In California, plaintiffs’ firms have filed thousands of class actions and mass-arbitration demands against operators of consumer-facing websites and apps, targeting tools such as advertising pixels, session replay software, and chat widgets, and relying on California’s Invasion of Privacy Act (CIPA). The complaints typically rely on several theories, including wiretapping under Cal. Penal Code § 631, recording of confidential communications under §§ 632 and 632.7, and the pen register and trap-and-trace provision in § 638.51. CIPA allows an injured person to sue for the greater of $5,000 per violation or three times actual damages, without proof of actual harm.
In Washington, that plague had only gotten started, with plaintiffs’ firms relying on Washington’s uniquely strict Privacy Act (WPA), RCW Ch. 9.73. The WPA makes it unlawful to “intercept, or record any . . . [p]rivate communications transmitted by telephone, telegraph, radio, or other device between two or more individuals . . . without first obtaining the consent of all the participants in the communication.” RCW 9.73.030(1)(a).
In the space of two weeks, California’s governor signed into law a new act that dramatically restricts plaintiffs from pursuing such CIPA claims, while the Washington Supreme Court decisively decided that the WPA does not apply to such claims. We explain each of those developments below.
What the Washington Supreme Court Decided
On October 8, 2026, the Washington Supreme Court issued its long-awaited decision in Baker v. Seattle Children’s Hospital. The Court held that a healthcare provider’s use of Meta Pixel technology on its public website to track a user’s activities did not violate the WPA. The plaintiffs alleged that Seattle Children’s Hospital’s website used the Pixel technology to track their clicks, searches, and page views and sent that information to Meta, which used it for targeted advertising. In one example, a visitor who typed “depression” into the site’s search bar had that search relayed to Meta and linked to the visitor’s Facebook or Instagram account. The hospital’s cookie banner told visitors that accepting cookies allowed data collection to assist marketing, but it did not mention the Pixel technology or explain how it works.
The trial court dismissed the WPA claim, and the Court of Appeals affirmed in an unpublished opinion, reasoning that the searches were unilateral communications rather than a back-and-forth exchange with another party. The Supreme Court affirmed on a different ground. The WPA prohibits intercepting or recording a private communication transmitted by a device “between two or more individuals” without the consent of all participants. RCW 9.73.030(1)(a). Writing for the majority, Justice Angelis focused on that last phrase. Because the statute lists “individual” separately from “partnership, corporation, association, or the state of Washington,” the court presumed the legislature meant different things by those words. A visitor’s search or click that produces an automated response from a corporation’s website involves only one individual, so it is not a communication between two or more individuals.
The court rejected the plaintiffs’ argument that corporations can be liable under the WPA, noting that the statute separately limits covered communications to those between “individuals.” It also declined to treat the statute’s reputation as “one of the most restrictive electronic surveillance laws ever promulgated” as a reason to read it more broadly. The court explained that this description referred primarily to the all-party consent requirement. It also said that cases under the federal wiretap act and California’s privacy act are not instructive, because those statutes differ significantly from the WPA.
What the Decision Leaves Open
While this decision should help shut down one avenue for pursuing Meta Pixel and similar claims, the decision may not completely shut the door.
First, the majority did not decide whether the plaintiffs’ clicks and searches were “private communications.” Justice González, joined by Justice Whitener, concurred in the result but would have reached that question. In his view, the plaintiffs could have a reasonable expectation of privacy in their health-related searches, particularly because the hospital’s notice said it would not share health information beyond the disclosures it listed, none of which involved advertising.
Second, the majority expressly left open whether the WPA applies when a covered entity communicates through individuals, such as a patient’s exchange with clinical staff. The concurrence went further and would hold that a message between a patient and a hospital’s staff is protected. It also flagged that the case did not involve “a system that does more than return stored content.” Live chat, messaging features, and AI-driven interactions on a website may therefore present a different analysis.
Washington’s My Health My Data Act
Baker addressed only the WPA, and plaintiffs in Washington have another avenue for health-related data sharing. The My Health My Data Act (MHMDA), RCW Ch. 19.373, took effect in 2024 and regulates the collection, sharing, and sale of “consumer health data” by businesses that operate in Washington or target Washington consumers. It is not limited to healthcare providers, so a retailer, app developer, or advertiser that handles health-related data is potentially covered.
The key difference from the WPA is that the MHMDA does not depend on a communication between two individuals. It focuses on what data is collected and shared, and with whom. The MHMDA is also enforceable by private plaintiffs via Washington’s Consumer Protection Act (CPA), RCW Ch. 19.86, which also allows recovery of treble damages (up to a limit) and attorneys fees. The first class action under the Act, Maxwell v. Amazon, was filed in the Western District of Washington in February 2025. It alleges that an advertising software development kit embedded in third-party apps collected health-linked data, including precise location and biometric data, without the consent the Act requires. That litigation is ongoing.
The California Repeal
On September 30, 2026, Governor Newsom signed SB 690, which eliminates the private right of action for § 638.51 claims arising from conduct on a website or app. Now only the California Attorney General may bring those claims. The change takes effect January 1, 2027, and applies to qualifying claims still pending on that date in actions filed on or after January 1, 2025. The bill does not repeal § 638.51 or declare any tracking technology lawful, and it does not affect CIPA’s wiretapping provisions or potential federal law claims.
Practical Takeaways
Neither development is a reason to relax tracking-technology governance. Websites that include chat features, messaging, patient or customer portals, or other interactive tools may fall outside the reasoning of the Baker majority. Plaintiffs may also pursue the other theories the court did not reach, including claims under My Health My Data Act. Meanwhile, California’s change leaves true CIPA wiretapping claims and as well as federal claims in place, and its retroactivity clause is likely to be challenged.
Businesses should continue to audit which pixels, SDKs, and scripts are active on their sites, particularly on pages where visitors search for or request health, financial, or other sensitive information. Businesses that handle health-related data from Washington consumers should especially assess whether their consent flows and privacy policies meet the MHMDA’s explicit-consent and separate-policy requirements.
If you have questions about this decision or would like to evaluate your organization’s use of tracking technologies, please reach out to a member of Miller Nash’s data privacy team.
This article is provided for informational purposes only—it does not constitute legal advice and does not create an attorney-client relationship between the firm and the reader. Readers should consult legal counsel before taking action relating to the subject matter of this article.
