A federal settlement moving through North Carolina courts reveals how one of America's largest laboratory testing companies allegedly harvested sensitive personal data from millions of website visitors without compensation to those affected.
Labcorp, which serves roughly half the country's physicians, faces allegations that it violated wiretapping laws in California and Pennsylvania by deploying third-party tracking technologies to intercept and record search queries users entered on its website between May 2021 and April 2026. The company denies wrongdoing but has agreed to settle rather than litigate, according to filings in U.S. District Court for the Middle District of North Carolina.
The settlement is unusual because it involves no monetary damages. Instead, Labcorp has agreed only to modify how it deploys tracking technologies on its website going forward.
Settlement class members — everyone who searched Labcorp's site during that five-year window — cannot opt out. Yet they receive no monetary recovery and surrender their right to sue for damages related to the allegations. In exchange, they get Labcorp's promise to stop the alleged conduct.
The arrangement reflects a troubling pattern in technology and data-related litigation. When companies face allegations of mass privacy violations, settlements increasingly feature injunctive relief divorced from compensation. It allows corporations to absorb legal liability without absorbing financial consequences.
Plaintiffs claim Labcorp's website employed third-party tracking technologies — likely cookies, pixels or similar surveillance mechanisms — that intercepted search queries. California's wiretapping law and Pennsylvania's comparable statute are among the nation's strictest privacy protections. Advocates have increasingly applied them to digital surveillance, arguing that intercepting digital communications deserves the same legal protection as phone calls.
The deployment of such technologies on a healthcare company's website would be particularly concerning. Searches for sensitive health information occur in moments of vulnerability, and the data generated is intimate. Third parties — marketing firms, data brokers, technology platforms — could potentially access it without users' clear notice or meaningful consent.
Key questions remain unanswered in public filings. What third parties received access to search data? How was it used? Did it influence marketing, pricing or insurance decisions? Were there data breaches? How many people were affected? Discovery remains largely confidential, keeping the public record thin.
The settlement's path forward includes a final approval hearing where the federal court will weigh whether the arrangement is "fair, reasonable, and adequate." Settlement class members have until Nov. 23, 2026, to file objections.
What's particularly striking is the broader absence of enforcement action. State attorneys general, California's privacy regulators, Pennsylvania's consumer protection authorities and the Federal Trade Commission have not moved against Labcorp, despite their authority over unfair data practices.
If approved, the settlement will not recover lost privacy or compensate those affected. It will not recover data already in circulation through third-party networks. It primarily ensures Labcorp modifies its website practices, a requirement the company might have faced through regulatory action or public pressure.
The settlement includes a claims website and settlement administrator hotline for those seeking information. But there is no money to claim.
