IAB backs Seattle Children’s Hospital in Washington wiretap case that could reshape ad measurement

The Interactive Promoting Bureau filed an amicus temporary as we speak with the Washington Supreme Court docket in Baker v. Seattle Youngsters’s Hospital, a case that might decide whether or not routine browser-to-server interactions on public web sites fall throughout the attain of a state wiretapping statute enacted in 1967. The temporary, submitted on April 10, 2026, at 2:47 PM by Orrick, Herrington & Sutcliffe LLP on behalf of IAB, positions the commerce group squarely alongside the hospital and towards a studying of the Washington Privateness Act that the IAB says would expose bizarre web site analytics and advert measurement to potential civil and felony legal responsibility.

The case started in October 2023, when three plaintiffs – Carly Baker, Janssen Ramos Savoie, and Amber Shavies – filed a putative class motion towards Seattle Youngsters’s Hospital (SCH). In accordance with the court docket file, SCH deployed Meta Platforms’ “Pixel” software program code on its public web site at www.seattlechildrens.org, a web site that permits guests to seek for details about medical situations, well being care suppliers, and providers. The plaintiffs alleged that Pixel intercepted their web site exercise in violation of RCW 9.73.030(1)(a), Washington’s privateness act, with out their consent.

What the Pixel truly does

In accordance with the Washington Court docket of Appeals opinion filed August 18, 2025, Pixel is designed to trace web site consumer exercise by capturing how guests work together with the web site, “together with clicks, textual content searches, web page views, and the webpage addresses that the consumer visits.” SCH used the collected data to assist its promoting efforts. The expertise additionally shares tracked information with Meta. When a consumer is logged into Fb whereas visiting SCH’s web site, in keeping with the opinion, “Pixel sends third-party cookies to Meta,” permitting Meta to hyperlink exercise information to the consumer’s distinctive Fb account. Even and not using a Fb account, Pixel transmits exercise to Meta with a novel identifier that may be linked to a present or later-created account, the grievance alleged, after which Meta can use that data for its personal focused promoting.

Every of the three named plaintiffs had a Fb or Instagram account after they used SCH’s public web site. Baker used the location to seek for medical situations and signs for her minor daughter, together with utilizing the web site’s search bar and situations webpage. Savoie looked for medical situations, signs, and well being care suppliers for her minor son utilizing the search bar and the “Discover A Physician” web page. Shavies looked for working hours for pressing care amenities. Some plaintiffs recalled receiving health-related ads on Fb after utilizing SCH’s web site, the grievance said.

The cookie consent discover

SCH was not silent about the usage of cookies. In accordance with the Court docket of Appeals opinion, a pop-up showing upon navigating to the location said: “By clicking ‘Settle for All Cookies,’ you comply with the storing of cookies in your system to reinforce web site navigation, analyze web site utilization and help in advertising and marketing efforts.” The plaintiffs’ place was that this disclosure was inadequate, and that SCH had secretly intercepted and recorded delicate well being data in violation of the privateness act.

The authorized argument on the core

Washington’s privateness act, chapter 9.73 RCW, is described within the Court docket of Appeals opinion as “one of the vital restrictive digital surveillance legal guidelines within the nation.” The statute makes it illegal to intercept or file any non-public communication transmitted by phone, telegraph, radio, or different system between two or extra people with out first acquiring the consent of all contributors. Violation may end up in each civil and felony legal responsibility beneath RCW 9.73.060 and .080.

The core authorized query is whether or not click-and-search exercise on a public web site constitutes “non-public communication” beneath that statute. In January 2024, SCH moved to dismiss beneath CR 12(b)(6) for failure to state a declare. After a February 2024 listening to, the trial court docket granted the movement and dismissed the grievance with prejudice. The plaintiffs then appealed. On August 18, 2025, the Washington Court docket of Appeals, Division One, affirmed the dismissal in an unpublished opinion authored by Choose Coburn.

The Court docket of Appeals relied on the Washington Supreme Court docket’s definition of “communication” established in State v. Riley, 121 Wn.2nd 22 (1993): the act of imparting or transmitting info or data. Making use of that definition, the court docket concluded that the plaintiffs didn’t allege they navigated SCH’s web site to transmit a message to or change data with one other get together. Reasonably, in keeping with the opinion, “they merely allege to have clicked and entered search phrases to retrieve publicly displayed data and webpages.” The court docket distinguished this from the “back-and-forth” textual content messaging the Supreme Court docket discovered plainly protected in State v. Roden, 179 Wn.2nd 893 (2014). As a result of the alleged interception “didn’t have an effect on different events or contain a number of invasions of privateness,” the Court docket of Appeals concluded the declare should fail.

The court docket explicitly restricted its holding: “We confine our holding to the info of this case and determine that the plaintiffs’ alleged click-and-search navigation of SCH’s public web site doesn’t fall throughout the statutory prohibition of RCW 9.73.030(1)(a).”

