On Appeal from the U.S. District Court, E.D. Pa. Judge John F. Murphy, No. 5:22-cv-04580

Before: HARDIMAN, FREEMAN, and CHUNG, Circuit Judges Argued: Oct. 21, 2025; Filed: Aug. 28, 2026

OPINION OF THE COURT

FREEMAN, Circuit Judge . Patrick Santoro and Jessica Landis brought a putative class action against healthcare provider Tower Health. They claim that Tower Health's websites use a tracking code that intercepted and shared Plaintiffs’ personally identifying information, including their health conditions, treatments, and medications. The District Court dismissed their second amended complaint with prejudice, reasoning that (1) Plaintiffs did not adequately specify the nature of the personal health information the tracking pixels shared and (2) amendment would be futile. Plaintiffs moved for reconsideration, requesting leave to further amend their complaint. The District Court denied the motion on grounds of undue delay. For the reasons that follow, we will AFFIRM the District Court's orders dismissing the Second Amended Complaint and denying the reconsideration motion.

Page 2Tower Health is a regional healthcare provider that operates seven hospitals and 27 urgent care facilities, plus home healthcare services. It encourages its patients and the general public to access health information through its website.

In various notices and confidentiality agreements, Tower Health pledges to keep its patients’ health information private. Notwithstanding those representations, Tower Health installed Meta Pixel on its website. Meta Pixel is software code that captures information about website users’ characteristics ( e.g. , their IP addresses, device identifiers, and account numbers) and the content of their communications ( e.g. , the URLs, buttons, links, pages, and tabs the users view). Meta Pixel contemporaneously transmits this information to the technology company Meta, which uses it for commercial purposes, including selling targeted advertisements. Meta then forwards the information (along with a data analysis) to Tower Health, which uses the information for its own commercial purposes. Meta pays Tower Health for access to this information.

Santoro and Landis are Tower Health patients. Each of them has used Tower Health’s website to “engage in communications that included individually-identifiable health information about his [or her] past, present, or future health conditions, including requests for information about specific Tower Health providers and locations, and information about specific health conditions, treatments, and medications.” App. 56. Neither Plaintiff authorized Tower Health to share that individually-identifiable health information with Meta, nor did Tower Health disclose that it would do so. And neither Plaintiff authorized Tower Health or Meta to use that information for commercial purposes. Nonetheless, Tower Health's deployment of Meta Pixel on its website captured Page 3Plaintiffs’ individually-identifiable health information and sent it to Meta to be used in the manner described above.

In 2022, Plaintiffs filed a putative class action against Tower Health and Meta for violations of a federal privacy statute and state tort laws. The claims against Meta were transferred to a different judicial district, and Tower Health moved to dismiss the complaint for failure to state a claim. Plaintiffs then amended their complaint as a matter of right, see Fed. R. Civ. P. 15(a)(1)(B), and Tower Health moved to dismiss the amended complaint. Plaintiffs obtained leave to amend again and filed their Second Amended Complaint (“SAC”). Tower Health’s third motion to dismiss followed.

In the SAC, Plaintiffs claimed that Tower Health violated the Electronic Communications Privacy Act ('ECPA'), 18 U.S.C. § 2510, et seq. , by disclosing their individually-identifiable health information (and that of all putative class members) without notice or consent, in violation of the Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d, et seq . They also claimed that Tower Health's disclosure of such information constitutes negligence and an intrusion upon their seclusion. All three of these claims were also raised in Plaintiffs' original and first amended complaints.

During oral argument on the motion to dismiss the SAC, Tower Health argued that this was Plaintiffs’ “third shot” at pleading their claims and the allegations remained insufficient. App. 215. It pointed out that Plaintiffs did not allege what specific pages of Tower Health’s website they visited; whether they searched for anything and, if so, what search terms they entered; or whether they clicked on a button to go to the patient portal. The company argued that the District Court should dismiss the complaint with prejudice because Plaintiffs had twice amended their complaint without adding the specific allegations that each of Tower Health's motions to dismiss contended were necessary.

