Keypoint: Massachusetts’ highest court ruled the use of software that tracks users’ activity on its website does not violate the state’s Wiretap Act, which was intended to prevent the recording or interception of communications between two or more persons.
On October 24, the Massachusetts Supreme Judicial Court held the state’s wiretapping act did not apply to the collection of users’ browsing activities on websites. In Vita v. New England Baptist, Massachusetts’ highest State Court held in a 5-1 decision that although the law did not define “communication,” it nevertheless was limited to communications between individuals and did not extend to cover a user’s browsing on a website. This decision, which is limited to the Massachusetts Wiretap Act, establishes that website operators can use tracking tools like Meta Pixel and Google Analytics to gather users’ browsing data without their consent, highlighting the limitations of the decades-old surveillance laws in addressing modern privacy concerns. Notably, several California courts have reached opposite conclusions under the corresponding California wiretapping laws (commonly known as CIPA Section 631(a)).
In the below article, we provide an overview and analysis of the Massachusetts Supreme Judicial Court ruling and the potential impact on the wave of privacy litigation ongoing in California Courts.
Background on the Wiretap Act
The Federal Wiretap Act prohibits unauthorized interception of wire, oral, or electronic communications by the government and private parties. The Act was initially enacted to combat organized crime by allowing law enforcement agencies to obtain judicial authorization to conduct wiretaps as part of criminal investigations. Under the Act, any interception of communications is generally prohibited unless one of the parties consents, or a Court order is obtained based on probable cause that the interception will reveal evidence of a crime. The Act establishes stringent procedures for obtaining such Court orders, including demonstrating necessity and minimizing the interception of irrelevant communications. Violations of the Wiretap Act can lead to both criminal penalties and civil liabilities, including fines and damages. The Act also provides for the suppression of unlawfully intercepted communications in court proceedings, thus safeguarding individuals’ privacy rights.
The Massachusetts Wiretap Law is more restrictive than its federal counterpart. Massachusetts law requires all-party consent for the interception of wire and oral communications, meaning that all individuals involved in a conversation must consent to its recording.
Lawsuit
The plaintiff alleged two healthcare centers violated the Massachusetts Wiretap Act by collecting and transmitting her browsing activities on their websites to third parties—including Google and Meta—for advertising purposes without her consent. The plaintiff claimed her interactions with the hospitals’ websites, such as accessing information about doctors and medical conditions, constitute “wire communications” protected by the Wiretap Act. Specifically, the plaintiff alleged the website transmitted at least thirteen categories of information, including
(1) the uniform resource locator (URL) of the webpages visited;
(2) the titles of those webpages;
(3) data about a user’s web browser and device configurations (e.g., screen resolution, device information, and browser settings);
(4) the unique identifiers used by third-party software providers to track individuals across the website (e.g., the Facebook ID);
(5) a user’s Internet protocol (IP) address;
(6) how, when, and where a user scrolled and clicked through different parts of a webpage
(7) whether a user navigated to a webpage containing a form for new patients requesting appointments, as well as the department the user selected, and whether the user submitted the form, although not the information the user entered into the form (with the exception of the department selection);
(8) the contents of any search a user made on the websites;
(9) the filtering criteria selected by a user on the “Find a Doctor” webpage, including specialty, location, gender, and language;
(10) whether the user “reserved a spot” in line at the hospitals’ urgent care;
(11) whether the user navigated to the webpage for paying medical bills;
(12) whether the user navigated to the patient portal where the user could access medical records and other personal medical information, although not the contents of records or communications within that portal; and
(13) whether, when navigating to the patient portal, the user clicked the “login” button for existing patients or the “sign up now” button for patients seeking to create new accounts.
Critically, however, the plaintiff did not allege any private patient records or communications with healthcare providers were intercepted.
The plaintiff alleged she personally accessed information on the hospitals’ websites concerning doctors’ credentials, backgrounds, and medical details such as symptoms, conditions, and procedures. She argued these interactions constituted “wire communications” protected under the Massachusetts Wiretap Act. Although the hospitals disclosed their use of cookies and data collection for website enhancement, the plaintiff argued these disclosures were incomplete and misleading.
After the plaintiff filed her complaint, both defendant hospitals filed a motion to dismiss for failure to state a claim. A trial judge denied both motions. The State Supreme Judicial Court granted the hospitals’ request for direct appellate review.
