Hand & Stone Spa Class Action, Spa Chain Shared Health Data With Google, Meta, and TikTok—Here’s How to File Your Privacy Claim

A federal class action lawsuit filed in January 2026 accuses Hand & Stone Franchise LLC of violating customer privacy by sharing confidential health information with Google, Meta, and TikTok without proper consent. Plaintiff Lauren Wolf claims the spa franchise embedded third-party tracking technologies on its website that transmitted sensitive health-related service selections and appointment activity to major tech platforms for marketing purposes.

The lawsuit, filed in the U.S. District Court for the Eastern District of Pennsylvania, alleges Hand & Stone violated the Health Insurance Portability and Accountability Act (HIPAA) and multiple state privacy laws by designing its website to require users to submit private information—then secretly sharing that data with technology companies.

What Hand & Stone Allegedly Shared

According to the complaint, Hand & Stone embedded tracking pixels and software development kits from Facebook (Meta), Google, TikTok, and Amazon on its website and mobile app. These tools allegedly transmitted information entered by users, including health-related service selections like massage therapy for chronic pain, facial treatments for skin conditions, and other wellness services.

The lawsuit claims the data shared included personal identifiers such as IP addresses, precise location data, and device information that could be linked to users’ existing social media or technology accounts. This allowed health-related activity to be associated with identifiable individuals—creating detailed profiles of customers’ health concerns and treatment preferences.

Wolf argues that by connecting spa visit data with social media profiles, Hand & Stone enabled tech companies to serve targeted advertisements based on customers’ private health information. Someone researching massage therapy for back pain might suddenly see ads for chiropractors, pain medication, or disability services across their Facebook, Google, and TikTok feeds.

The Privacy Violation Allegations

The class action complaint asserts several legal violations. First, Wolf claims Hand & Stone violated HIPAA by disclosing protected health information to third parties without written authorization. HIPAA requires healthcare providers and related businesses to safeguard patient information and obtain explicit consent before sharing medical data.

Second, the lawsuit alleges violations of various state privacy laws and consumer protection statutes. Many states have enacted biometric privacy laws and data protection regulations that require companies to inform users about data collection practices and obtain consent before sharing personal information with third parties.

Third, Wolf argues Hand & Stone ignored numerous warnings from federal regulators about the privacy risks of using third-party tracking technologies on websites that collect health information. The Federal Trade Commission has issued multiple enforcement actions against companies that installed tracking pixels on pages where users submit medical or health-related data.

Similar privacy concerns emerged in the SNHU class action lawsuit students sue over GPA data shared with TikTok and Google, where students alleged their educational institutions secretly transmitted sensitive academic and personal information to technology platforms through embedded tracking tools.

Who May Be Affected

The lawsuit seeks to represent a nationwide class of Hand & Stone customers who used the company’s website or mobile app to research treatments, schedule consultations, book appointments, or manage membership accounts. If you’ve ever visited HandAndStone.com or used the Hand & Stone mobile app, your information may have been transmitted to Google, Meta, TikTok, or Amazon.

Hand & Stone operates over 500 franchise locations across the United States, serving millions of customers annually. The tracking technologies allegedly remained active on the website and app for an extended period, potentially affecting anyone who interacted with Hand & Stone’s digital platforms during that time.

You don’t necessarily need to have purchased spa services or become a member to be included in the class. Simply visiting the website and entering information to browse services, check pricing, or explore treatment options may qualify you if that data was transmitted to third-party tech companies.

What Happens Next in This Lawsuit

Wolf demands a jury trial and requests injunctive relief to prevent Hand & Stone from continuing to gather and misuse customer information. She also seeks an award of unspecified monetary damages for herself and all class members.

The case is in its earliest stages. Hand & Stone has not yet publicly responded to the allegations. As the litigation proceeds, the court will determine whether to certify a class action, allowing all affected customers to participate in the lawsuit collectively.

Discovery will reveal exactly what information Hand & Stone shared, with which companies, for how long, and whether the company took steps to protect customer privacy. Internal communications and technical evidence will show whether Hand & Stone knew about the tracking technologies and understood the privacy implications.

Precedents in Health Data Privacy Cases

Several recent cases demonstrate growing judicial scrutiny of companies that share health information with tech platforms through tracking pixels. California federal courts have allowed similar lawsuits against healthcare providers and wellness companies to proceed, recognizing that consumers have a reasonable expectation of privacy when submitting health data online.

The Temu lawsuits explode in 2025 multiple states lawsuits over data-theft business allegations illustrate how courts increasingly hold companies accountable for unauthorized data collection and sharing practices that violate consumer privacy expectations.

A 2022 case against the University of California system over similar tracking pixel violations resulted in the university removing tracking tools from student portals. Multiple universities settled lawsuits in 2023-2024 over sharing student data with Facebook and Google through tracking pixels on financial aid pages.

These precedents suggest courts are willing to allow privacy cases to proceed when plaintiffs demonstrate companies installed tracking technologies that transmitted sensitive personal or health information to third parties without proper disclosure or consent.

Frequently Asked Questions

How do I know if my information was shared?

If you used Hand & Stone’s website or mobile app to browse services, schedule appointments, or manage your account, your information may have been transmitted to Google, Meta, TikTok, or Amazon. Watch for official class action notices as the case progresses.

Do I need to hire a lawyer to participate?

No. Class action lawsuits allow affected individuals to participate without hiring their own attorneys. If the case is certified as a class action and reaches a settlement, you’ll receive instructions on how to file a claim.

What compensation could I receive?

It’s too early to determine potential compensation amounts. Privacy class action settlements vary widely depending on the number of affected individuals, severity of violations, and whether plaintiffs can demonstrate concrete harm from the data sharing.

How long will this lawsuit take?

Class action lawsuits typically take 1-3 years from filing to settlement or trial verdict. The case was just filed in January 2026, so expect a lengthy legal process before any resolution.

Can I still use Hand & Stone services?

Yes. The lawsuit doesn’t prevent you from visiting Hand & Stone locations or using their services. However, you may want to review their privacy policies and be cautious about what information you submit through their website or app.

What should I do if I’m affected?

Monitor your email and mail for official class action notices from the court or settlement administrator. Keep records of your Hand & Stone account, appointment history, and any communications from the company. Consider reviewing what information you’ve shared through their digital platforms.

Are other spas facing similar lawsuits?

Many health and wellness companies face scrutiny over tracking pixel usage. Several healthcare providers, telehealth platforms, and wellness apps have settled similar privacy claims over sharing patient information with tech companies through embedded tracking tools.

Last Updated: January 21, 2026

Disclaimer: This article provides general information only and does not constitute legal advice.

Have you used Hand & Stone’s website or app? Share your privacy concerns in the comments below or contact a consumer protection attorney to discuss your legal rights.

Stay informed, stay protected. — AllAboutLawyer.com

About the Author

Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah