Washington Privacy Act Does Not Cover Searches Directed Solely to an Automated Corporate Website

1. Introduction

This decision identifies an important boundary in Washington’s protection against electronic surveillance: the requirement that a covered communication occur “between two or more individuals.” The court held that searches and clicks directed to a corporation’s website, where a fully automated system returns stored information, do not satisfy that requirement under RCW 9.73.030(1)(a).

Carly Baker, Janssen Ramos Savoie, and Amber Shavies brought a putative class action against Seattle Children’s Hospital (SCH). They alleged that the hospital embedded Meta Platforms Inc.’s Pixel technology in its public website, allowing Meta to receive information about visitors’ searches, clicks, and page views. According to the complaint, Meta linked that information to users’ accounts or device identifiers and used it for targeted advertising.

The searches involved potentially sensitive subjects, including children’s medical conditions, symptoms, specialists, and urgent care services. Nevertheless, the court resolved the appeal without determining whether the information was private or whether the hospital’s cookie notice supplied adequate consent. The decisive defect was the absence of a second individual participating in the communications alleged.

Justice González concurred in the result but offered a materially different explanation of the statute’s operation. He considered the parents’ allegations sufficient to establish potentially private communications and emphasized that communications with individuals working for corporations remain protected. His concurrence therefore supplies an important caution against treating the decision as a general exemption for corporate communications.

2. Background and Procedural History

The alleged tracking

SCH’s public website provided general information, including descriptions of health conditions, clinic hours, and directories of health care professionals. Visitors could navigate through links or a search bar. The complaint alleged that Pixel recorded their activity and transmitted it to Meta without their knowledge.

For example, a search for “depression” would produce a page containing resources about that condition while Pixel conveyed the search information to Meta. The complaint alleged that Meta could associate this activity with a Facebook or Instagram account. For visitors who were not logged in or did not yet have an account, a unique identifier allegedly enabled later association.

The website displayed a pop-up explaining that accepting cookies permitted software to store data assisting in marketing. The majority noted that the notice did not identify Pixel or explain its collection and use of website data. This factual description did not become a ruling on the sufficiency of consent.

The litigation’s narrowing scope

The complaint included claims under the Washington privacy act (WPA), the Washington Consumer Protection Act, the Washington Uniform Health Care Information Act, and several common-law theories. The trial court dismissed the complaint with prejudice. Only the WPA claim was pursued on appeal, so the Supreme Court did not address the sufficiency of the other claims.

The complaint also referred to MyChart, the hospital’s patient portal. The plaintiffs subsequently clarified that their claim targeted Pixel’s operation on the publicly available website rather than activity inside the authenticated portal. The court accordingly did not decide whether interception of messages to physicians, medical records, or other communications inside MyChart would violate the WPA.

The Court of Appeals affirmed on the ground that the website interactions were unilateral rather than a “back-and-forth” exchange. The Supreme Court affirmed the dismissal on a different ground: the communications alleged were not between two or more individuals. Business and hospital-industry amici supported SCH, but the court’s reasoning rested on statutory text rather than an express balancing of commercial interests against patient privacy.

3. Summary of the Opinion

The controlling holding

RCW 9.73.030(1) identifies the actors who may unlawfully intercept or record communications, including an “individual, partnership, corporation, association,” and governmental entities. Subsection (1)(a), however, protects a specified category of private communications: those transmitted by a covered device “between two or more individuals.”

The majority treated this difference in wording as deliberate. Corporations may violate the statute, but their inclusion among potential violators does not make them “individuals” for purposes of the protected-communication requirement.

Each interaction alleged here involved one plaintiff and a fully automated server owned and operated by SCH. Because no second individual participated, the plaintiffs could not state a claim under subsection (1)(a). The court therefore affirmed dismissal.

What the court did not decide

• Whether the searches and clicks constituted “private communication[s].”
• Whether Pixel’s conduct satisfied the statutory requirements for interception or recording.
• Whether the cookie notice established valid consent.
• Whether communications involving individuals acting for a corporation would be covered; the majority expressly reserved that question.
• Whether the conduct violated other statutory or common-law protections.
• How the WPA applies to communications inside the patient portal or to systems doing more than returning stored content.

Accordingly, the decision establishes a limitation on one WPA provision, not a general determination that the alleged tracking was lawful.