When the District Court turned to Plaintiffs, it opened by saying, 'Your biggest problem is the specificity of the pleadings, so let’s start there.” App. 239. Plaintiffs argued that further specifics were unnecessary; their allegation that Tower Page 4Health disseminated their individually-identifiable health information was enough to support a violation of HIPAA and thus give rise to an ECPA violation. In response, the District Court said it would 'show [Plaintiffs] [its] cards': it was struggling to discern how to write an opinion permitting this case to go to discovery based on “hypothetical” information. App. 243. It said Plaintiffs needed to “paint a picture” of what information Meta received from Tower Health. App. 245. But, based on the allegations the SAC, the District Court would only able to write that “the allegation of what the information [Meta] got is . . . blah, blah, blah.' Id.

Plaintiffs disagreed, arguing that all individuallyidentifiable health information is protected under the statute. After a lengthy exchange, Plaintiffs’ counsel told the District Court: “[I]f you’re inclined to insist that we need to say our plaintiffs looked for information about a torn ACL or a heart attack or a bunion, we're able to do that and we'd like an opportunity to do that if Your Honor thinks that will advance the litigation or inform the claims in some way.” App. 259. But counsel, “again, emphasize[d]” that such amendment was unnecessary as a matter of law. Id.

The District Court immediately clarified that its concern was broader than Plaintiffs’ failure to allege the specific health conditions they looked into on Tower Health's website. Rather, the District Court said the complaint lacked detail about “the scope of the information” Plaintiffs shared. Id. By way of example, the District Court said, '[I]t makes a difference whether we’re talking about someone who comes to the Tower Health website and, say, makes one click into the dermatology department” or “someone . . . who is a patient of Tower Health and goes into the dermatology department and reads a whole bunch of detailed information.” App. 259–60. Plaintiffs reiterated their disagreement, saying “HIPAA protects all information about medical conditions or treatment. So the one click is the same as 400 clicks.” App. 261.

Tower Health began its rebuttal argument by saying it was clear that the parties did not 'have the facts to discuss here.” App. 263. The District Court responded, “I agree with you on that.” Id.

Page 5At the conclusion of arguments, the District Court took the motion under advisement. Six weeks later, it dismissed the SAC for failure to state a claim. It reasoned that the ECPA claim turns on whether Plaintiffs adequately alleged that Tower Health intercepted communications for the purpose of violating HIPAA. The District Court recognized that HIPAA makes it a crime to knowingly disclose “individually identifiable health information to another person,' see 42 U.S.C. § 1320d-6(a)(3), and defines “individually identifiable health information' to include 'information . . . created or received by a health care provider . . . [that] [r]elates to the past, present, or future physical or mental health or condition of an individual,” see 45 C.F.R. § 160.103. But it concluded that, despite Plaintiffs’ use of those statutory phrases in the SAC, their allegations were too 'bare-bones' to state an ECPA claim. App. 9. It stated that, to survive a motion under Federal Rule of Civil Procedure 12(b)(6), Plaintiffs needed to provide specific examples of the HIPAA-protected information Meta Pixel transferred from Tower Health to Meta.

The District Court held that Plaintiffs’ tort claims fail for similar reasons: Plaintiffs did not make sufficiently specific allegations about the information they shared on Tower Health’s website. And it dismissed all claims with prejudice because Plaintiffs “had three chances to plead their claims, as well as the opportunity to provide more factual details about the information captured by the Meta Pixel at oral argument. The facts simply aren’t there, and therefore, amendment would be futile.” App. 14.

