Washington's Supreme Court on October 8, 2026 affirmed the dismissal of a class action accusing Seattle Children's Hospital of letting Meta's Pixel record parents' health-related searches, holding that the state's all-party consent wiretap statute protects only communications "between two or more individuals" - and that a person typing into a search box run by an automated corporate server does not meet that test.

In Short

Three parents said a children's hospital let Meta see what they searched for on its website, and Washington's highest court threw the case out. The judges said the state's wiretap law only covers conversations between people, and typing into a website that answers automatically is not a conversation with a person. That makes it harder to use this Washington law against websites that run advertising trackers, though the court left open what happens when a real human or a smarter system sits on the other end.

The ruling

The opinion in Baker v. Seattle Children's Hospital, No. 104590-5, was filed for record at 8 a.m. on October 8, 2026, according to the clerk's stamp on the document. Justice Angelis wrote for the majority. Justice González wrote separately, concurring in the result but disagreeing with much of the reasoning. The copy of the opinion reviewed for this article lists Justice Melody under "We concur" and does not show the full vote of the en banc court.

The case turned on a single clause. The Washington privacy act, codified at RCW 9.73.030(1)(a), makes it unlawful to "intercept, or record any . . . [p]rivate communication transmitted by telephone, telegraph, radio, or other device between two or more individuals . . . without first obtaining the consent of all the participants in the communication."

The plaintiffs argued their website searches were private communications that Meta's code intercepted. The majority never reached that question. "RCW 9.73.030(1)(a) governs interception or recording of 'communication' between 'two or more individuals' and therefore excludes searches and clicks that generate an automated response from SCH's website," Justice Angelis wrote. "Accordingly, we affirm the trial court's order dismissing the plaintiffs' WPA claim."

The holding is narrow in one sense and broad in another. It does not say that website tracking is lawful in Washington, and it does not touch the other claims the parents originally filed. It does, however, remove the state wiretap statute - with its demand for the consent of every participant - as a route for challenging the most common form of tracking on public web pages: code that copies what a visitor clicks and types into a site that responds without human involvement.

What the parents alleged

Carly Baker, Janssen Ramos Savoie and Amber Shavies brought the putative class action against the hospital. Each had a child who was a patient there, and each held an account with Meta Platforms Inc., according to the concurring opinion. Baker used the website's search bar and its "Conditions" page to look up medical conditions and symptoms. Ramos Savoie used the search bar and the "Find A Doctor" page. Shavies searched for urgent care facilities and their opening hours. Some of the parents recall later receiving health-related advertisements on Facebook.

The complaint describes the mechanics in some detail. The hospital's site carried Meta Pixel, which the majority describes as "free software used to track website visitors and which Meta uses to target advertisements based on visitors' activities on websites like SCH's public site." The opinion offers a concrete example: "when a visitor types 'depression' in the search bar of SCH's public website, the site loads a page with resources for this health condition. Pixel records and relays the content of this search to Meta, which links that information to the Facebook or Instagram account of the website visitor and which Meta uses for targeted advertising."

Visitors without a Meta account were not outside the system. According to the majority's summary of the complaint, Pixel transmits their activity "with a unique identifier," and "that identifier allows Meta to link the user's activity on the SCH website when that individual logs in to or creates a Meta account."

The plumbing, as the concurrence describes it

Justice González's opinion contains the most technical account of how the tracking worked, drawn from the complaint. When the parents visited the site, their browsers sent "GET requests" to the hospital's web server, which returned the requested pages. A GET request "identifies the requested page by its URL, can carry additional data embedded in that URL, and travels with any cookies the browser holds for the server it addresses." A POST request, by contrast, "carries data outside of the URL."

Because the hospital had embedded the Pixel in its pages - the same kind of site tag advertisers place across millions of websites - the hospital's response delivered Meta's code to each visitor's browser, and that code "then caused the browser to duplicate each GET request and send the copy to Meta."

Two cookies matter in the parents' account. The Pixel "places an _fbp cookie on the device of every visitor to the hospital's website, which permits Meta to group that visitor's requests under a single device identifier." Meta "separately placed a c_user cookie containing the numeric identifier for the visitor's Facebook account." The complaint alleges the Pixel sends both to Meta, and that "the c_user cookie is what allows Meta to attribute the request to a named account rather than to an unidentified device."

