State Supreme Court Rejects Parents’ Privacy Claim Over Seattle Children’s Website Tracking

The Washington Supreme Court on Thursday upheld dismissal of a privacy-act claim brought by parents who alleged Seattle Children’s Hospital shared their website searches with Meta without their consent.

The parents said they used the hospital’s website to research their children’s health and find care, and that Meta used the resulting data for targeted advertising.

The October 8 ruling turns on the privacy-act provision protecting communications between two or more individuals. The parents’ searches and clicks on the hospital’s public website generated automated responses, the court held, and did not meet that requirement.

All nine justices agreed with the result. Seven signed the majority opinion written by Justice Theodore J. Angelis. Justice Steven C. González wrote a separate concurrence, joined by Justice G. Helen Whitener.

The decision leaves in place the dismissal entered by King County Superior Court Judge Jason Holloway. The majority did not decide whether the parents’ searches were private, and the court did not address whether the alleged conduct violated other laws.

Carly Baker, Janssen Ramos Savoie and Amber Shavies filed the proposed class action in October 2023. Each had a child who was a patient at the hospital, according to the court’s account.

The parents alleged that they used the website to research medical conditions and symptoms, look for doctors and specialists, and check urgent care locations and hours. They said software embedded in the site, known as Meta Pixel, recorded their activity and transmitted it to Meta.

According to the allegations described in the opinion, Pixel could link website searches and page views to visitors’ Facebook or Instagram accounts, allowing Meta to target advertisements based on that activity. Some of the parents recalled receiving health-related advertisements on Facebook after using the hospital’s website.

The court accepted the complaint’s factual allegations as true for purposes of reviewing the dismissal. It was deciding whether those allegations stated a claim under the privacy act, rather than resolving disputed evidence at trial.

The majority described a website pop-up telling visitors that accepting cookies would allow data storage to assist with marketing. The notice did not identify Pixel or explain how it collected and used website data, the opinion said.

The parents argued that their searches were private communications protected by the statute. They also pointed out that the law expressly allows corporations to be held liable for unlawful interception or recording.

The majority said that corporate liability did not eliminate the separate requirement that a protected communication involve two or more individuals. In this case, each exchange involved a parent and an automated server maintained by the hospital.

“Because only one individual was involved in each communication, the plaintiffs do not have a claim under the WPA,” Angelis wrote, using the abbreviation for the Washington privacy act.

González agreed that the claim could not proceed but disputed parts of the majority’s reasoning. A search could reveal a parent’s question or concern about a child’s health, he wrote, and the parents had sufficiently alleged that they reasonably expected those communications to remain private.

He noted that the hospital’s notice concerning health information did not list advertising among its permitted disclosures. Whether a general cookie banner defeated the parents’ expectation of privacy could not be resolved from the pleadings, he wrote.

González also said private communications between patients and hospital employees would be protected, including messages left for a care team. The majority expressly left unresolved how the provision would apply to communications involving individuals acting for a corporation.

The Supreme Court limited its review to activity on the public website. The hospital argued that Pixel was never installed on its MyChart patient portal, and the parents clarified that their claim did not depend on tracking after a user signed in. They continued to allege that navigating to the portal’s sign-in page disclosed a user’s patient status to Meta.

The ruling does not establish that messages to doctors or medical records inside MyChart were disclosed to Meta.

The parents’ lawsuit also included claims under Washington’s Consumer Protection Act and Uniform Health Care Information Act, along with other civil claims. They did not challenge dismissal of those claims on appeal, and the Supreme Court did not address their merits.