Washington Privacy Act: RCW 9.73, Website Tracking and the Limits of All-Party Consent

On October 8, 2026, the Washington Supreme Court affirmed dismissal of a Meta Pixel claim in Baker v. Seattle Children’s Hospital. The result gives website operators an important defense under Washington’s communications privacy statute. It also leaves a distinction that businesses need to examine carefully: automated website interactions and communications involving people do not necessarily present the same claim but we are seeing millions of dollars in settlements being paid out over privacy lawsuits with cases going both ways and no end in sight.

Chapter 9.73 RCW, commonly called the Washington Privacy Act, belongs in Captain Compliance’s privacy lawsuit series alongside CIPA, federal ECPA and the communications laws of Pennsylvania, Illinois, Ohio and Florida. Its all-party consent requirement is strict for covered private communications. But coverage comes first. A claim cannot skip the statutory requirements simply because tracking technology collected information a visitor considers sensitive.

A useful Washington assessment therefore examines both the communication and the technology. Identify who was communicating, whether the exchange was private, what was intercepted or recorded and how consent was obtained. Then review other applicable privacy laws independently. A successful defense to an RCW 9.73 claim does not establish that a deployment satisfies health-data, consumer-protection or other communications laws.

What RCW 9.73.030 requires

RCW 9.73.030 generally prohibits interception or recording of covered private communications or conversations without first obtaining all participants’ consent, subject to the chapter’s exceptions. Subsection (1)(a) concerns private communications transmitted through telephone, telegraph, radio or another device between two or more individuals. Subsection (1)(b) separately addresses private conversations. Individuals, corporations and other listed entities can be subject to the prohibition.

The provision also contains a specific consent mechanism: an announcement to all other participants, in a reasonably effective manner, that the communication or conversation is about to be recorded or transmitted. If the conversation is recorded, the announcement must be recorded too. Certain emergency, threatening and other specified communications have one-party exceptions.

The practical inquiry is more precise than asking whether a site uses cookies. Recording a private conversation can occur without a cookie, and setting a cookie does not automatically establish interception of a protected communication. The assessment must connect the deployed component to the conduct the statute regulates.

The statute’s all-party rule also differs from obtaining authorization from a vendor customer alone. A business may approve a tool without resolving whether the other participants gave the consent required for the particular exchange. The legal review should identify each participant and the evidence of their notice or consent.

Baker v. Seattle Children’s Hospital: the new website-tracking decision

In Baker v. Seattle Children’s Hospital, No. 104590-5 (Wash. Oct. 8, 2026), parents alleged that Meta Pixel transmitted searches and clicks from the hospital’s public website. The court concluded that those interactions involved an individual and an automated corporate system, rather than two or more individuals, and affirmed dismissal of the RCW 9.73.030(1)(a) claim.

The court did not decide whether the searches were private. It confined its review to the public-website activity at issue, left the circumstances of entities communicating through individuals unresolved, and did not decide the other claims that were not pursued on appeal. A separate concurrence agreed with the result while taking a different approach to privacy and communications through corporate employees.

For a website operator, the first review question after Baker is the nature of each interaction. A public search box returning stored content, a message intended for a staff member and a live support exchange deserve separate entries in the data map. Treating all three as one “website communication” would conceal facts relevant to the legal analysis.

The same distinction matters for a claimant. A network trace can show a transmission, but the complaint still needs to identify a communication that fits the asserted provision. The presence of a sensitive search term does not dispense with the requirement concerning participants. Conversely, the fact that software carries or stores a message does not answer whether the message was directed between people.

Our practical recommendation is to classify interactions before making a sitewide decision about controls. Retain the evidence supporting each classification: screenshots, message-routing configuration, recipients and the relevant transmission records. The defense should rest on the deployed workflow rather than the broad description that a business operates an automated website.

Why live chat and messages to staff need separate analysis

Consider three hypothetical uses of the same hospital website. A visitor searches for clinic hours and receives an automated page. A patient writes a message intended for a nurse. Another visitor starts with an automated assistant and then moves into a conversation with an employee. These examples are different workflows, not descriptions of the hospital’s actual configuration in Baker.

For the nurse-directed message, document where the submission goes and who is expected to receive it. For the mixed chat, record the point at which a human joins and whether the earlier transcript is carried into that exchange. The legal analysis should consider those facts instead of assuming that the initial presence of a bot determines the entire session.

Recording functionality also needs a separate inventory. A chat application may retain its own transcript while a replay tool copies the same message field to another service. An AI component may receive the transcript for a distinct purpose. Identify each recipient, the scope of capture and the authorization relied on. A general description of the system as “customer support” can hide several different processing operations.

These examples warrant legal review; they do not predict a court’s result. In particular, asynchronous delivery, corporate ownership of the platform and later human access should not be reduced to a simple technical slogan. Explain the intended exchange and the role of the system carrying it.