The majority, in a footnote, records that the complaint defines a first-party cookie as one "created by the website that a user is currently visiting," while "a third-party cookie can store and communicate a website user's data from one website with a different website." Pixel uses both.

The hospital did warn visitors about cookies. According to the majority, a pop-up told visitors that "if they accept cookies, they agree to the use of that software to store data that assist in marketing." The alert "does not, however, identify Pixel or explain the process by which Pixel collects and uses website data."

Justice González treated this as unresolved. The hospital's own notice "told patients it would not share their health information beyond the disclosures it listed, and none of those disclosures are related to advertising," the concurrence states. "Whether a general cookie banner defeated that expectation is not resolved by the pleadings."

How the case reached the Supreme Court

The trial court granted the hospital's motion to dismiss with prejudice at the close of oral argument. The hospital had challenged the sufficiency of the allegations and argued that Pixel was never installed on its MyChart patient portal. The Court of Appeals affirmed in an unpublished opinion dated August 18, 2025, holding that the searches were not "private communication[s]" because they were "unilateral rather than a 'back-and-forth' exchange of information with another party." The Supreme Court granted review and received amicus briefs from the Chamber of Commerce of the United States and the Washington State Hospital Association, and from the Interactive Advertising Bureau, all supporting the hospital.

The patient portal fell away before the case reached the justices. The parents' complaint had alleged that Pixel transmitted information when patients attempted to log in to MyChart, but in responding to the motion to dismiss they said their claims targeted only the public website. The majority therefore limited its review to the public site. The concurrence notes that the parents "did not abandon their allegation that the Pixel discloses a user's patient status when the user navigates to the portal's sign-in page," but it too declined to address activity inside the portal, which the complaint said included test results, messages to providers and prescription refill requests.

Two discrepancies in the document

The majority opinion states that the three parents filed suit "In 2013." That date cannot be squared with the rest of the record. PPC Land's April 2026 coverage of the IAB's amicus filing placed the filing in October 2023, with dismissal in February 2024, which fits the August 2025 appeals ruling. The "2013" in the opinion appears to be a typographical error.

The opinion also cites the Court of Appeals decision as No. 86481-1-I, while the URL it gives for that same decision ends in 864611.pdf. PPC Land's earlier report used 86461-1-I. Neither discrepancy affects the holding.

The majority's reasoning

The majority's analysis runs to fewer than four pages and rests on a textual comparison within the same subsection. RCW 9.73.030(1) lists who may violate the statute: "individual, partnership, corporation, association, or the state of Washington, its agencies, and political subdivisions." Subsection (1)(a) then limits protected communications to those "between two or more individuals."

"When the legislature uses two different terms in the same statute, we presume lawmakers intended the terms to have different meanings," the majority wrote. "Accordingly, the term 'individual' in subsection .030(1)(a) does not encompass the other, separately listed institutions in subsection .030(1)."

The application followed directly. No party disputed that the hospital is a corporation, and "each communication involved only one of the plaintiffs and a fully automated system SCH owns and operates." Because "only one individual was involved in each communication, the plaintiffs do not have a claim under the WPA."

The parents argued that the act's explicit coverage of corporations as violators implied that corporations could also be parties to protected communications. The court turned that argument around. The separate listing "reinforces (rather than undermines) our conclusion," Justice Angelis wrote. Had lawmakers wanted broader coverage, "they could have written .030(1)(a) to mirror the preceding section or could have stated that the WPA protects communications between two or more 'persons,' rather than 'two or more individuals.'"

"Most restrictive" reconsidered

The parents also leaned on the court's own past description of the WPA as "one of the most restrictive electronic surveillance laws ever promulgated," from State v. Roden in 2014, and on decisions in other jurisdictions that have let similar pixel claims survive dismissal under the federal wiretap act and California's privacy act.

The majority rejected both. "[F]ederal cases on [the federal wiretap statute] are not instructive given the significant differences between the state and federal statutory schemes," it wrote, quoting Roden, adding that "the same is true of California's privacy act, which likewise differs significantly from the WPA." The "most restrictive" label, the court clarified, referred mainly to the all-party consent requirement, quoting State v. Kipp: "Washington is 1 of only 11 states that require that all parties to a private communication consent to its recording and disclosure."