Two weeks later, Plaintiffs moved for reconsideration and attached a proposed Third Amended Complaint (“TAC”). The TAC included allegations of the Tower Health URLs Plaintiffs visited, including URLs for specific healthcare practitioners. It did not allege which health conditions Plaintiffs searched on Tower Health’s website. But it alleged that, after Plaintiffs submitted private information to Tower Health, they began receiving ads on Facebook (Meta’s social media platform) related to their medical conditions and treatments, and they provided examples of the conditions and treatments that were the subject of the ads.

Page 6The District Court denied the motion on the grounds of undue delay in seeking to further amend the complaint. Plaintiffs timely appealed.

Before turning to the merits, we must assure ourselves that the District Court had subject matter jurisdiction. See Seneca Res. Corp. v. Township of Highland , 863 F.3d 245, 252 (3d Cir. 2017). To that end, we directed the parties to address Plaintiffs’ Article III standing in light of our opinion in Cook v. Gamestop, Inc. , 148 F. 4th 153 (3d Cir. 2025). We are satisfied that Plaintiffs’ allegations support Article III standing for each of their claims.³

Here, as in Cook , only one element of standing is in question: injury in fact. See id . at 157. “To establish injury in fact, a plaintiff must show that he or she suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.' Spokeo, Inc. v. Robins , 578 U.S. 330, 339 (2016) (citation modified). Intangible harms—like those caused by a violation of a privacy statute—can give rise to “concrete” injuries. See In re BPS Direct, LLC; Cabela’s, LLC Wiretapping Litig. , 175 F.4th 423, 432–34 (3d Cir. 2026). To determine whether they do, we ask whether plaintiffs “have identified a close historical or common-law analogue for their asserted injury,' and we “compar[e] the kind of harm a plaintiff alleges with the kind of harm caused by a comparator tort at common law.” Id. at 429 (citation modified).

Page 7Here, for purposes of their ECPA and tort claims, Plaintiffs analogize their injury to that addressed by commonlaw intrusion upon seclusion. Under that common-law tort, '[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.' Restatement (Second) of Torts § 652B (1977) (“Second Restatement § 652B”). “[T]he harm arises when a defendant has 'invaded a private seclusion that the plaintiff has thrown about his person or affairs.’” BPS Direct , 175 F.4th at 432 (quoting Second Restatement § 652B cmt. c). And “[w]hen the harm is based on an intrusion into a plaintiff’s affairs, those affairs must (at least plausibly) be private.” Id. at 432 .

In BPS Direct , we held that the surreptitious viewing of the plaintiffs' complete credit card or debit card numbers caused an injury analogous to the harms vindicated by the intrusion-upon-seclusion tort. Id. at 433-34. We explained that that information is 'rightly viewed as highly sensitive,' and individuals expect it to be free from prying eyes. Id. at 433. The same is true of health conditions, treatments, and medications that a patient communicates to her healthcare provider.

We have long recognized that '[i]nformation about one’s body and state of health is matter which the individual is ordinarily entitled to retain within the private enclave where he may lead a private life.” United States v. Westinghouse Elec. Corp. , 638 F.2d 570, 577 (3d Cir. 1980) (citation modified); see also Doe v. Delie , 257 F.3d 309, 315 (3d Cir. 2001) (recognizing “the individual interest in avoiding disclosure of personal matters” such as “one’s medical information” (citation modified)). Additionally, patients have an 'imperative need for confidence and trust' in their private communications with healthcare providers about their health conditions. See Trammel v. United States , 445 U.S. 40, 51 (1980). Given these privacy interests, Plaintiffs alleged an injury analogous to that vindicated by common-law intrusion upon seclusion when they alleged that (1) they are patients of healthcare provider Tower Health, (2) they shared information about their “specific health conditions, treatments, and Page 8medications' with Tower Health, App. 56, and (3) Tower Health, by using Meta Pixel, shared Plaintiffs' individuallyidentifiable health information with Meta.⁴