IAB’s amicus temporary: the technical argument

With the case now earlier than the Washington Supreme Court docket beneath case quantity 1045905, the IAB entered the proceedings on April 10, 2026, submitting a 2,726-word amicus temporary via Orrick. The counsel group included Marc R. Shapiro, Christopher J. Cariello, and Ned Hirschfeld from Orrick’s New York workplace at 51 West 52nd Avenue, alongside Robert M. McKenna and Aravind Swaminathan from the Seattle workplace at 401 Union Avenue, and Ian Hawkes from the Washington, DC workplace at 2100 Pennsylvania Avenue NW.

Michael Hahn, EVP and Common Counsel at IAB, introduced the submitting on LinkedIn, writing that the temporary explains “why an overbroad interpretation of the Washington Privateness Act – one which treats routine browser-to-server interactions as ‘non-public communications’ – would have sweeping and unintended penalties.”

The technical substance of IAB’s temporary facilities on the HTTP request-response cycle that underlies each web site go to. In accordance with the temporary, the interplay at challenge – “a browser’s GET request adopted by a server’s HTTP response, formatted as packets for transmission – is how any laptop accesses any data on any web site.” The temporary describes this as “the muse of the World Huge Internet.” A GET request, the temporary explains, is the kind of HTTP request that retrieves information from the server, akin to loading a webpage. The server then responds with an HTTP response containing particular bits of code.

IAB argues that the plaintiffs’ studying of the statute would imply that “each time anybody visits any web site for any purpose, they interact in a non-public communication with one other particular person (the web site’s server) beneath the WPA,” probably exposing web sites to legal responsibility for amassing information essential to type an web connection.

The temporary attracts a pointy distinction between the plaintiffs’ exercise and the form of person-to-person change the statute was designed to guard. In accordance with the IAB temporary, a Voice Over Web Protocol name, messaging utility change, or dwell web site chat – all of those “contain two individuals speaking, and the WPA protects their privateness.” However a browser accessing publicly posted content material “is an automatic interplay between gadgets, not an change between people.”

What IAB says is in danger for web sites

The temporary outlines a number of classes of routine web site operations that may be affected by the plaintiffs’ studying of the statute. Web site operators, it argues, analyze information of consumer connections to repair technological issues, troubleshoot complaints, assess and tackle safety considerations, and analyze content material reputation. These features require recording fundamental information about consumer connections. Below the plaintiffs’ studying, all of that may represent the interception of personal communications.

Critically for the advertising and marketing neighborhood, the temporary identifies advert measurement as a particular casualty of an expansive ruling. In accordance with the IAB temporary, “web sites should file and transmit to measurement distributors fundamental technical details about whether or not customers view or click on on an commercial in an effort to quantify its attain.” Advertisers, the temporary states, “demand that form of measurement and wouldn’t pay for ads with out it.” The temporary contends that even the only such information assortment could possibly be disrupted by the plaintiffs’ studying of the WPA.

The IAB additionally raises considerations concerning the consent workaround. Even when consumer consent remained a statutory protection, the temporary argues it will be “plainly unworkable for web site operators to safe shopper consent for each single packet transmission that facilitates web connectivity.” The analogy it attracts is to phone operators, who couldn’t feasibly search shopper consent for each electromechanical sign that facilitates a telephone name. Recording GET requests, the temporary states, “is the technological structure of the web.”

The legislative historical past argument

The IAB temporary additionally presents a statutory historical past argument. In accordance with the temporary, the Washington Privateness Act was enacted in 1967 to manage wiretapping of phone communications between callers. The Legislature subsequently made 4 rounds of slender amendments: in 1977, including one-party consent exceptions for emergencies, extortion threats, and nameless calls; in 1985, including an exception for hostage and barricade conditions; in 1986, increasing the emergency exception to incorporate medical emergencies and including emergency service personnel; and in 2001, addressing digital recording of custodial interrogations. None of those amendments entailed any dialogue of regulating the web, the temporary states.

The IAB contrasts this historical past with the Washington Legislature’s newer, focused method to web privateness via statutes just like the My Well being My Knowledge Act, chapter 19.373 RCW. That legislation, in keeping with the temporary, acknowledges that apps and web sites might acquire well being data over the web and requires “extra disclosures and shopper consent concerning the gathering, sharing, and use of such data.” Critically, it requires consent for sharing in lots of circumstances, however not the place corporations use information as “crucial to supply a services or products that the patron to whom such shopper well being information relates has requested” beneath RCW 19.373.030(1)(b). The IAB temporary argues this sort of focused, manageable consent requirement is workable exactly as a result of it applies to pick transmissions, not each GET request.

Why the end result issues for digital promoting

The IAB Diligence Platform, launched in August 2024 by IAB to assist the trade navigate the rising complexity of state privateness legal guidelines, displays the context wherein this case arrives. As of the beginning of 2025, fourteen US state privateness legal guidelines had been enforceable, with extra anticipated all year long. The IAB Tech Lab’s Accountability Platform, finalized in November 2024, established a framework particularly for validating consumer desire alerts throughout the digital promoting ecosystem.

