Legal isn't the bar: what the Seattle Children's ruling doesn't settle

Last week a hospital won a pixel case. Its patients still lost.

On October 8, 2026, the Washington Supreme Court upheld the dismissal of a wiretap suit over the Meta Pixel on Seattle Children's Hospital's public website (Baker v. Seattle Children's). Parents had argued the Pixel captured their health-related searches and clicks and sent them to an ad platform. The majority held that the state Privacy Act protects communications "between two or more individuals," and that a search answered by the hospital's own automated system involves only one. On that reading, the statute does not reach it.

Read the decision closely before you treat it as permission.

What the court decided, and what it left open

The ruling is narrow by its own terms. The court did not find that the tracking was appropriate. It found that this one statute, read this one way, does not cover a person-to-machine exchange. It expressly left the consent question undecided, and it did not resolve whether these were private communications. It also noted that the hospital's cookie pop-up never named the Pixel or explained what it collected.

A dismissal on those grounds is a fence with a missing board. It holds until someone walks through the gap.

The result does not travel

A favorable reading of one state's wiretap law binds no one else. California's Invasion of Privacy Act applies a different test, and plaintiffs there have had more room to proceed. All-party-consent states start from a different baseline. None of this touches the HHS Office for Civil Rights, the Federal Trade Commission, or a state attorney general, each of whom can act on health data moving to a third party regardless of how a wiretap statute reads. One win on a motion to dismiss is not a compliance posture.

The cookie banner problem

The court's aside about the pop-up is the practical lesson. A generic banner that never names the tracker, never says what it collects, and never ties collection to a real choice gives you very little to stand on when the next complaint arrives. Consent that cannot be explained is not consent you can defend.

The riskiest surfaces on a health site

Search boxes, symptom checkers, and find-a-doctor tools are where intent becomes data. A query typed into any of them can reveal a condition, a provider, or a parent's fear about a child. Those are the first places to look, because they are the first places a tag can learn something a patient never meant to share.

Our rule for healthcare clients

We design to what you could explain to a patient's parent, not to what survives a motion to dismiss. In practice that means no third-party tag on any page or field that can show a condition, a provider, or a search query. Where measurement is needed, we move it server-side and strip identifying and health-related data before anything leaves your servers. The marketing team still gets its numbers. The ad platform never sees the patient.

A 30-day check for marketing and compliance to run together

• Inventory every third-party tag firing on the site, by page and by field.
• Flag any tag present on search, symptom-checker, scheduling, or provider-directory pages.
• Read the consent banner as a patient would: does it name the trackers and say what they collect?
• Confirm whether a decline actually stops collection, or only hides the banner.
• Move required analytics server-side, with health and identifying fields removed before transmission.
• Re-test the live pages, not the tag manager, and keep the capture as your record.

Surviving one statute is not a design standard. The next plaintiff will bring a different one. Build to what you would defend in front of the person whose data it is.

Sources: PPC Land, Law360.