Massachusetts’ Top Court Rejects Privacy Arguments, Holds that Hospital Website Tracking is Not a Wiretap

In a recent decision, the Massachusetts Supreme Judicial Court held that the transfer of personal information via embedded tracking technology like a pixel from a hospital website does not constitute wiretapping under the state’s Wiretap Act.

Tracking technologies like pixels are placed on websites form third parties, often Meta and Google, that collect personal information about a user without their knowledge. When these pixels are placed on health-related websites, like a hospital’s webpage, they can collect highly sensitive user information that can reveal heath characteristics. Massachusetts’ Wiretap Act prohibits surreptitious interceptions of communications.

In this case—Vita v. New England Baptist Hospital—the plaintiffs alleged that the collection and disclosure of their personal information via pixels on hospitals’ websites constituted an intercepted communication because information about their health conditions were shared without their authorization. In a blow to privacy protections for consumers, the court said that transferring information via a pixel was not a communication under the law.

A dissenting opinion explained that the hospitals’ disclosures about data collection were misleading so that individuals could not understand the extent of third-party tracking, and that it is difficult to apply a pre-internet law to modern internet activity. The case underscores the need for baseline privacy protections and highlights the ubiquity of third-party tracking technologies, which remain largely unknown to the average internet user.

EPIC joined an amicus brief filed by the National Consumer Law Center in the case, urging the court to consider that state wiretap acts are often a powerful way to limit harmful online tracking and that Google and Meta’s collection of personal information from hospital websites is an injury to consumers.