That distinction carries weight outside Washington. California's Invasion of Privacy Act has generated thousands of tracking suits. More than 4,000 CIPA lawsuits were cited in an IAB paper distributed on October 1, 2026, and Governor Gavin Newsom signed SB 690 on September 30, 2026, ending private suits under the pen register provision from January 1, 2027, while leaving Sections 631, 632 and 632.7 open to private plaintiffs. Washington's court has now said, in effect, that California's case law on those surviving sections will not be imported into its own statute.

What the majority left alone

Two questions were expressly not decided. The court did not decide "whether any communications at issue constitute a 'private communication'" under the statute. And in a footnote, it acknowledged that the corporations listed in the statute "will often, of course, communicate through individuals," but said it "need not, and do[es] not, resolve whether the statute would apply when such communications are transmitted by a covered device and are between two or more individuals because those hypothetical facts are not conceivably raised by the complaint."

The opinion also does not address the sufficiency of the parents' other claims under the Washington Consumer Protection Act, the Uniform Health Care Information Act, and for invasion of privacy, breach of implied contract, conversion and unjust enrichment. The parents did not challenge their dismissal on appeal.

The concurrence: same result, different map

Justice González agreed the complaint failed, but on narrower grounds - and the separate opinion sketches where future claims might succeed.

First, Justice González would have reached the question the majority skipped, and answered it for the parents. "A click and a typed query each impart information: the user's question or concern," the opinion reads. "Those clicks and queries could convey what condition or symptom a parent was researching and which physician they were looking for." Citing State v. Riley, the concurrence notes that back-and-forth interactions are not required for a communication. "I would therefore hold that the parents' clicking and searching could constitute a private communication."

The concurrence draws an analogy to State v. Gunwall from 1986, in which the court held that numbers captured by a pen register were a private communication, contrasting it with Riley, where a telephone company's "line trap" was not. "The numbers captured in Gunwall were dialed to reach a person on the other end of the line," Justice González wrote. "That distinction matters here."

Second, the concurrence rejects the majority's corporate carve-out. "Unlike the majority, I would recognize that private communications transmitted between an individual and individuals working for a corporation are protected by our privacy act," Justice González wrote, agreeing with the parents that the statute "leaves no room for a corporate carveout of liability." In that reading, the enumeration of corporations in subsection (1) "identifies who may violate the act. It does not tell us who may be a party to the communication the act protects."

The concurrence also points to a structural inconsistency in the majority's approach. Subsection (1)(b) conditions lawful recording of conversations on the consent of "all the persons engaged in the conversation." If "person" extends to a corporation, Justice González wrote, "the majority does not explain why a corporation may consent to the recording of a conversation under subsection (1)(b) but cannot be on one end of a communication under subsection (1)(a)."

What sank the parents, in the concurrence's view, was simply that nobody was on the other end. Their communications "were directed at a server that returned stored content and not at another individual." Speculation that "a physical person can review the communication at some point after it is received" was not enough. Footnote 3 is pointed: "Nowhere does the complaint allege that anyone read a parent's query or that any query was directed to an individual."

Examples that would qualify

The concurrence describes situations that, in Justice González's view, would fall inside the statute. "A private communication sent or received by the hospital's clinical staff from a patient is protected by our privacy act because two or more individuals would be involved in that exchange. Similarly, a message left by the patient on a health provider's voice mail or internal messaging system would be protected by the privacy act even if it was not left for a specific staffer."

The closing paragraph marks the edges of the decision. "A message to a member of a care team is not before us, nor is the application of our privacy act to a system that does more than return stored content."

Why it matters for advertisers and publishers

The immediate effect is that a Washington business running Meta Pixel or a comparable site tag on public pages has one fewer statutory exposure for click-and-search tracking where the site answers automatically. The WPA carries an all-party consent rule that most states and federal law do not, and a ruling that it reaches every GET request copied to an advertising platform would have made routine measurement code a source of class action risk across the state.

The ad industry argued exactly that. The IAB's amicus brief, filed April 10, 2026, contended that a GET request and server response are the basic mechanism of any web access, that measurement vendors need basic technical data to confirm whether ads were seen or clicked, and that per-packet consent would be unworkable. The brief drew a line between automated device-to-device exchanges and person-to-person channels such as VoIP calls, messaging and live chat. The majority's holding tracks that line closely, though on textual grounds rather than the policy arguments the IAB advanced.