The Baker case sits in a distinct authorized class than these consent frameworks – it considerations whether or not a decades-old wiretapping legislation, quite than a contemporary privateness statute, applies to the fundamental mechanics of how web sites serve content material. However a ruling within the plaintiffs’ favor on the Washington Supreme Court docket stage would prolong far past healthcare web sites. Any web site utilizing analytics instruments, pixel monitoring, A/B testing, efficiency monitoring, or advert measurement – all of which depend on recording browser-server interactions – would probably face publicity.

Germany’s wave of litigation against Meta’s tracking practices has proceeded beneath GDPR’s framework, the place information safety legislation explicitly governs these interactions. The Washington case is completely different: it asks whether or not a pre-internet wiretapping statute may be stretched to succeed in the identical conduct. The Thuringia Greater Regional Court docket awarded €3,000 in damages towards Meta on March 2, 2026, discovering that Meta’s Enterprise Instruments – together with Pixel – collected information with out legitimate consent. That ruling, nevertheless, rested on Article 9 GDPR and the particular protections for delicate well being information beneath European legislation, not on an analogy to wiretapping statutes.

Washington has additionally been lively on digital promoting regulation in different respects. Washington State enacted a sales tax on advertising services in 2025, positioning itself as the primary state to comprehensively tax digital promoting providers. And Washington’s Supreme Court docket is concurrently contemplating a separate case wherein the Digital Advertising Alliance filed an amicus brief in September 2025 defending a digital promoting firm dealing with a $35 million fantastic for alleged violations of the state’s Truthful Marketing campaign Practices Act.

For the advert tech trade, the Baker case represents a particular and pointed danger: that advert measurement infrastructure – the fundamental mechanism of recording whether or not a consumer noticed or clicked an commercial – could possibly be characterised as wiretapping beneath state legislation. The IAB temporary is direct about this, arguing that the plaintiffs’ building “might unduly chill these financial frameworks for freely out there, various web content material.” Promoting income, the temporary notes, “is the lifeblood of numerous small-scale publishers throughout the web, enabling them to make content material freely out there to customers.”

The Washington Supreme Court docket accepted the case for evaluation on January 8, 2026. No oral argument date has been publicly introduced.

Timeline

• 1967 – Washington Privateness Act enacted, chapter 9.73 RCW, regulating wiretapping of phone communications
• 1977 – First amendments add one-party consent exceptions for emergencies, extortion threats, and nameless calls
• 1985 – Second spherical of amendments provides exception for hostage and barricade conditions
• 1986 – Third amendments increase emergency exception to medical emergencies and add emergency service personnel
• 2001 – Most up-to-date pre-internet amendments tackle digital recording of custodial interrogations
• October 2023 – Carly Baker, Janssen Ramos Savoie, and Amber Shavies file putative class motion towards Seattle Youngsters’s Hospital in Washington
• January 2024 – SCH strikes to dismiss beneath CR 12(b)(6)
• February 2024 – Trial court docket holds listening to and grants SCH’s movement to dismiss with prejudice
• August 19, 2024 – IAB launches Diligence Platform to streamline privateness compliance throughout US state legal guidelines
• November 5, 2024 – IAB Tech Lab finalizes Accountability Platform for validating privateness alerts in digital promoting
• August 18, 2025 – Washington Court docket of Appeals, Division One, affirms dismissal in unpublished opinion No. 86461-1-I
• September 2025 – Washington State advertising services tax takes effect
• September 2025 – Digital Advertising Alliance files amicus brief in separate Washington Supreme Court docket promoting case
• March 2, 2026 – Thuringia Higher Regional Court awards €3,000 in GDPR damages against Meta for Pixel-based monitoring with out consent
• April 10, 2026 – IAB information 24-page amicus temporary with Washington Supreme Court docket in Baker v. Seattle Youngsters’s Hospital, Supreme Court docket No. 1045905, at 2:47 PM

Abstract

Who: The Interactive Promoting Bureau (IAB), as amicus curiae, within the case of Carly Baker, Janssen Ramos Savoie, and Amber Shavies v. Seattle Youngsters’s Hospital, with Orrick, Herrington & Sutcliffe LLP serving as counsel.

What: IAB filed a 24-page amicus temporary with the Washington Supreme Court docket arguing that the state’s 1967 Privateness Act, which prohibits intercepting non-public communications between people, shouldn’t be prolonged to cowl routine browser-to-server HTTP request and response interactions that underlie all web site entry – together with the pixel monitoringand advert measurement features central to the digital promoting trade.

When: The amicus temporary was filed on April 10, 2026, at 2:47 PM. The unique class motion was filed in October 2023. The Court docket of Appeals issued its unpublished affirmance on August 18, 2025.

The place: Washington Supreme Court docket, case quantity 1045905. The underlying occasions concerned the general public web site www.seattlechildrens.org, owned and operated by Seattle Youngsters’s Hospital, a Washington nonprofit company.

Why: IAB intervened as a result of a ruling adopting the plaintiffs’ studying of the Washington Privateness Act would expose web sites throughout the state to potential civil and felony legal responsibility for recording the fundamental HTTP packet transmissions that allow any web connection – a consequence the temporary argues would threaten analytics, safety features, efficiency monitoring, and the advert measurement infrastructure on which digital promoting relies upon.