Washington Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 13, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 13, 2026.

Current Landscape

The supplied dataset labels Washington’s risk level as elevated and records one lawsuit, zero demand letters, and zero other tracked matters. These counts do not establish the volume of litigation statewide. The listed statutes are the Washington Privacy Act (Wash. Rev. Code § 9.73.030) and the My Health My Data Act (Wash. Rev. Code ch. 19.373).

The sole case summary concerns Baker v. Seattle Children's Hospital, a Washington Privacy Act dispute involving website use. Seattle Children’s Hospital’s answer asks the Washington Supreme Court to deny review of Division One’s unpublished ruling. The hospital characterizes that ruling as narrow and limited to the facts; this is the filing party’s characterization, not an independently established holding. The excerpt does not establish the substantive disposition, any standing determination, or whether Supreme Court review was granted.

Current Litigation Activity

Current litigation component: 17/100.

Important New Filings

• Baker v. Seattle Children's Hospital · October 8, 2026

Current Filing & Litigation Trends

One recorded lawsuit and no recorded demand letters provide too little information to establish a filing trend, growth rate, or recurring litigation pattern. The dataset lists a broad range of technologies, but does not connect individual technologies to specific allegations or holdings. The summarized filing is an answer opposing Supreme Court review, and the outcome of that review request is not supplied.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Washington Privacy Act — Wash. Rev. Code § 9.73.030 · all-party consent · private right of action · statutory damages
• My Health My Data Act — Wash. Rev. Code ch. 19.373 · private right of action

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Limited data

GPC / universal opt-out exposure component: limited data — this component is excluded from the overall risk guideline for this jurisdiction until researched (remaining components are reweighted accordingly).

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

The excerpt does not address Global Privacy Control or universal opt-out requirements.

GPC evidence confidence: 100%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Meta Pixel
• Cookies
• HTTP requests
• Website search and click tracking
• Duplicated HTTP GET requests
• First-party and third-party cookies
• _fbp cookie
• c_user cookie
• First-party cookies
• Third-party cookies
• Website search, click, and page-view tracking
• Unique identifiers linking website activity to Meta accounts
• third-party website tracking technologies
• Website clicks
• Website searches
• Automated website responses
• Website browsing
• Pixel
• Microsoft browser tracking software
• session replay
• Instagram
• Facebook
• Algorithmic feeds
• Age assurance
• Push notifications

Historical Risk Guideline

What Businesses Should Review

Businesses may consider documenting the tracking technologies deployed on Washington-facing websites, including cookies, pixels, session replay, third-party requests, and search, click, or page-view tracking. Review topics include disclosures, consent settings, tag configurations, data recipients, and identifiers that connect website activity to accounts. These are practical review suggestions based on the listed technologies, not court-established requirements or assurances about legal outcomes.

Data Quality

40 source(s), 20 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• RCW 19.373.010 — Washington State Legislature · Tier A (Primary authority)
• Answer to Petition to Review in Baker v. Seattle Children's Hospital — Courthouse News Service · Tier A (Primary authority)
• Washington State Courts - Opinions - Recently Filed — Washington State Courts · Tier A (Primary authority)
• Baker v. Seattle Children's Hospital — U.S. Chamber of Commerce · Tier D (Industry data)
• Petition for Review in Baker v. Seattle Children's Hospital — Washington Courts · Tier A (Primary authority)
• Zillow Users Can't Sue Over Microsoft Session Replay Tech — Law360 · Tier B (Authoritative secondary)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• Zillow Users Can't Sue Over Microsoft Session Replay Tech — Law360 · Tier B (Authoritative secondary)
• Wash. Justices Say Privacy Act Doesn't Bar Hospital Pixel Use — Law360 · Tier B (Authoritative secondary)
• T.S. v. Body Contour Centers, LLC — Order Granting in Part and Denying in Part Motion to Dismiss — Leagle — U.S. District Court, Western District of Washington opinion · Tier E (General web)
• Still Tracking, Still Suing: Website Privacy Litigation After SB 690 — Bass, Berry & Sims (via Mondaq) · Tier C (Professional analysis)
• Baker v. Seattle Children's Hospital — Washington Supreme Court Opinion — Washington Supreme Court (hosted by U.S. Chamber of Commerce) · Tier A (Primary authority)
• Baker v. Seattle Children's Hospital (2026) — FindLaw — Supreme Court of Washington opinion · Tier A (Primary authority)
• Zillow, Microsoft get US wiretapping claims dismissed — MLex · Tier B (Authoritative secondary)
• T.S. v. Body Contour Centers LLC — Order Granting in Part and Denying in Part Motion to Dismiss — U.S. District Court for the Western District of Washington, via Justia · Tier A (Primary authority)
• Baker v. Seattle Child.'s Hosp., No. 104,590-5 — Opinion Information Sheet — Supreme Court of the State of Washington · Tier A (Primary authority)
• Parents lose Meta Pixel wiretap case against Seattle Children's Hospital — PPC Land · Tier D (Industry data)
• Meta Pixel Lawsuits: What Courts Have Ruled, Case by Case (2026) — ConsentStack · Tier D (Industry data)
• State Supreme Court Rejects Parents’ Privacy Claim Over Seattle Children’s Website Tracking — Olympic Herald · Tier E (General web)
• Zillow, Microsoft Defeat Privacy Suit Over Consumer Data Sharing — Bloomberg Law · Tier B (Authoritative secondary)
• In Re: Zillow Group, Inc. Session Replay Software Litigation — Document 119 — U.S. District Court for the Western District of Washington, via Justia · Tier A (Primary authority)
• Zillow, Microsoft get US wiretapping claims dismissed — MLex · Tier B (Authoritative secondary)
• In re Zillow Group, Inc. Session Replay Software Litigation — Order on Motions to Dismiss — U.S. District Court for the Western District of Washington, via Leagle · Tier A (Primary authority)
• Baker v. Seattle Children's Hospital, No. 104590-5 — Majority Opinion and Concurrence — Washington Supreme Court · Tier A (Primary authority)
• Zillow Users Can't Sue Over Microsoft Session Replay Tech — Law360 · Tier B (Authoritative secondary)

All State Pages