The main allegation is that Costco lets Meta collect communications related to health care from its website, violating HIPAA and effectively acting as a wiretap of the customer.
The first lawsuit was news earlier in October, and the new one from the 25th appears to be similar. Links to first suit:
This makes the most sense to me. I’d bet that some code was applied to their whole site, instead of everything except the pharmacy.
Their website isn’t exactly sophisticated, so I wouldn’t be surprised if this was a mistake. It still shouldn’t have happened.