The plaintiffs' class action bar has spent years pressing state wiretap statutes into service against website tracking pixels, with California's Invasion of Privacy Act (CIPA) carrying most of the load and other all-party consent states drawing attention as copycat vehicles. The Washington Supreme Court recently closed one of those doors. In Baker v. Seattle Children's Hospital, No. 104590-5, 2026 WL 3023818 (Wash. Oct. 8, 2026), the court held that the Washington Privacy Act's (WPA) wiretapping prohibition, Wash. Rev. Code § 9.73.030(1)(a), does not reach a hospital's use of the Meta Pixel on its public website, because the statute protects only private communications "between two or more individuals" and a visitor's clicks and searches that trigger an automated server response involve only one.
Why It Matters
The ruling removes Washington's all-party consent wiretap statute from the plaintiffs' toolkit for the most common website pixel tracking claim – browser-side pixels, cookies, and analytics scripts on static public pages – substantially reducing WPA class action exposure for public-facing website operators. The court's reasoning is simple and consequential: The WPA protects only private communications "between two or more individuals," and a visitor's clicks and search queries that trigger an automated response from a corporate website involve only one individual.
The decision does not, however, make website pixel tracking tools lawful in Washington, and it does leave open several exposure points – namely, human- and AI-mediated channels like patient portals, live chat, and secure messaging. It also does not reduce exposure under Washington's My Health My Data Act (MHMDA), Consumer Protection Act (CPA), Uniform Health Care Information Act (UHCIA), or common law privacy theories, none of which turn on a two-party communication.
The decision narrows one theory; it is not license to relax website pixel tracking technology governance.
The Decision
The plaintiffs alleged that when visitors typed a medical-related term, such as "depression," into the search bar on Seattle Children's Hospital's (SCH) public website, the Meta Pixel sent a copy of the request to Meta, together with cookies that allowed Meta to serve targeted advertising. SCH's cookie pop-up did not identify the Pixel, and its privacy notice promised not to share health information beyond enumerated disclosures, none involving advertising.
The Washington Supreme Court affirmed dismissal of the WPA claim. Wash. Rev. Code § 9.73.030(1) lists "any individual, partnership, corporation, [or] association" as potential violators, but subsection (1)(a) protects only communications "between two or more individuals." The court reasoned that because the legislature used different terms in the same statute, an "individual" is not a corporation. Each alleged communication involved one plaintiff and "a fully automated system SCH owns and operates," so the WPA claim failed as a matter of law.
Equally important is what the majority left open. It expressly declined to decide whether the plaintiffs' searches were "private communications" at all, and, acknowledging that corporations "will often, of course, communicate through individuals," it reserved whether the WPA reaches such communications. Two justices concurred in the result only. They would have held that health-related clicks and searches can be private communications – and that the plaintiffs sufficiently alleged them. They also rejected any "corporate carveout," reasoning that a corporation acts only through individuals, so a patient's message to clinical staff or a voicemail left for a provider would be protected. In the concurrence's view, dismissal was proper only because the plaintiffs' queries were directed to "a server that returned stored content and not at another individual." The concurrence pointedly added that the undefined term "individual" "may well include more than a natural person" and that the WPA's application "to a system that does more than return stored content" was not before the court.
Analysis and Takeaways
A Clear Win on Website Pixel Tracking, Confined to Its Facts
The court's holding delivers a dispositive, pleading stage defense to WPA claims premised on pixels, tags, and analytics scripts on static public web pages, and because the holding rests on the phrase "between two or more individuals," it cannot be pleaded around with more detail about what the code captured. Yet the majority's silence on whether a search is a "private communication," combined with the concurrence's affirmative answer, leaves the WPA's reach undefined. A complaint alleging that an employee actually received the plaintiff's input – a staffed chat window, a contact form routed to a scheduling desk – would present the question not addressed in the opinion as to whether such communications are protected.
The AI Question is Coming
The concurrence's observation that "individual" may extend beyond natural persons, together with its reservation of systems that "do more than return stored content," all but invites a test case involving conversational AI. A generative chatbot that interprets a visitor's health question and composes a tailored response is not a server returning stored content; whether it is an "individual" is a question of first impression.
The State Wiretap Statute Retreat is Accelerating
The Washington decision comes eight days after California's governor signed SB 690, which amends CIPA § 637.2 so that a § 638.51 pen register claim arising from website or app conduct may be brought only by the Attorney General, beginning January 1, 2027. Together, the two developments signal a budding convergence of judicial and legislative sentiment that wiretap statutes are the wrong instrument for regulating web analytics.
The Exposure Shifts; It Does Not Disappear
Plaintiffs' counsel will re-plead health care and sensitive data tracking cases under theories unaffected by the ruling. Washington's MHMDA requires opt-in consent to collect or share "consumer health data" and separate authorization to sell it, and is privately enforceable through the CPA, which authorizes treble damages and attorneys' fees. A mismatch between a privacy notice's promises and actual data flows is also a textbook CPA deceptive practice allegation. And federal Wiretap Act, CIPA, and analogous wiretapping laws in Pennsylvania (WESCA) and Florida (FSCA) are unaffected.
Practical Compliance Tips and Strategies
- Conduct a technology inventory: Catalog every pixel, tag, software development kit, session replay tool, and server-side connector across websites, apps, and portals, recording what each captures and who receives the data.
- Classify channels by risk tier: Separate automated public pages, where the ruling forecloses WPA liability, from human-mediated channels – staffed chat, messaging, forms routed to personnel, portals – and AI-mediated interfaces, and apply all-party consent discipline to the latter two.
- Reconcile notice to practice: Correct any privacy notice or cookie banner promise that sensitive data will not be shared for advertising if the technology stack makes that untrue.
- Build MHMDA-compliant consent architecture: For Washington consumers, implement a separate consumer health data privacy policy, opt-in consent before collecting or sharing consumer health data, and signed authorization before any "sale," with technical controls that suppress tracking until consent is captured.
- Reposition pending litigation: Move promptly to dismiss WPA counts under Baker; evaluate MHMDA and CPA theories on their own terms.
Engage Counsel Early
This ruling and SB 690 confirm that pixel and web tracking litigation is shifting from wiretap statutes toward consumer health, consumer protection, and comprehensive privacy law theories whose obligations are affirmative, technical, and jurisdiction-specific. Businesses that treat the decision as a reason to defer tracking technology governance will find that the exposure has simply migrated. A proactive, conservative approach to compliance remains far less costly than defending a putative class action, and experienced privacy counsel should be engaged early in the design and procurement of tracking and AI-assisted technologies, before a demand letter or complaint arrives.
How Baker Donelson Can Help
Baker Donelson's Privacy and Cybersecurity Litigation team has significant experience defending website pixel tracking and similar digital privacy class actions and pre-suit demand letters involving repeat plaintiffs' firms and pro se litigants in this space, including Mario Costanz, Vivek Shah, Joseph Sides, Tauler Smith LLP, Pacific Trial Attorneys APC, Johnson Dalal, Swigart Law Group, and Manning Law. We have also advised hundreds of companies on website compliance, risk mitigation strategies, and litigation readiness. If you have received a demand letter or a complaint, or want to protectively get a step ahead of this risk, contact the author, David J. Oberly, or another member of Baker Donelson's Data Privacy and Cybersecurity, Digital Marketing, AdTech and Consumer Privacy Compliance, or Privacy and Cybersecurity Litigation teams.