Washington’s top court just gave advertisers a clearer—but not unlimited—shield around Meta Pixel. On October 8, 2026, the Washington Supreme Court affirmed dismissal of Baker v. Seattle Children’s Hospital, ruling that the state’s all-party consent wiretap law does not reach a person typing into an automated website search box.
No second person, no wiretap claim
The Washington Privacy Act bars intercepting private communications “between two or more individuals” without consent. The majority said a search that triggers an automatic response from the hospital’s server involves only one individual: the parent. The hospital, as a corporation, is not an “individual” under the statute’s text.
Justice Angelis wrote for the majority; Justice González concurred in the result but disagreed with much of the reasoning. The court did not decide whether the searches were private communications, and it did not reach the MyChart patient-portal claims the parents dropped along the way.
What the parents said the Pixel did
Carly Baker, Janssen Ramos Savoie and Amber Shavies said each had a child treated at Seattle Children’s and each later saw health-related Facebook ads after searching for symptoms, doctors, urgent care and opening hours. According to the complaint, the hospital’s Meta Pixel copied browser requests and cookies—including the _fbp device identifier and c_user account identifier—and sent them to Meta, which used them for ad targeting.
The hospital’s cookie pop-up did warn visitors that accepted cookies would be used for marketing, but it did not name Meta Pixel or explain the handoff. Justice González called that issue unresolved.
Why the line matters for ad teams
- Automated pages in Washington now carry less WPA exposure for click-and-search tracking where no person is on the corporate side.
- Human-staffed channels are different. Live chat, contact forms, patient messages and voicemail are examples both opinions treat as potentially protected.
- Generative and conversational systems are not settled. The concurrence explicitly said the ruling may not apply to “a system that does more than return stored content.”
- Other laws still bite. Washington’s My Health My Data Act, California’s CIPA and overseas regulators continue to target health-related pixel tracking.
For scale: California’s CIPA has spawned more than 4,000 pixel lawsuits, and a separate German court ordered Meta to pay €3,000 in March 2026 over health-related Business Tools tracking. Sweden’s data authority earlier fined two pharmacies 45 million SEK combined.
What to do before you relax
Map every page and endpoint. Static resource pages and search boxes are not the same risk as live chat, contact forms, patient portals or AI assistants that generate responses rather than retrieve stored pages.
Move sensitive data collection server-side. The Washington ruling did not address Meta’s Conversions API or other server-to-server setups, and Meta is already pushing advertisers to that architecture.
Make consent specific. A generic cookie banner that says marketing data may be stored is not the same as naming Meta Pixel and explaining what it collects—and regulators keep treating that gap as a liability.
Source: PPC Land