4. Analysis

A. Legal Reasoning

Dismissal turned on a legal deficiency, not a factual finding

The court reviewed dismissal de novo, meaning it independently assessed the legal sufficiency of the complaint. It accepted the pleaded facts as true and recognized that hypothetical facts conceivably raised by the complaint could support recovery.

Even under that plaintiff-favorable standard, the claim failed. The alleged searches were directed to a system that automatically returned website content. The complaint did not conceivably present an exchange with another individual. Thus, the failure concerned a necessary statutory element, not whether the plaintiffs could prove the alleged tracking.

Potential violators and protected participants are distinct categories

The majority’s central interpretive move was to separate two questions:

1. Who can violate the statute? Individuals, corporations, partnerships, associations, and the listed governmental bodies.
2. What communications does subsection (1)(a) protect? Private communications transmitted between two or more individuals.

The plaintiffs argued that expressly imposing liability on corporations supported protection of their website communications with SCH. The majority rejected that inference. The legislature could prohibit corporations from intercepting communications between individuals without necessarily protecting every communication directed to the corporation itself.

The majority also reasoned that lawmakers could have repeated the broader list of entities or used “persons” rather than “individuals” in subsection (1)(a). Because they did not, the court declined to substitute broader language.

Plain meaning controlled over general privacy policy

The plaintiffs invoked Washington’s reputation for especially strong electronic-surveillance protections. The majority answered that the WPA’s stringency principally concerns its all-party consent requirement. That feature does not eliminate the separate limitations defining which communications the statute covers.

Similarly, decisions permitting claims under federal or California law did not determine the meaning of Washington’s differently worded provision. The majority regarded the statutory text as unambiguous and therefore did not use legislative history or policy concerns to enlarge it.

The holding is narrower than a universal corporate exemption

Some language in the majority broadly contrasts individuals with corporations and other listed entities. Its express reservation is therefore significant: corporations often communicate through individuals, and the majority did not decide whether the statute applies when such communications occur between two or more individuals through a covered device.

The sound reading of the holding is consequently tied to its facts: one user interacting with an automated corporate website. It does not establish that messages to a hospital employee, clinician, or other human recipient lose protection because the recipient acts for an organization.

B. Precedents Cited and Their Influence

Procedural precedents: evaluating the complaint

Scott v. Amazon.com, Inc. and Cutler v. Phillips Petrol. Co.

The majority cited Scott v. Amazon.com, Inc., quoting Cutler v. Phillips Petrol. Co., for de novo review of a dismissal for failure to state a claim. These cases established the Supreme Court’s independent review of the legal issue rather than deference to the trial court’s interpretation.

Bravo v. Dolsen Cos. and Halvorson v. Dahl

Bravo v. Dolsen Cos., quoting Halvorson v. Dahl, supplied the rule that a court may consider hypothetical facts “conceivably raised by the complaint.” This generous pleading principle mattered because dismissal could not rest merely on incomplete factual detail. Nevertheless, it did not authorize inventing a materially different communication with a human recipient where the pleaded interactions involved automated website responses.

Kinney v. Cook and Tenore v. AT&T Wireless Servs.

The majority relied on Kinney v. Cook, quoting Tenore v. AT&T Wireless Servs., for the requirement to construe allegations favorably to the nonmoving party and dismiss only when no qualifying set of facts would justify recovery. Their significance is that the plaintiffs lost despite a protective pleading standard: the alleged transaction lacked an essential statutory participant.

FutureSelect Portfolio Mgmt., Inc. v. Tremont Grp. Holdings, Inc.

The concurrence cited this decision for accepting allegations as true and considering hypothetical supporting facts. Justice González acknowledged the caution appropriate to a novel technological dispute but concluded that further factual development would not change the destination of the communications alleged: a server returning stored content, not another individual.

Interpretive precedents: enforcing the legislature’s wording

Dep't of Ecology v. Campbell & Gwinn, LLC

This decision supplied both de novo review of statutory interpretation and the contextual approach to plain meaning. The majority examined the disputed phrase alongside the statute’s broader list of potential violators rather than reading “individuals” in isolation.

