Automated servers aren’t 'individuals' (at least not under the Washington Privacy Act)

Does website analytics technology that records searches and clicks violate the Washington Privacy Act? No, says the Washington Supreme Court, at least not when the communication is with an automated server rather than another person.

In Baker v. Seattle Children’s Hospital, a group of parents claimed that Seattle Children’s Hospital used Meta Pixel to share their searches and clicks on the hospital’s public website with Meta, which then used the data for targeted advertising.¹ The parents alleged this violated the Washington Privacy Act (WPA), RCW 9.73.030(1)(a), which makes it unlawful to intercept or record a “[p]rivate communication transmitted by telephone, telegraph, radio, or other device between two or more individuals” without first getting the consent of all participants.²

The trial court dismissed for failure to state a claim, the Washington Court of Appeals affirmed, and the Washington Supreme Court granted the plaintiffs’ petition for review.

Opinion summary

All nine justices affirmed dismissal of the WPA claim, agreeing on the result but not entirely on the reasoning.

Majority opinion

Writing for the majority, Justice Theodore Angelis focused on the statute’s text: Section 9.73.030(1)(a) applies only to communications “between two or more individuals.”³ That doesn’t include communications between an individual and the other entities listed in the statute, meaning partnerships; corporations; associations; or the state of Washington, its agencies, and political subdivisions, because of the difference in statutory language used.⁴ Here, each search or click was between one parent and a fully automated system (a website) owned and operated by a corporation—one an individual, one not. The strength of this textual interpretation outweighed the plaintiffs’ counterarguments that corporations can be liable under the WPA, that the WPA has been characterized as a restrictive electronic surveillance law, and that claims based on similar factual allegations under similar federal and California statutes have survived dismissal. So, the claim failed.

Having settled the case on that point, the majority didn’t decide whether website searches and clicks count as “private” communications or whether the statute applies to communications between one individual and a nonindividual entity communicating through an individual.⁵

Concurrence

Justice Steven González concurred in the result, with Justice Helen Whitener joining. The concurrence agreed that the alleged communication here was not between two individuals. But these justices concurred in the result only because they would decide that the alleged clicks and searches here, researching children’s conditions or symptoms or looking up providers, could constitute private communications—their claim failed because those communications were not allegedly sent to another “individual.”⁶ The concurring justices also wrote that this provision of the WPA protects communications between an individual and individuals working for a corporation—for example, a message sent to (or from) a hospital’s clinical staff. Finally, the concurrence didn’t buy into the majority’s reasoning that listing “individuals” separately from “corporations” in the statute means a corporation can’t take part in a protected conversation. In its view, the statute’s list of entities only says who can violate the privacy act, not who can be on one end of a protected conversation.

Analysis and implications

Baker shows a Washington Supreme Court willing to read the WPA’s text according to its plain language, notwithstanding that doing so distanced its ruling from the federal and California wiretap cases that have let similar website-tracking claims move forward. Two concurring justices arrived at the result through different reasoning, but the bottom line is the same: Under RCW 9.73.030(1)(a), a click or search sent to an automated server, including a website that returns stored content, isn’t a communication “between two or more individuals.”

That said, Baker leaves several questions for another day. The majority expressly left open whether the WPA reaches communications with a company’s human staff—a point the concurrence criticized, stressing its view that messages to a corporation’s human representatives remain protected. The decision also leaves open whether website searches and clicks are “private communications” in the first place, as well as how any tracking within authenticated portals might be treated, as the plaintiffs expressly disclaimed reliance on any such activity. And because the plaintiffs did not appeal the dismissal of their other claims, including under the Washington Consumer Protection Act and common law privacy claims, those claims were not addressed by the court.

Still, for plaintiffs hoping to bring WPA claims over common website analytics tools, the message is clear: Unless there’s a person on the other end of the line, this statute probably isn’t the place to start.

Endnotes

1. No. 104590-5 (Wash. Oct. 8, 2026) (“Op.”).
2. Id. at 1–2; RCW 9.73.030(1)(a).
3. Id. at 6–7 (emphasis in original); see also RCW 9.73.030(1)(a).
4. Op. at 6–7.
5. Id. at 9 n.6, 10.
6. Baker, No. 104590-5, slip op. at 7 (González, J., concurring in result).