Washington Supreme Court Rejects Privacy Act Claim Over Hospital Website Tracking Pixel: Implications for Businesses Operating Public-Facing Websites

In a significant win for businesses facing the wave of pixel-tracking and “wiretap” class actions, the Washington Supreme Court in Baker v. Seattle Children’s Hospital held that the Washington Privacy Act (WPA) does not reach a website operator’s use of third-party tracking technology to capture a visitor’s searches and clicks on a public website. The Court reasoned that the WPA protects only private communications “between two or more individuals,” and a website visitor’s interaction with an automated website maintained by a corporation does not qualify.

Orrick submitted an amicus brief on behalf of Interactive Advertising Bureau (IAB) that supported the outcome arrived at by the Washington Supreme Court. 

The Dispute: Third-Party Web Analytics Tools on Websites

The WPA, RCW 9.73.030(1)(a), makes it unlawful for any “individual, partnership, corporation, association, or the state of Washington” to intercept or record a “[p]rivate communication transmitted by telephone, telegraph, radio, or other device between two or more individuals” without first obtaining the consent of all participants. Washington is one of the few states that requires all-party consent to record a private communication.

The plaintiffs, parents of patients at Seattle Children’s Hospital (SCH), filed a putative class action alleging that SCH’s public website used Meta Pixel—free software that tracks visitors’ clicks, text searches, and page views and sends that data to Meta, which links it to users’ Facebook or Instagram accounts for targeted advertising. For example, the complaint alleged that when a visitor typed “depression” into the website’s search bar, Pixel relayed that search to Meta. SCH’s website displayed a cookie pop-up disclosing the use of software to assist in marketing, but it did not identify Pixel or explain how Pixel collects and uses data.

The trial court dismissed the WPA claim with prejudice. The Court of Appeals affirmed, reasoning that the plaintiffs’ searches were not “private communication[s]” because they were unilateral rather than a “back-and-forth” exchange of information. The Washington Supreme Court granted review.

The Decision: No Individual-to-Individual Communication Between a Website Visitor and a Corporation’s Automated Website or Systems.

The Court affirmed on a different ground, focusing on the statutory phrase “between two or more individuals.” Writing for the majority, Justice Angelis observed that RCW 9.73.030(1) uses the term “individual” twice and lists “individual[s]” separately from partnerships, corporations, associations, and the State. Applying the presumption that different terms in the same statute carry different meanings, the Court concluded that “individual” does not encompass those other entities.

Because SCH is a corporation and each alleged communication involved only one plaintiff and a fully automated system SCH owns and operates, only one “individual” was party to each communication, and the WPA claim failed as a matter of law. The Court rejected the plaintiffs’ argument that corporate liability under the statute implies corporate participants are covered, explaining that the legislature could have protected communications between two or more “persons” but did not.

Two questions were left open. First, having resolved the case on the “two or more individuals” element, the majority did not decide whether website searches and clicks can constitute a “private communication.” Second, the Court expressly reserved whether the WPA would apply when a covered entity communicates through individuals.

Key Takeaways and Open Questions

• Automated website interactions fall outside the WPA. Under the majority’s plain-text reading, a user’s searches and clicks that generate automated responses from a corporate website are not communications “between two or more individuals,” which should foreclose WPA claims premised on standard analytics and advertising pixels on public-facing websites.
• Human-to-human channels remain a risk. The majority reserved whether the WPA reaches communications with a company’s personnel, and the concurrence would extend protection to messages sent to clinical staff, voicemail, or internal messaging systems. Live chat, messaging, and patient-portal features warrant continued attention.
• The “private communication” question is unresolved. At least one justice would treat website queries about health conditions as private communications, so plaintiffs may test that theory in cases involving different facts.
• Other theories remain available. The plaintiffs did not appeal dismissal of their Consumer Protection Act, Uniform Health Care Information Act, and common-law claims, and the Court did not address them. Businesses should continue to evaluate tracking practices under Washington’s other privacy laws and under federal and other states’ wiretap statutes.

The Orrick team included Aravind Swaminathan, Marc Shapiro, Ned Hirschfeld and Ian Hawkes. The case is Baker v. Seattle Children’s Hospital, No. 104590-5 (Wash.). If you have questions about how this decision may affect your business, please reach out to the team or your Orrick contact.