The protection is narrower than it first appears, for three reasons.

Human-staffed channels. The majority reserved, and the concurrence affirmatively endorsed, coverage of communications where a person sits on the corporate side. Live chat with staff, messaging systems, and contact forms routed to people were not before the court. A complaint alleging that a Pixel or similar code captured a patient's message to a nurse would face a different analysis.

Systems that do more than return stored content. Justice González's final sentence explicitly carves out "a system that does more than return stored content." A footnote in that opinion adds that "the term 'individual' may well include more than a natural person," though neither opinion defines the word. That leaves an open question for conversational AI interfaces, which generate responses rather than retrieve static pages. The question is not academic. A May 2026 class action against OpenAI alleges that the Meta Pixel and Google Analytics transmitted ChatGPT conversation titles, along with the same c_user and _fbp cookies at issue in Washington, to Meta and Google. That case was brought under federal law and CIPA, not the WPA, but the Washington concurrence suggests that the server-returned-stored-content rationale may not extend to generative systems.

Other laws. The parents' consumer protection and health information claims were dismissed but not reviewed. Washington's My Health My Data Act, which the IAB itself cited as a targeted alternative to stretching the wiretap law, was not at issue. And outside the United States, the same tool has drawn penalties: a German regional court in Jena ordered Meta to pay €3,000 on March 2, 2026, over Business Tools tracking that captured health-related searches without effective consent, and Sweden's data protection authority fined pharmacies Apoteket and Apohem a combined 45 million SEK in August 2024 after Meta's pixel, with advanced matching enabled, sent sensitive purchase data to Meta.

Health data and the pattern of litigation

Health is where pixel litigation has hit hardest. In August 2025, a federal jury in San Francisco found Meta violated CIPAby collecting menstrual and pregnancy data through the Flo period-tracking app. The Washington ruling arrives as a counterweight in a different statutory setting, with a different textual hook.

For marketers, the decision changes the legal calculus around one specific architecture - browser-side code on public, automated pages - rather than tracking in general. Approaches that move data collection off the browser, such as Meta's Conversions API or other server-side setups, were not addressed. Meta has been pushing advertisers in that direction regardless: in April 2026 it added a one-click Conversions API setup and an AI-assisted Pixel feature, noting that access may not be available for certain data source categories. Whether a server-to-server transfer of first-party data involves a "communication between two or more individuals" is a question no Washington court has yet answered.

The cookie banner question also remains live. Justice González's observation that a general banner may not defeat an expectation of privacy created by a more specific health privacy notice was not adopted by the majority, but it was not rejected either - the majority simply did not reach it.

Timeline

Summary

Who: Parents Carly Baker, Janssen Ramos Savoie and Amber Shavies, as lead plaintiffs of a putative class, against Seattle Children's Hospital, a Washington nonprofit corporation. Meta Platforms Inc. supplied the Pixel at the center of the case but was not a party. Justice Angelis wrote the majority opinion; Justice González concurred in the result. The IAB, the US Chamber of Commerce and the Washington State Hospital Association filed amicus briefs supporting the hospital.

What: The Washington Supreme Court affirmed dismissal of the parents' claim under the Washington privacy act, RCW 9.73.030(1)(a), holding that clicks and searches on a public website answered by an automated corporate server are not communications "between two or more individuals." The court did not decide whether the searches were private communications, and did not address communications involving human staff or the parents' other claims.

When: The opinion was filed on October 8, 2026. The suit was filed in October 2023 according to earlier PPC Land reporting (the opinion states 2013), dismissed by the trial court in February 2024, and affirmed by the Court of Appeals on August 18, 2025.

Where: The Supreme Court of the State of Washington, sitting en banc, in case No. 104590-5. The conduct concerned the hospital's public website.

Why: Washington is one of 11 all-party consent states, and a ruling that its wiretap law covered every browser request copied to an advertising platform would have exposed common measurement code to class action liability. The majority's textual reading closes that route for automated public pages, while the concurrence signals that human-staffed channels and systems that generate rather than retrieve content remain open questions.