Massachusetts Supreme Judicial Court Decision
Justice Scott Kafker, writing for the majority, began with the plain language of the statute, which makes it a crime to “willfully commit[ ] an interception, attempt[ ] to commit an interception, or procure[ ] any other person to commit an interception or to attempt to commit an interception of any wire or oral communication.” Beginning with statutory construction, the Court found the statute did not define “communication” itself, “but rather the means or method of ‘communication’ – i.e., wire or oral.” The statue included examples, however, that “makes plain the Legislature’s intent to address at least conversations in person or over the telephone or person-to-person messages communicated through the use of wire or cables.” In contrast, the complaint alleged interception “communications” between the plaintiff and the hospital’s website, not any specific person within the hospital’s organization. That the Wiretap Act provided for criminal penalties as well was persuasive to the Court, which held it could not “conclude that the wiretap act unambiguously prohibits and, indeed, criminalizes the interception of web browsing activity, because there appears to be a difference in kind and not degree between interactions on a website available to the public and private conversations in your house or on your telephone.” The Court found browsing and accessing information published on a website to be “significantly different from having a conversation or sending a message to another person.”
The Court ultimately held the text of the Wiretap Act was “inconclusive at best as to whether website browsing is a ‘communication’ protected by the act” and next turned to the legislative history. The Court concluded in enacting the wiretapping act, the Legislature was chiefly concerned about the secret recording or monitoring of person-to-person communications.
The Court then examined whether case law had extended the meaning of “communication” beyond person-to-person interactions. The Court not only found case law had not extended the meaning of “communication” but had in fact rejected broad interpretation of the word that expanded the scope of the Wiretap Act well beyond the secret recording of private conversations the Legislature intended to prevent. Here, the Court distinguished both cases the plaintiff had cited—including the Ninth Circuit’s 2020 In re Facebook, Inc. Internet Tracking Litigation decision—and the Federal Wiretap Act itself by noting those “cases do not engage in depth, if at all, with the meaning of ‘communication.’” The Court also found the Federal Wiretap Act was amended in 1986 by the Electronic Communications Privacy Act to add coverage of “electronic communication,” which is defined as “any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photo optical system.” 18 U.S.C. Sec. 2510(12). The Court noted while this “broad definition of ‘electronic communication’ would appear to cover many website browsing activities . . . [the Massachusetts] wiretap act was never similarly amended to add a separate definition of ‘electronic communication.’” The Court further found the Federal act required only one-party consent.
Finally, the Court considered the “rule of lenity,” which requires ambiguities in criminal statutes be resolved in favor of the defendants. Once again, the Court was troubled that the law provided not only for civil suits with statutory damages but also potential criminal exposure. The Court held it “deem as communications the interception of which might lead to criminal penalties the act of simply running searches on the websites or accessing information about doctors published on the websites, as alleged by [the plaintiff]. These interactions with a website, as explained above, differ in material respects from person-to-person conversations and messaging. The website user is interacting with the website, not another person, and accessing publicly available data, not having a personal conversation or sending a personal message.”
The Court did not side entirely with the defendant hospitals, however. The Court repeatedly acknowledged the accused conduct was troubling and presented real issues. The Court noted plaintiff had other avenues to pursue any wrongdoing, such as claims for negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, right to privacy, and other laws.
In a dissenting opinion, Justice Dalila Argaez Wendlandt argued the hospitals misled patients by allowing third parties to track and monetize their healthcare information without consent. She stated “[w]ords matter” and because the legislature chose to cover “any communication” under the statute, it was improper for the majority to further limit that. The dissent found no difference between a user deleting dropdown filters to find a book an appointment with a physician on a website and the user doing the same by dialing a keypad and placing a call to the hospital using a telephone. Similarly, the dissent took issue with the majority’s position that a patient and a doctor discussing frequently asked questions could not be bugged “but when the hospitals create an electronic forum to allow that same information to be exchanged over the hospitals’ website, they can implant tracking code to record the discussion secretly and then sell the information to the highest bidder without recourse in the act.”
Takeaways
The Massachusetts Supreme Judicial Court’s decision comes after website owners have faced hundreds (if not more) of lawsuits that allege the use of industry standard website technology violates wiretapping laws in “two-party” consent states such as Massachusetts, Florida, and most notably California. These lawsuits have alleged implementation of website chat functionality, session replay technology, and tracking cookies each violate wiretapping laws.
This decision provides website owners some relief when operating in Massachusetts. Most lawsuits, however, have been filed in California. While neither the Massachusetts nor the California wiretap laws define “communication,” a nearby provision in California’s law—Section 632.7—broadly defines communication to include any transmission of voice, data, or image. Courts have repeatedly held that section is limited to communications between two telephones, however, and therefore does not apply to interactions with websites or the servers on which they operate.
Defendants in California courts will surely cite this decision from the Massachusetts Supreme Judicial Court, but it will remain to be seen whether California courts are willing to adopt the Court’s reasoning, which depended heavily on the intent of the Massachusetts Legislature.
[View source.]
