PORT ANGELES, Wash. (CN) - A class of parents asked the Washington Supreme Court on Thursday to find that Seattle Children's Hospital violated wiretapping laws by deploying third-party tracking technologies on its website, while the hospital insisted the law doesn't apply to communications with a corporation.
"In the last decade or so, the corporate surveillance of our online activities has become increasingly invasive - this case is an example of that," said Ryan Ellersick, an attorney with Zimmerman Reed representing the parents.
Three parents sued the hospital in late 2023, accusing it of intentionally deploying a software code owned by Meta that tracks website user activity to secretly intercept and record their sensitive health information.
The parents said they used Seattle Children's Hospital's website to search for information about medical conditions on behalf of their children and later received health-related ads on Facebook, including some related to the specific symptoms they had searched on the hospital website.
The trial court dismissed the parents' class action and the Washington Court of Appeals affirmed the dismissal, finding the "click-and-search navigation" of the hospital's public website didn't fall within the state's wiretap prohibition.
Washington's privacy act is one of the most restrictive in the nation and prohibits the interception and recording of certain communications without the consent of all parties.
Before the Supreme Court, the parents argued their searches on the hospital's website counted as "private communication" under the state's privacy act.
The justices questioned the parents' perceived bounds of the privacy act.
"In your view, does the privacy act protect all of my communications with Wikipedia if I searched gambling addiction or miscarriage or anything like that?" asked Justice Colleen Melody. "Are those protected communications that no other party can track?"
To the parents, such a search would be protected.
"The statute talks about, again, in broad language transmitting messages through any device, and so I think that contemplates future communications technologies," Ellersick said. "I think if the court concludes that Seattle Children's Hospital is not an individual, then the statute will not apply to any communications transmitted through a company website, and there will be essentially carte blanche to engage in mass surveillance of those types of activities."
Justice Raquel Montoya-Lewis asked whether the problem could be solved by the hospital adding a pop-up window letting website users know they are being tracked. The parents agreed.
Seattle Children's Hospital argued the parents were stretching the privacy act beyond its bounds.
"The plaintiffs cannot reconcile their claims with the WPA's plain language; WPA is an anti-eavesdropping statute," said James Sigel, attorney with Davis Wright Tremaine.
The hospital argued that mere browsing and search history is not a "communication" as covered by the law, nor does the hospital count as an individual under the terms of the law.
"The question essentially is: Is a website an individual? Are these really communications with another individual that the WPA requires in order to impose either civil or criminal liability? And I think the answer is no," Sigel said.
The hospital also pointed out that the relevant law is specifically an anti-eavesdropping statute intended to prevent third parties from listening in on conversations between two individuals.
Plus, the parents and hospital agreed the tracking software is only applied to the hospital's public website that provides general information rather than the private patient portal.
"What we're talking about here is just simply the review of information that's sitting on the internet that happens all the time," Sigel said. "So you wouldn't say, for example, that someone communicated with this court when they went to the court's website to look up an opinion that was posted there, that's not within the ordinary understanding of communication."
But the parents argued searching is a more dynamic process than the hospital suggested.
"The problem was that they used an agent, a third party, to intercept in real time what people were doing on the website, and the consumers did not consent to them monitoring what they were doing," Ellersick said.
The Supreme Court did not indicate when it would rule.
Source: Courthouse News Service
