Washington Supreme Court hears challenge over hospital website tracking and scope of state anti‑eavesdropping law

The Washington State Supreme Court heard oral argument on May 28 in Carl Baker et al. v. Seattle Children’s Hospital, a case testing whether the state’s anti‑eavesdropping statute (referred to in argument as the WPA) reaches user searches of a public hospital website that plaintiffs say were intercepted by a tracking pixel and forwarded to Meta without their consent. Plaintiffs’ counsel, Ryan Ellerczyk, told the court the searches — including exact symptom and condition search terms — were “transmitted or intercepted by Meta and incorporated into Meta's algorithms and used to make money,” and that the WPA should protect that activity.

The dispute centers on statutory text requiring a “communication” and, in the statute’s operative language as argued, a communication “between two or more individuals.” Ellerczyk urged the court to read the WPA in light of legislative intent and prior state precedent that the statute be construed broadly to protect privacy, arguing that the statute’s reference to transmissions “through any device” anticipates modern internet technologies. He also told the court that an unseen third‑party auditor monitoring website queries raises a privacy interest the WPA should protect unless users consent.

Responding for Seattle Children’s, James Siegel said the WPA is an anti‑eavesdropping statute limited to private communications between individuals and that a public hospital website functions like an encyclopedia or pamphlet rather than a conversational exchange. Siegel said hypothetical interactions with anthropomorphized AI bots or chatbots raise interesting questions but are outside this case; in his view, a bot is a computer and not an “individual” for purposes of the WPA. Siegel also argued that the plaintiffs’ claims about the hospital’s patient portal (MyChart/Epic) were abandoned below and are not before the court, and that other laws, such as the My Health, My Data Act, are the appropriate regimes for certain health‑data concerns.

Justices pressed both sides on two recurring points: (1) whether the statutory term “individual” should be read to exclude corporations and bots and thus limit the WPA to human‑to‑human communications, and (2) whether the criminal penalties associated with parts of the WPA mean courts should apply the rule of lenity to interpret ambiguous provisions narrowly. Counsel disagreed about whether Christensen and other precedents require broad readings to protect privacy or whether lenity applies when a criminal statute is ambiguous.

Several justices posed fact‑sensitive hypotheticals — for example, a person in an emergency room typing a query about bruises on a child — to test whether a website query could be both private and actionable. Siegel told the court that public pages on Seattle Children’s site did not include the tracking pixel alleged to be on the portal site and that, on the record before the court, the WPA would not apply to those public pages. Both sides acknowledged that effective notice and consent (for example, a clear pop‑up disclosing third‑party tracking) is a limiting principle that could resolve some claims.

The argument closed after the allotted time and the court submitted the case. The traveling court then took non‑case questions from students at Peninsula College, during which the justices described the court’s outreach program and timelines for issuing opinions (often several months, though urgent matters can be faster). The court did not announce a decision; opinions in the Washington Supreme Court are typically released on Thursdays.

Why it matters: the ruling could clarify how long‑standing state anti‑eavesdropping law applies to modern internet architecture and third‑party tracking, and whether plaintiffs may use the WPA to pursue claims arising from browsing a public website when data are forwarded to advertising networks. The court’s decision will also inform whether plaintiffs should instead use statutory regimes aimed specifically at health or data privacy.

The case was submitted; no opinion has been issued.