Five Corners Fam. Farmers v. State

Quoting Dep't of Ecology v. Campbell & Gwinn, LLC, this precedent identifies statutory text and related provisions as the strongest evidence of legislative intent. It also permits legislative history and enactment circumstances when ambiguity exists. Here, the majority found no ambiguity requiring those additional interpretive aids.

Densley v. Dep't of Ret. Sys. and Koenig v. City of Des Moines

Densley v. Dep't of Ret. Sys., citing Koenig v. City of Des Moines, supplied the presumption that different terms in the same statute carry different meanings. This principle was central to distinguishing “individual” from “corporation” and the other listed entities. The concurrence questioned its application because the broader statute uses overlapping terms—including “participants,” “parties,” “speakers,” and “persons”—in different provisions.

State v. J.P.

The majority invoked this case for the prohibition against adding or deleting language from an unambiguous statute. It therefore refused to read subsection (1)(a) as though it protected communications between any two entities listed in subsection (1), or between two or more “persons.”

State v. Wadsworth

The concurrence cited this decision for de novo statutory interpretation. It reinforced that Justice González’s disagreement with aspects of the majority’s reasoning concerned the legal construction of the WPA, not competing factual findings.

Privacy precedents: coverage, communication, and reasonable expectations

State v. Roden

This precedent performed several functions. The plaintiffs relied on its description of the WPA as among the most restrictive electronic-surveillance laws. The majority also relied on its warning that federal wiretap decisions are not instructive where the statutory schemes differ significantly.

The concurrence used State v. Roden to identify four requirements: a private communication transmitted by a device, interception or recording, a device designed to record or transmit, and absence of all-party consent. It emphasized that the first requirement must also incorporate the statutory condition of transmission between two or more individuals. The case further supplied examples involving private text messages and the distinction between substantive messages and isolated identifying information.

State v. Kipp

The majority used this case to explain what makes Washington’s statute particularly restrictive: its requirement that all parties consent. This prevented a broad characterization of the WPA’s protective purpose from overriding the narrower language defining covered communications.

State v. Christensen

Cited in the concurrence, this decision supported both the framework for WPA violations and the privacy inquiry. A communication is private when the parties manifest an intention to keep it private and that expectation is reasonable. This inquiry supported the concurrence’s assessment of the parents’ health-related searches, but the majority did not reach it.

State v. Riley

The concurrence relied on this case’s broad definition of “communication” as imparting or transmitting information. That definition does not demand a contemporaneous, reciprocal conversation.

The concurrence also discussed State v. Riley as distinguishing a telephone “line trap,” which reveals the originating number, from a pen register recording dialed numbers. The distinction helped explain why information conveying a user’s question or concern may qualify as communication even when the technology differs from traditional speech.

State v. Townsend

This decision involved electronically transmitted messages stored automatically on a detective’s computer for later reading. The concurrence used it to show that communication need not involve immediate “back-and-forth” interaction. It also supported the subjective-and-objectively-reasonable test for privacy and illustrated that e-mails and instant messages can be private communications.

State v. Faford

The concurrence cited this case’s treatment of private cordless telephone calls as an example of protected communication with a single recipient. Its role was illustrative: technological transmission does not itself defeat privacy. The concurrence also recognized that communications involving larger groups can remain protected, although establishing privacy may require more.

State v. Gunwall

The concurrence drew an analogy to this decision’s treatment of dialed telephone numbers captured by a pen register as private communications. Such information can reveal meaningful activity and permit continuing intrusions into privacy.

The analogy was nevertheless limited. The numbers in State v. Gunwall were dialed to reach a person. Here, the parents’ clicks and searches sought stored content from an automated server. Thus, information could possess communicative and private qualities while still failing the separate requirement concerning participants.

The lower appellate decision

Baker v. Seattle Children's Hosp. was the unpublished Court of Appeals decision affirming dismissal because the website interactions lacked a “back-and-forth” exchange. The Supreme Court did not adopt that rationale as its controlling ground. Justice González expressly explained why existing definitions of communication do not require reciprocal interaction. The distinction matters: this opinion should not be read as establishing that unilateral or asynchronous messages are categorically outside the WPA.

C. The Concurrence’s Distinct Contribution

Justice González agreed that the plaintiffs had not alleged communications between two or more individuals. He would nevertheless have held that their clicking and searching could constitute private communications.