Tower Health argues that Plaintiffs needed to identify the specific information they revealed to Tower Health (and Tower Health revealed to Meta) to establish a concrete injury. We disagree. Plaintiffs alleged that, in their capacity as patients of Tower Health, they shared their health information with their healthcare provider, which then shared that individually-identifiable health information with Meta without Plaintiffs’ authorization. Because patients expect the medical information they share with their healthcare providers to remain private, a provider's surreptitious disclosure of a patient’s confidential medical information is analogous to the kind of harm caused by an intrusion upon seclusion. See Barclift v. Keystone Credit Servs., LLC , 93 F.4th 136, 145 (3d Cir. 2024). That suffices to establish standing.⁵

Tower Health also argues that Plaintiffs cannot analogize to the intrusion-upon-seclusion tort where they voluntarily communicated their health information to Tower Page 9Health. But Plaintiffs’ voluntary disclosure to Tower Health is beside the point. Plaintiffs alleged that they did not authorize Tower Health to disclose their health information to Meta . Tower Health’s decision to share that private information gave rise to Plaintiffs’ injury.

Although Plaintiffs challenge the District Court’s dismissal order, their argument is narrow. They do not contend that any claims in the SAC withstand Rule 12(b)(6) scrutiny. Instead, they challenge only the District Court's decision to dismiss the SAC with prejudice .

But Plaintiffs did not properly request leave to amend the SAC before the District Court dismissed it. To do so, they needed to 'submit a draft amended complaint to the court.' Fletcher-Harlee Corp. v. Pote Concrete Contractors, Inc. , 482 F.3d 247, 252 (3d Cir. 2007). Their conditional remarks during oral argument did not come close to satisfying this 'settled rule” that applies to non-civil-rights cases. Id. at 253. Moreover, during oral argument Plaintiffs gave no indication they might be capable of amending their complaint in a manner the District Court might find adequate. True, they posited that they could allege the nature of the health conditions they shared on Tower Health’s website (while maintaining that they should not need to do so). But when the District Court said the specific health conditions alone would not suffice, Plaintiffs never said they had additional facts that could satisfy the District Court’s concerns. So there was no reason for the District Court to believe further amendment was possible. See App. 24 (explaining the District Court dismissed the SAC with prejudice because “[P]laintiffs d[o] not have the facts or simply d[o] not want to provide them”). The District Court did not abuse its discretion when it dismissed the SAC without leave to amend.

Page 10Nonetheless, after the dismissal, Plaintiffs moved for reconsideration and attached their proposed TAC. The District Court construed their motion as one seeking relief pursuant to Federal Rule of Civil Procedure 59(e). Under that rule, after a complaint is dismissed with prejudice, a plaintiff “may seek to amend the complaint (and thereby disturb the judgment).” Id. at 252. So when a plaintiff files a timely Rule 59(e) motion “seek[ing] to reopen the judgment and amend the complaint, . . . leave to amend . . . should . . . ‘be freely given when justice so requires,’” per Federal Rule of Civil Procedure 15. Id. at 253 (quoting Fed. R. Civ. P. 15(a)); Cureton v. Nat’l Collegiate Athletic Ass’n , 252 F.3d 267, 272 (3d Cir. 2001) ('Where a timely motion to amend judgment is filed under Rule 59(e), the Rule 15 and 59 inquiries turn on the same factors.”). And Rule 15’s “admonition that leave to amend should be freely given 'when justice so requires'' incorporates a district court's discretion to deny leave to amend based on undue delay, bad faith, dilatory motives, futility, or prejudice to the non-moving party. See United States ex rel. Customs Fraud Investigations, LLC. v. Victaulic Co ., 839 F.3d 242, 249 (3d Cir. 2016) (quoting Fed. R. Civ. P. 15 (a)(2)).

