A class action lawsuit has been filed against Facebook and seven cancer institutes that claims the social media giant spied on users who divulged private health information on cancer institute websites and then used that data for advertising purposes.

Lead plaintiff Winston Smith claims that the websites features a secret “Facebook code” that “commandeers” users’ browsers and sends private info to the site. Smith also says that Facebook uses this data to create marketing profiles for users, which allows it to target them with advertising.

This is an explosive claim, and Facebook has already said that the lawsuit is without merit. However, Smith cites a chart in his complaint that Facebook uses to sell advertising services. This chart places more than 225 million users into 150 separate medical categories, including diabetes, pregnancy, addiction, erectile dysfunction and HIV/AIDS.

“Facebook’s application for advertisers touts its ability to target users based on information Facebook has collected about them relating to health care,” the complaint states. “Plaintiffs are not aware of the total revenue Facebook derives from these lists, but, upon information and belief, avers that per-user revenue for each medical list significantly exceeds the average per-user revenue for non-medical lists.”

This lawsuit might be reaching a little far, but it still raises an interesting and valid question—should Facebook know so many intimate details about us?