In his analysis, a search or click imparts information about the user’s question, concern, or desired provider. The hospital’s response provides related content. The parents alleged an expectation of confidentiality, and the hospital’s notice allegedly promised not to share health information beyond specified disclosures unrelated to advertising. At the pleading stage, he regarded that expectation as reasonable; whether a general cookie banner defeated it remained unresolved.

The concurrence also resisted making corporate status decisive. It reasoned that the list in subsection (1) identifies potential violators, not necessarily every permissible participant in a protected exchange. It questioned the majority’s contrast between “individuals” and other statutory terms, particularly because subsection (1)(b) refers to consent by “persons” engaged in a conversation.

Justice González would recognize protection for patient communications with clinical staff, including messages left on a provider’s voicemail or internal messaging system even without naming a particular staff member. These examples illustrate his reasoning; they are not holdings resolving factual situations absent from this case.

Importantly, possible later review by a person was insufficient. The plaintiffs’ assertion that a person could eventually inspect the information did not transform a search directed to an automated server into a communication directed to another individual. The concurrence also cautioned that neither opinion exhaustively defined “individual” and left more sophisticated systems outside the question presented.

D. Potential Impact

A significant limitation on website-tracking claims under this provision

Defendants facing similar WPA claims will likely invoke this decision where the alleged activity consists solely of navigating a public website or submitting searches that produce automated content. Even sensitive subject matter and undisclosed third-party tracking do not, by themselves, supply the missing second individual.

Greater attention to the intended recipient

Future disputes will likely focus on whether the user sought information from an automated database or sent information to another individual. A message intended for a care team differs from a search requesting a stored webpage. The concurrence supports that distinction, while the majority leaves corporate communications through individuals unresolved.

Privacy and consent remain separate questions

The decision does not establish that information entered on a public website is necessarily public. Nor does it validate generic cookie notices. If a future case satisfies the participant requirement, courts may still need to examine reasonable expectations of privacy, the alleged interception, and whether every participant consented.

Other causes of action retain independent significance

The plaintiffs’ other statutory and common-law claims were outside the appeal. Future claimants therefore must assess each legal theory independently rather than assume that failure under the WPA resolves every question concerning health-related tracking or disclosure.

Any expansion must respect statutory language

The majority’s reasoning places responsibility for broadening subsection (1)(a) on the legislature rather than judicial substitution of more expansive terminology. Whether additional legislation is desirable is a policy question the opinion does not resolve.

5. Complex Concepts Simplified

“Between two or more individuals”

The relevant provision requires more than one qualifying individual in the communication. In this case, the website user was the only individual; the response came from an automated corporate system.

All-party consent

Every participant must consent before a covered private communication may be intercepted or recorded, unless an exception applies. This rule matters only after the communication falls within the statute’s coverage.

CR 12(b)(6)

A procedure for dismissing a complaint that does not state a legally sufficient claim. The court assumes the allegations are true; it does not decide whether the alleged events actually occurred.

De novo review

The appellate court decides the legal question independently, without deferring to the lower court’s legal conclusion.

GET requests, cookies, and Pixel

A GET request asks a server for a webpage and may include information in the page address. Cookies store identifiers or other data on a device. Pixel is website code alleged here to cause information about browsing requests and identifiers to be transmitted to Meta.

Private communication versus protected communication

Information may convey something private yet fail another statutory requirement. The concurrence considered the searches potentially private, but both opinions found no qualifying second individual.

Concurring in result

A judge agrees with the outcome but not necessarily the majority’s reasoning. Justice González agreed with dismissal while disputing aspects of the majority’s interpretation.

Putative class action

A lawsuit proposed on behalf of similarly situated people before a class has been certified. This opinion concerns the sufficiency of the WPA claim, not class certification.

6. Conclusion

The opinion establishes that searches and clicks directed solely to an automated corporate website do not satisfy RCW 9.73.030(1)(a)’s requirement of communication “between two or more individuals.” That threshold defect justified dismissal even accepting the alleged tracking as true.

Its significance lies equally in its limits. The court did not decide whether the searches were private, whether consent was valid, or whether other laws prohibited the conduct. The concurrence further underscores that automated delivery and corporate involvement should not be confused with the absence of an individual recipient. Future cases will turn on that distinction and on the precise statutory protection invoked.