The District Court denied leave to amend based on undue delay. It explained that Plaintiffs were 'rel[ying] on facts that could have been pled much earlier,” and “Plaintiffs had ample notice that their description of the personal health information allegedly intercepted by Tower Health lacked necessary detail.” App. 22. As support for Plaintiffs’ notice of the pleading deficiencies, the District Court pointed to (1) Tower Health’s arguments about those deficiencies in all three of its motions to dismiss, (2) the focus of oral argument on the motion to dismiss the SAC, and (3) other district courts' dismissals of similar Meta Pixel claims.⁷ It also noted that Plaintiffs had already amended their complaint twice, and Plaintiffs did not request leave to further amend after oral argument. Further, the District Court recounted that, during oral argument, the only specific information Plaintiffs offered to provide was the nature of the health conditions about which they sought information on Tower Health’s website—an offer Page 11the District Court promptly characterized as insufficient to address its concerns.

We begin with the three reasons why the District Court believed Plaintiffs had notice of the pleading deficiencies. The District Court’s first and third reasons, individually or jointly, do not support that conclusion. After all, absent any input from the court, a defendant's arguments do not put a plaintiff on notice that the court will find a complaint deficient. And though Tower Health thrice argued that Plaintiffs’ complaints were deficient, the District Court gave no input whatsoever until after Plaintiffs filed their SAC. A court may not penalize plaintiffs for declining to alter their pleadings based solely on their opponent's arguments-persistent as those arguments may be. See Victaulic , 839 F.3d at 249–50.

Similarly, Plaintiffs were not on notice of their pleadings’ deficiencies because other district courts dismissed similar pleadings in other cases. To state the obvious: Other district courts’ rulings in other cases do not bind the parties or the District Court in this case. And the District Court did not cite a single appellate court opinion (let alone an opinion of this Court) that aligned with the reasoning of those other districtcourt dismissals. So even assuming the other dismissal rulings the District Court referenced were relevantly similar, they did not put Plaintiffs on notice that their complaint was likely to be dismissed with prejudice. Even when combined with Tower Health’s arguments, those other courts’ rulings did not provide Plaintiffs adequate notice.

By contrast, the oral argument in this case did notify Plaintiffs that the District Court viewed their allegations as deficient.

We have observed that judges often make comments and ask questions in court that do not provide 'a clear indication of the court’s views or how a case will eventually be decided.' See Victaulic , 839 F.3d at 250. And we do not expect plaintiffs 'to pick, from dozens of questions and statements over the course of a hearing, those questions that signal what the court will ultimately decide.' Id. So it remains true that, “[i]n the context of a typical Rule 12(b)(6) motion, a plaintiff is unlikely to know whether his complaint is actually Page 12deficient-and in need of revision-until after the District Court has ruled” on the motion. Id. Plaintiffs do not need to request leave to amend based on statements in an oral argument that “were not a ruling, a holding, or an explanation of how the court intend[s] to rule.' Id .

But there are exceptions to the general rule that a judge's comments from the bench do not provide plaintiffs with notice that their claims are likely to be dismissed with prejudice. See id. ('This is not to say that a plaintiff will never be on notice of potential deficiencies based on a motion to dismiss or comments from the bench.”). This case presents one such exception.

During oral argument, the District Court made its views of the SAC abundantly clear. Time and time again, it said the SAC lacked specificity about the scope of the privacy invasion Plaintiffs alleged. It even said it was “showing [Plaintiffs] [its] cards': It did not know how to write an opinion permitting Plaintiffs' claims to go to discovery. App. 243. And it expressly agreed with Tower Health’s comment that Plaintiffs’ factual allegations were lacking.

