
- Some claims — such as those under the Washington Privacy Act and common‑law causes like invasion of privacy or breach of implied contract — were dismissed
The lawsuit remains active.
The case remains in the post‑pleading phase, likely awaiting defendants’ response to amended complaint or further briefing.
There is no recorded next court date currently scheduled or publicly accessible.

What has Costco said?

Costco has not publicly denied or confirmed the allegations regarding the Meta Pixel on its pharmacy pages.
No official representation from Costco, whether disputing the plaintiffs’ claims, explaining its use of tracking, or referencing HIPAA compliance can be found in the public record or complaints.