In a long-awaited decision affecting the scope of privacy protections in Massachusetts, on October 24, 2024, the Massachusetts Supreme Judicial Court (“SJC”) held that collecting and transmitting user browsing activities, through tracking software such as Meta Pixel or Google Analytics, does not violate the Massachusetts 1968 Wiretap Act (the “Act”) and ordered the dismissal of a putative class action lawsuit. The SJC’s 5-1 decision in Vita v. New England Baptist Hospital eliminated the possibility of holding a hospital system liable under the Act for its use of third-party tracking technologies on its website to collect browsing data. This ruling has broad reaching repercussions since, as stated by the majority, similar tracking tools are “commonly employed” across a wide variety of fields and industries. Indeed, the SJC’s decision represents a victory for businesses amidst a recent surge in nationwide consumer privacy class action lawsuits alleging wiretap violations against website owners and seeking significant statutory damages.
Background on Massachusetts’ Wiretap Act
Massachusetts’ Wiretap Act, which is more protective than its federal counterpart, requires consent from all parties to a communication or conversation before it can be recorded. More specifically, the Act prohibits individuals from “willfully commit[ing] an interception, attempt[ing] to commit an interception, or procur[ing] any other person to commit an interception or to attempt to commit an interception of any wire or oral communication.” M.G.L. c. 272, § 99(C)(1).
Violations of the Act can result in both criminal penalties and civil liability, including hefty fines and punitive damages. The Act further provides for statutory damages regardless of whether the aggrieved person suffered any actual damages.
The Lawsuit and SJC Decision
In the two companion cases brought before the SJC, Plaintiff Kathleen Vita alleged that two hospitals maintained websites through which they tracked various information related to Vita’s interactions with the webpages without her consent, including searches she made within the websites regarding doctors and medical conditions. Vita further alleged that this tracking was accomplished through third party software, such as Meta Pixel and Google Analytics, which allowed both the hospitals and third-party service providers to track website user activity in violation of the Act.
The SJC disagreed. In a 47-page decision, the SJC held that the statute’s undefined term “communication” was ambiguous as applied to the alleged web browsing activities. Referring to both the statutory text and legislative history, the Court differentiated between traditional “person-to-person” communications, such as a telephone call, and accessing and interacting with a particular webpage. The majority found that the alleged conduct did not involve communicating with another person in the traditional sense, but rather interacting with a website to access publicly available and pre-generated content. In light of the significant potential criminal penalties associated with wiretap violations, the SJC applied the rule of lenity to find that the alleged website interactions did not constitute “communications” and therefore were not entitled to the protections of the Act.
The majority’s position was sharply critiqued by the dissent, which rejected the distinction between person-to-person communications and web browsing. The dissent argued that the Act broadly applied to “any communication.” The dissent reasoned that the activities in question were analogous to communications traditionally covered by wiretap legislation, such as communications with a “customer service representative or healthcare provider” regarding medical questions and responses, such that browsing activities recorded without consent should fall within the protections of the Act. The dissent concluded that as a result of the majority’s opinion, further legislation would ultimately be needed to “correct [the Court’s] error.”
Takeaways
The SJC’s decision provides some measure of reassurance for companies utilizing third-party tracking software on their websites. However, the decision similarly underscores the need for companies to focus on their privacy compliance efforts as their websites will be subject to a patchwork of rapidly evolving state and federal laws. The Vita decision only applies the Massachusetts Wiretap Act, not to the Federal Wiretap Statute or other state wiretapping laws, such as the California Invasion of Privacy Act. It is unclear whether other states will follow the SJC’s conclusion in this case.
Moreover, as the SJC makes clear in noting that the defendants’ alleged conduct may have violated other statutes and given rise to common law causes of action, there are a variety of other statutory and common-law causes of action that may apply to similar conduct in lieu of bringing claims under the Act. For example, the string of similar class action lawsuits have also asserted claims under the following statutes and/or theories:
- G.L. c. 214, § 1B (the Massachusetts invasion of privacy statute)
- Breach of fiduciary duty and/or common law duty of confidentiality
- Breaches of express and implied contract
- Unjust enrichment
Finally, this is a continuously developing field, especially as it remains unclear whether the Massachusetts legislature will act on the SJC’s implicit call to action and enact privacy legislation specifically addressing similar tracking software and surveillance tools.