Upon reviewing the record, we are convinced the District Court provided Plaintiffs an “explanation . . . of how the court intended to rule.” Victaulic , 839 F.3d at 250. So, unlike in a more typical case, it was reasonable for the District Court to expect Plaintiffs to understand they were “in danger of having [their] entire suit dismissed with prejudice were [they] not to move to amend [their] complaint [promptly] after argument, instead of [promptly] after the decision came down.” Id. Yet Plaintiffs did not promptly request leave to further amend after oral argument. Indeed, they made no attempt to amend until eight weeks later—two weeks after the District Court issued the ruling it forecast to Plaintiffs during oral argument.⁸ Plus, Plaintiffs had already amended their Page 13complaint twice, albeit without guidance from the District Court. Cf. Victaulic , 839 F.3d at 250 (“We have rarely upheld a dismissal with prejudice of a complaint when the plaintiff has been given no opportunity to amend.”). On this record, it was not an abuse of discretion to find that Plaintiffs unduly delayed seeking leave to amend.

We pause here to clarify how our precedent guides today's decision. In In re Adams Golf, Inc. Securities Litigation , we observed that plaintiffs “relied at their peril” on the possibility of adding additional information to their complaint where the information was available earlier. 381 F.3d 267, 280 (3d Cir. 2004). We made a similar observation in Jang v. Boston Scientific Scimed, Inc . when we said our Court 'has declined to reward a wait-and-see approach to pleading.” 729 F.3d 357, 368 (3d Cir. 2013). But three years later, we clarified in Victaulic that courts should not rely on Jang ’s dictum about a wait-and-see approach. 839 F.3d at 252 (describing reliance on that language from Jang as “misplaced” because the language had “no practical import” in Jang ). We also observed that a typical plaintiff facing a Rule 12(b)(6) motion “is unlikely to know whether his complaint is actually deficient-and in need of revision-until after the District Court has ruled” on the motion. Id. at 250. And we noted that the denial of leave to amend in Adams Golf was based on undue delay and futility ( i.e. , “the proposed Second Amended Complaint . . . did not contain new material allegations”), and the district court in Adams Golf had previously permitted one amendment. Id. at 252.

While a district court’s exercise of discretion in applying Rule 15 eschews firm rules, in this Circuit we do not require plaintiffs to read tea leaves to discern whether their pleadings are deficient. So, absent a clear indication from the Page 14district court presiding over his case, a plaintiff need not accede to their opponents’ arguments about pleading deficiencies or presume that the district court will agree with other district courts' rulings in similar cases. Id . at 250.

It remains true that, in a 'typical' case, 'a plaintiff is unlikely to know whether his complaint is actually deficient— and in need of revision-until after the District Court has ruled' on a Rule 12(b)(6) motion. Id. at 250. But some records demonstrate that the plaintiff received a pre-ruling 'clear indication” that the district court found their complaint deficient. Id. In such a case, a plaintiff who wishes to amend based on facts available to him shall seek leave to do so promptly after receiving the clear indication. See id. He fails to do so at his peril, see Adams Golf , 381 F.3d at 280, particularly if he has previously amended his complaint, cf. Victaulic , 839 F.3d at 250.

All this shows that the District Court did not abuse its discretion when it denied leave to file the TAC because of undue delay.

Of course, Plaintiffs were entitled to stand by the position they took at oral argument. If they were convinced that the SAC stated a claim as a matter of law, they had a clear avenue to challenge the District Court's contrary view: On appeal, they could have argued that the SAC's allegations withstand a Rule 12(b)(6) motion. They could have done so even after the District Court denied their motion to file a TAC. Puzzlingly, Plaintiffs opted not to raise that argument in their appellate brief. Thus, we take no position on whether the SAC stated a claim upon which relief could be granted.

Because the District Court did not abuse its discretion when it dismissed the SAC with prejudice or when it denied the Rule 59 motion that sought to reopen the judgment and amend the complaint, we will affirm both orders.

* * * For the foregoing reasons, we will AFFIRM the District Court’s orders dismissing the Second Amended Complaint and denying Plaintiffs’ motion for reconsideration.

Page 15Counsel for Appellants

David J. Cohen [Argued] James B. Zouras STEPHAN ZOURAS

Counsel for Appellee Tower Health

Michael E. Rayfield [Argued] SHOOK HARDY & BACON