Massachusetts Supreme Court Pops Plaintiff’s Pixel Proceeding

Companies commonly use tracking technologies – such as Meta’s “Pixel” software or “Google Analytics” – on their websites for various reasons. In numerous class actions across the country, plaintiffs have claimed that the use of these technologies violates various state and federal statutes. Among these are wiretap statutes, which were originally passed as early as the 1960s, well before this technology – or the Internet – even existed. On Oct. 24, the Massachusetts Supreme Court provided defendants a lifeline and a potential defense that could allow dismissal of certain wiretap statute-based claims at an early stage of the lawsuit.

The Claims

The plaintiff, Kathleen Vita, alleged that she visited New England Baptist Hospital’s and Beth Israel Deaconess Medical Center’s (the “Hospitals”) websites. While on the websites, she looked up doctors and their credentials, searched for information on symptoms, conditions and treatments, and used the patient portal.

Vita claimed that the Hospitals violated the Massachusetts Wiretap Act by tracking certain information while she and other users browsed the Hospitals’ websites including the URL of the webpages visited, device configuration information, and IP addresses. She claimed that this allowed the Hospitals to create a “browser fingerprint” from which the Hospitals and others could identify specific users. Vita further claimed that the Hospitals tracked (a) how, when, and where users scrolled and clicked, (b) whether a user navigated to a page containing a form for new patients, whether they selected a department on that form, and whether they submitted the form, (c) the contents of user searches, (d) filtering criteria used to find doctors, (e) whether users “reserved a spot in line” at urgent care, (f) whether users navigated to a page for paying bills, (g) whether users navigated to a patient portal, and (h) whether a user clicked “login” or “sign up” at the patient portal. Notably, Vita did not allege that any information within any patient portal – such as medical records – was tracked.

Vita further alleged that this tracking was done through software developed by third parties including Facebook (its “Meta Pixel” product) and Google (its “Google Analytics”). She claimed that the tracking software transmitted the information to these third parties who then sold the information to businesses and used it in targeted advertising.

Vita alleged that this tracking, recording, and transmission of her and other users’ information to third parties without the users’ consent or knowledge constituted a violation of the Massachusetts Wiretap Act.

The Massachusetts Wiretap Act

The Massachusetts Wiretap Act, originally signed into law in 1968, is a criminal statute that also provides an explicit private right of action. It prohibits intercepting a wire or oral communication, providing criminal and civil liability for anyone who willfully commits an interception, attempts to commit an interception, or procures any other person to commit an interception or to attempt to commit an interception of any wire or oral communication.

A “wire communication” is defined as “any communication made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception.”  However, the statute does not define “communication.”

The Decision

The Massachusetts Supreme Court was tasked with reviewing the lower court’s denial of the Hospitals’ Motions to Dismiss. After finding that the lower courts were correct that Vita had standing, the Court turned to whether Vita properly pled claims under the Massachusetts Wiretap Act.

The Massachusetts Supreme Court’s decision on the Wiretap Act turned on whether Vita alleged a “communication.” Because “communication” is not defined, the Supreme Court analyzed the language of the Massachusetts Wiretap Act to determine whether the use of “communication” in the Wiretap Act was intended to include an individual’s interactions with websites. The Court reviewed several other examples of the use of the term “communication” within the Wiretap Act and found those examples all reflected person-to-person communications, like phone calls and private conversations. The Court, therefore, could not find that the language unambiguously included browsing activities as “communications” under the statute, finding that “[b]rowsing and accessing the information published on a website is significantly different from having a conversation or sending a message to another person,” and that difference was one of “in kind and not degree.” The Court then reviewed dictionary definitions but found them similarly unhelpful in this context. The Court then considered the Wiretap Act’s legislative history.

The Court explained that “[f]rom the very beginning, the Legislature repeatedly referred to eavesdropping on private conversations and the use of covert electronic recording devices that could be placed in a home or business or used to tap a telephone.” Committee reports discussed the use of various eavesdropping devices, commonly known as “bugs;” the interception of customer-to-customer phone calls; and the recording or listening in on private conversations. The Court therefore concluded that “this legislative history is therefore directed at the invasion of privacy and threat to free expression from secret surveillance of private conversations,” and focused on the “secret inception of person-to-person communications.”

The Court went on to explain that its “case law has never extended the meaning of “communication” beyond person-to-person interactions.” In distinguishing cases under the Federal wiretap act, the Court noted that those cases broadly defined “electronic communication” rather than “communication.” The Court also noted other differences in the Federal wiretap act, including that it provides for a one-party consent exception.

Finding that neither the Massachusetts Wiretap Act’s text or legislative history, nor the Supreme Court’s own case law, stated conclusively that browsing and interacting with a website constituted a “communication” within the meaning of the Act, the Court held that the Hospitals were “entitled to the benefit of any rational doubt” under the rule of lenity applicable to criminal statutes. Noting that the Wiretap Act does not distinguish medical information from other information, the Court stated that reaching the opposite conclusion would also criminalize transmitting website browsing and interaction data from music or sports websites.

While dismissing Vita’s claims against the Hospitals, which were based on the Massachusetts Wiretap Act alone, the Court pointed out that there are “other statutory and common-law causes of action to address allegedly false, misleading, or deceptive activity on the Internet, including statutory and common-law protections more directly applicable to misrepresentations or misuse of private medical information.”

One judge dissented from the opinion, suggesting that website browsing and other interaction data are akin to a “virtual customer service representative or healthcare provider,” and therefore should be considered a “communication” under the Massachusetts Wiretap Act. The dissent further called for “the Legislature [] to correct today’s error.”

Conclusion

While this decision only addresses the Massachusetts Wiretap Act and notes some differences between that act and its federal counterpart, the reasoning could apply to other wiretap statutes. If courts in other states follow and apply this reasoning to their state wiretap statutes, that could severely limit plaintiffs’ claims relating to website tracking technologies. Nonetheless, as the Court noted, there are other potential statutory and common law claims that may still cover complaints about the violation of privacy rights by website tracking technologies.

Given that the Massachusetts Court declined to step into the role of the legislature and refrained from changing the statutory language to include website tracking technologies, legislative action to change the relevant statutory language in Massachusetts and elsewhere could be coming.

While this ruling is a welcome one for defendants in these types of cases, businesses using these technologies should be aware of the risks involved and talk to their legal advisors about ways to try to mitigate those risks.

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.