Kipp: privacy depends on the circumstances

In State v. Kipp, 179 Wn.2d 718 (2014), the Washington Supreme Court held that a secretly recorded conversation was private and should have been suppressed. It explained that privacy involves a manifested subjective intention and a reasonable expectation. Relevant circumstances include duration, subject matter, location, the presence or potential presence of third parties and the relationship between the participants. With undisputed facts, the privacy question was reviewed as a matter of law.

The case concerned a conversation, not a marketing pixel. Its relevance is the need to examine context after identifying a potentially covered exchange. A private medical discussion, a broadly accessible public statement and routine information shared in front of others need not create the same expectations.

For digital communications, retain the interface and surrounding representations. A message window labeled for confidential support may create a different factual record from a public comment forum. Terms describing access, retention and disclosure also warrant review alongside actual behavior. A statement promising a limited audience is difficult to reconcile operationally with an integration that supplies the same transcript to unrelated services.

Do not use the appearance of a public website as a substitute for examining the particular interaction. A publicly accessible page can host different functions. The review should identify whether the user was reading content, posting publicly or directing information into a narrower exchange.

Townsend: knowledge of recording can support implied consent

State v. Townsend, 147 Wn.2d 666 (2002), involved email and real-time ICQ messages exchanged in a police operation. The Supreme Court treated the communications as private but concluded that Townsend impliedly consented to their recording. The decision considered the technology’s recording features and notice about its operation. It illustrates that privacy and consent are separate questions: a communication can be private and nevertheless lawfully recorded with the required consent.

That reasoning should be applied to the actual functionality and disclosures. A visitor’s knowledge that a service retains a message does not necessarily explain every additional recording or recipient. Record what the user was told, which feature they used and which capture the company says that conduct authorized.

A useful product review distinguishes a transcript necessary to deliver a messaging feature from optional monitoring attached to the page. The first may have a clearer connection to the user’s knowledge of the service. The second needs its own explanation. This is a factual distinction for assessment, rather than a rule that one category is always permitted and the other always prohibited.

For a consent defense, the company should preserve the version of the disclosure presented to the particular participant. A policy available somewhere on the website is different evidence from an announcement or notice delivered in the interaction. The defense becomes more concrete when it can connect the user’s conduct to the relevant information about recording.

Roden: consent to storage does not automatically authorize interception

In State v. Roden, 179 Wn.2d 893 (2014), a detective used a seized phone to read and respond to messages intended for its owner. The Washington Supreme Court found an unlawful interception and reversed the conviction. It distinguished Townsend: the issue was interception of messages directed to an actual acquaintance, rather than recording messages sent to the recipient’s online profile.

The court also rejected the premise that the possibility of access defeated privacy. The technical ability to read a message does not, by itself, establish permission to acquire it. Roden is a law-enforcement case, but the distinction between expected storage and another actor’s interception is useful when assessing communications tools.

For businesses, map access rights and routing separately from retention. A platform retaining a customer’s message, a support employee opening it and a third-party component acquiring a copy are different actions. Document the basis for each rather than treat the existence of a stored record as blanket authorization.

Calling a transfer an “integration” does not describe the recipient’s role. Examine whether the service delivers the intended exchange, analyzes it for the business, reuses it independently or performs several of those functions. A contract and a technical capture can provide different parts of that factual record.

Garner v. Amazon: accidental voice capture raises another consent question

In a March 31, 2026 summary-judgment order in Garner v. Amazon.com, Inc., No. 2:21-cv-750, Judge Robert Lasnik distinguished deliberate commands to Alexa from “false wake” recordings of household communications. For the Washington plaintiff, the court found that Amazon had not established implied consent to the pre-lawsuit false-wake recordings as a matter of law. It treated later recordings differently in light of the plaintiff’s knowledge after filing suit.

The ruling was an interim disposition addressing the record before the court, not a final liability finding. It also rejected reliance on the mere online availability of policies as proof of that particular plaintiff’s notice. Its practical relevance is the difference between choosing to address a device and having the device capture a separate conversation.

For an illustrative voice-assistant deployment, identify the activation conditions, buffer behavior and steps for handling unintended capture. Determine whether guests or other speakers receive the same notice as the account holder. A purchaser’s agreement is not a substitute for understanding who may be recorded.

Meeting assistants and call-transcription tools deserve a similar review. Preserve the announcement, participant settings and recording state. Inspect whether capture begins before the notice or continues beyond the intended interaction. These recommendations address the execution evidence; they do not assume every transcription product operates in the same manner.

Washington’s civil damages formula has a cap, not a $1,000 floor

RCW 9.73.060 authorizes a civil action by a person claiming that a violation injured their business, person or reputation. It provides actual damages, including mental pain and suffering, or liquidated damages calculated at $100 per day of violation, not exceeding $1,000, together with reasonable attorneys’ fees and litigation costs. It reaches violations committed directly or through an agent.

That formula differs from provisions in this series that use a minimum liquidated amount. On the face of Washington’s daily formula, five violation days would produce $500 and twenty would reach the $1,000 cap. Those illustrative calculations do not determine liability, injury, class membership or the proper unit of recovery. The cap also does not mean that all potential exposure, including actual damages and fees, is limited to $1,000.

