By Nicholas Iovino, Courthouse News Service

SAN JOSE, Calif. (CN) - Facebook spied on users that relayed private health information on the websites of major cancer institutes and harvested the data to generate advertising profits, users claim in a new class action.

Lead plaintiff Winston Smith sued Facebook, the American Cancer Society, the American Society of Oncology and five other cancer institutes in Federal Court on Wednesday.

Websites for the medical institutes feature a secret "Facebook code" that "commandeers" users' web browsers and sends private information to the social media giant, Smith claims in his 92-page complaint.

"This lawsuit is without merit, and we will defend ourselves vigorously," a Facebook spokeswoman said in an email Wednesday afternoon.

Smith says Facebook uses the private health data it obtains to create marketing profiles for each user, and then targets them with tailored advertisements based on their private information.

A person's health condition is the second most valuable piece of personal data sought after on the web behind login credentials and passwords, according to a 2015 study on web privacy and security cited in the complaint.

The social media giant earned nearly $11.5 billion in advertising revenue in 2014, according to the suit.

When Smith searched for information on lung cancer at the American Cancer Society's website cancer.org, the information he sought and links he clicked were sent to Facebook without his knowledge or consent, he says.

The lawsuit cites a chart Facebook uses to sell advertising services, which places more than 225 million users in 154 separate medical categories for direct marketing purposes.

"Facebook's application for advertisers touts its ability to target users based on information Facebook has collected about them relating to health care," the complaint states.

Facebook's medical-categories list identifies users associated with a wide range of medical conditions, including diabetes, pregnancy, addiction, hepatitis C, HPV, erectile dysfunction, herpes simplex virus and HIV/AIDS.

"Plaintiffs are not aware of the total revenue Facebook derives from these lists, but, upon information and belief, avers that per-user revenue for each medical list significantly exceeds the average per-user revenue for non-medical lists," Smith claims in the complaint.

Smith says Facebook does not disclose in its data and privacy policies that it tracks, collects and intercepts users' sensitive medical information and communications.

Although he contends the medical institutes are "aware of Facebook's ubiquitous presence on the Internet," Smith says he does not know if the cancer institutes knew of or profited from the social media giant's harvesting of personal health information.

Facebook's tracking of private health data does not occur on most medical websites, Smith says.

Websites for the Mayo Clinic and John Hopkins Medicine feature a small Facebook icon on nearly every page, but those sites don't allow Facebook to track users' activities, according to the suit.

Smith says the American Cancer Society and other institutes named in the lawsuit should have disclosed their relationships with Facebook or informed users that their private health information would be shared with the social media titan.

An American Cancer Society spokeswoman declined to comment on the pending litigation.

The complaint cites 10 causes of action against Facebook and the seven cancer institutes, claiming they failed to safeguard plaintiffs' private health information under the Health Insurance Portability and Accountability Act (pdf), Wiretap Act and other state and federal laws.

Smith seeks class certification, damages, restitution and a permanent injunction to stop the defendants from tracking or disclosing the private health information of Facebook users.

The plaintiffs are represented by Jeffery Koncius of Kiesel Law in Beverly Hills.

Other defendants named in the class action include the Melanoma Research Foundation, Adventists Health System, BJC Healthcare, Cleveland Clinic and University of Texas MD Anderson Cancer Center.

In October 2015, a federal judge dismissed a class action claiming Facebook broke privacy laws by tracking users' Internet activities after they logged out of their Facebook accounts.

To Learn More:

Is Facebook’s “Faceprint Database” Illegal? (by Noel Brinkerhoff and Steve Straehley, AllGov)

For Data Miners, Little Kids are Big Business (by Noel Brinkerhoff and Steve Straehley, AllGov)

In Facebook Privacy Case, Lawyers Gain Millions, while Plaintiffs get Nothing (by Noel Brinkerhoff, AllGov)