Tracking Web Users Does Not Violate Wiretap Law, Massachusetts High Court Rules
A firm’s use of software that tracks users’ activity on its website does not violate a state law against wiretapping, the Massachusetts Supreme Judicial Court has ruled.
While the state law against wiretapping prohibits intercepting communications, the high court found that the law is ambiguous as to whether website browsing activity is communication covered by the law. “If the legislature intends for the wiretap act’s criminal and civil penalties to prohibit the tracking of a person’s browsing of, and interaction with, published information on websites, it must say so expressly,” the court declared.
The court dismissed the wiretap violation claims bought by Kathleen Vita against New England Baptist Hospital (NEBH) and Beth Israel Deaconess Medical Center, Inc. (BIDMC), reversing a Superior Court.
While it dismissed the wiretap claims, the court said that there may be other causes of action in such cases and it does not want to minimize the “serious threat to privacy” presented by the tracking of website browsing activity.
Wiretap Law
The wiretap act makes it a crime to “willfully commit an interception, attempt to commit an interception, or procure any other person to commit an interception or to attempt to commit an interception of any wire or oral communication.”
Vita alleged that the hospitals collected information about her accessing and reviewing public information on their websites regarding doctors’ credentials and various medical conditions and procedures, and she claimed that these interactions with the websites fell within the meaning of “wire communications” protected by the wiretap act. She also alleged that the hospitals sold her browsing information to third parties for advertising purposes without her consent.
The complaints cited the hospitals’ use of software including Meta Pixel and Google Analytics to collect and sell the information to merchants who, in turn, use it to deliver targeted digital advertisements.
Vita did not allege that any private patient records or messages to nurses, doctors, or other healthcare providers were intercepted, a fact that the high court emphasized. “If such communications were intercepted, these would be much different cases,” the opinion states.
The Supreme Judicial Court noted that when the statute was enacted, wiretaps involved the interception of person-to-person conversations and messages using hidden electronic surveillance devices placed in people’s homes or businesses or tapping their telephone lines. The legislature’s chief concern in enacting the wiretap act was “electronic eavesdropping” and wiretapping.
The court found that the legislature crafted the statute to prohibit new and evolving technological means of secret electronic eavesdropping, whether they be face-to-face conversations, calls on a landline telephone, cell phone calls, text messages, Internet chats with other people, e-mail messages, or other interpersonal conversations or messaging utilizing future technology.
However, the court stressed, the allegations against the hospitals do not claim the interception of person-to-person conversations or messaging of the kind clearly within the wiretap act’s ambit. The interactions in this case are not with another person but with a website. Nor are they personal conversations or messages.
“In essence, we are not here dealing with just new means of communication, such as the difference between communicating with another person on a cell phone rather than a landline, or a text message rather than a telegraph message. Browsing and accessing the information published on a website is significantly different from having a conversation or sending a message to another person,” the opinion by Justice Scott Kafka stated.
Legislative Intent
The court found that nothing in the text or legislative history of the statute suggests that the legislature intended to reach so far as to criminalize the secret recording of web browsing activities. Because the statutory language meaning of “communication” in this context is ambiguous, the hospitals are “entitled to the benefit of any rational doubt,” the court concluded.
Pushing back on a vigorous dissent, the majority said it is not ignoring the “business realities” of the use of tracking tools that support an advertising-based business model that is so common on the Internet but that it “will not impose penalties of up to five years in prison on activity that has not been clearly defined to be criminal.”
The high court majority also suggested there may be other remedies.
“Make no mistake, the hospitals’ alleged conduct here raises serious concerns, and may indeed violate various other statutes and give rise to common-law causes of action more specifically directed at the improper handling of confidential information, particularly confidential medical information. And we do not in any way minimize the serious threat to privacy presented by the proliferation of third-party tracking of an individual’s website browsing activity for advertising purposes. These concerns, however, should be addressed to the Legislature,” the court added.
Dissenting Opinion
Justice Dalila Argaez Wendlandt in a dissent disagreed that the act is “hopelessly ambiguous and unable to protect against the surreptitious recordings” that occurred in the case. She argued that the law covers “any communication” and does not limit protections to the “person-to-person conversations or messaging.”
“When a patient telephones the doctor’s office to schedule an appointment, that conversation cannot be recorded secretly by a modern surveillance device under the act; but when that same exchange occurs on a website designed to facilitate such scheduling, it bewilders the court to conclude that the act extends so far,” she wrote in her dissenting opinion.
Wendlandt stressed that the websites are interactive and that the information collected includes search terms, particular medical conditions and treatments, preferences for physicians, appointment scheduling, and the hospitals’ responses to queries. “The result is a personalized exchange of information specific to the patient’s healthcare inquiries and needs,” the dissent maintained. The hospitals promised confidentiality and then secretly allowed third parties to record this healthcare information and “create detailed portraits of the patients’ medical needs and to monetize this information for advertisements targeted to those patients.”
The dissent agreed with the majority in one sense. “Lamentably, the court is right about one thing; the Legislature will need to correct today’s error,” Wendlandt wrote.