RCW 9.73.050 separately addresses inadmissibility of information obtained in violation of the recording provision, subject to its specified exceptions. RCW 9.73.080 generally classifies a violation of RCW 9.73.030 as a gross misdemeanor. Civil damages, evidence rules and criminal provisions should not be combined into a single automatic penalty calculation.

When reviewing a demand, identify the asserted injury and recording event before evaluating the requested amount. A vendor count or page-view total is not a damages analysis. Preserve the relevant records while counsel examines the statutory theory and any accompanying claims.

How RCW 9.73 compares with CIPA, WESCA, Illinois, Ohio and Florida

The comparison draws on California Penal Code Section 631, Pennsylvania Chapter 57, Illinois Section 14-2, Ohio Section 2933.52 and Florida Section 934.03. It summarizes selected provisions and issues rather than every defense.

A useful comparison case is Popa v. Harriet Carter Gifts (3d Cir. 2022), which rejected a broad WESCA exemption based on the vendor’s direct receipt of browser communications. Its March 2026 development concerned federal standing and remand to state court. Neither event can be substituted for analysis of Washington’s text.

Also distinguish Popa v. Microsoft Corp. (9th Cir. 2025). That Microsoft Clarity case originated in Pennsylvania, proceeded in federal court in Washington and involved Pennsylvania WESCA claims. The Ninth Circuit affirmed dismissal for lack of Article III standing. Its location in a Washington federal court does not turn it into an RCW 9.73 holding.

The operational evidence can be shared across these reviews, but each claim requires its own legal analysis. Establishing a recipient, payload and capture time is useful in several jurisdictions. The applicable consent standard, covered communication and available remedies may still differ substantially.

My Health My Data requires a separate review

Washington’s My Health My Data Act is in Chapter 19.373 RCW, a separate framework from the communications statute. For covered processing, RCW 19.373.030 restricts collection and sharing of consumer health data, with consent or a requested-product-or-service necessity route. Sharing consent must be separate and distinct from collection consent when that consent route is used. The provision also specifies disclosures and prior timing for the required consent.

The definitions include health-related information linked or reasonably linkable to a consumer and certain derived or inferred data. The exemptions include specified information governed by HIPAA and other listed frameworks. Assess the actual data and processing rather than assuming every hospital interaction is covered or that a healthcare organization has blanket immunity.

RCW 19.373.090 connects violations to Washington’s Consumer Protection Act. This provides another reason to distinguish a defense under the communications law from the analysis of health-data processing. The frameworks have different triggers and enforcement routes.

In an illustrative wellness or health-search workflow, identify whether the information sent to a recipient can connect a consumer with a condition, symptom or effort to obtain care. Examine identifiers alongside the event, not in isolation. The answer may depend on context, recipient capabilities and exemptions, rather than the label “analytics.”

For teams using advertising on health-related pages, review the purpose and necessity of each transmission before deciding whether to retain it. A generic measurement category may be too broad to explain the processing. A consent signal also needs to correspond to the particular choice required by the relevant law.

Build a Washington review around the actual interaction

Inventory public searches, forms, live chat, staff-directed messages, voice features and authenticated areas as separate workflows. For each, identify the intended participants and the recording or transmission components. Include browser tools, embedded frames and server-side forwarding. The legal theory should refer to a communication the technical review can identify.

Capture behavior before any choice, after rejection, after acceptance and after withdrawal. Include direct entry to sensitive pages and transitions from automated assistance to a human. Record the notice version, choice, configuration version and observed requests together. A consent record is more useful when execution evidence shows what it controlled.

Test masking at the point of capture. A playback interface hiding a field does not independently establish that the underlying information never reached the vendor. Examine message text, page addresses, event names and dynamically added elements. Treat a vendor’s general documentation as a starting point for testing the deployed settings.

For recorded conversations, preserve the announcement and its timing. Check who receives it and whether later participants receive appropriate notice. Where the business relies on knowledge or implied consent, identify the facts supporting that knowledge for the person whose communication was acquired. An account holder and another speaker may have different records.

When a demand arrives, preserve historical configurations before making changes. Separate what a network capture establishes from inferences about participants, privacy or consent. Identify whether the claim concerns automated browsing, a person-directed message or a recorded conversation. Then examine each accompanying statute independently.

Where Captain Compliance fits

Captain Compliance’s consent management workflows and website scanning support the operational record: which technologies are deployed, which configured conditions govern activation and what choices visitors make. Our tracking-risk controls help organizations connect disclosures and consent with the code and vendors behind the interface.

Those tools should be paired with review of message routing, recording announcements and any server-side processing outside a browser scan’s scope. A consent platform does not decide whether an exchange is private or whether it involves the participants required by RCW 9.73. A scanner also cannot establish what every participant heard before a recorded conversation.

A useful compliance record explains the interaction, identifies the capture and shows the permission or other legal basis the business relies on. It also supports changes when a new vendor or feature alters the flow. Book a demo to review how Captain Compliance can help maintain those tracking, consent and evidence controls.