Software like Meta Pixel and Google Analytics that website operators use to track what sites a person visits, or what footprint they leave on those sites, is not subject to the same restrictions as wiretapping a phone line, according to a split decision from the Supreme Judicial Court of Massachusetts, in a case brought against two hospitals.
The court in Vita v. New England Baptist Hospital, et al (SJC-13542), ruled that wiretapping and browser tracking are categorically different pursuits, in its eyes, unless the state legislature decides otherwise. “If the Legislature intends for the Wiretap Act’s criminal and civil penalties to prohibit the tracking of a person’s browsing of, and interaction with, published information on websites, it must say so expressly,” wrote Associate Judge Scott Kafker in the opinion.
In deferring to the defendants based on lack of clarity in the law, the court applied the rule of lenity (also called the rule of strict constuction), which might become a model for other courts deciding similar questions where wiretapping statutes are ambiguous in terms of their application to website technology.
And given that wiretapping statutes across states typically were written before website “cookies” used to track user behavior had been developed—so they had no reason to directly address such claims—the Massachusetts decision might jump-start efforts in state legislatures to do so; although unlike wiretaps, tracking software can offer a pop-up window with a disclosure that user data will be tracked and could be sold to third parties.
However, in the case of Vita filed by plaintiff Kathleen Vita, the hospitals in question, New England Baptist and Beth Israel Deaconess Medical Center, had suggested that patient privacy and data would be protected—a suggestion that prompted Associate Justice Dalila Wendlandt to call them liars in her dissenting opinion.
She also noted that the Massachusetts statute included the words “any communication” when describing what the law covers, asserting that’s more definitive than the majority opinion suggested; and she questioned why the law would treat an electronic communication from patient-to-doctor through a website differently than a phone conversation between those same parties—which the law clearly prevents from being bugged.
“The Legislature had the clairvoyance to choose these particular words to indicate that it was the tremendous power of electronic surveillance devices—like the tracking software at issue in the instant cases—to enhance the ability to snoop far beyond what could be done by the human ear alone that defined the scope of the act’s protections,” the dissent reads.
No doubt this will continue to be a developing area of the law as cases are brought in multiple jurisdictions in the coming months and years.