Massachusetts Supreme Judicial Court Holds that State’s Wiretap Act Does Not Apply to Website Browsing Tracking Claims

The Supreme Judicial Court of Massachusetts (the “SJC”) has held that the state’s wiretap act does not prohibit the tracking of a person’s browsing of and interaction with published information on websites. Kathleen Vita v. New England Baptist Hosp., No. SJC-13542 (Mass. Oct. 24, 2024).

On behalf of herself and a purported class of similarly situated persons, the plaintiff alleged that two Massachusetts-based hospitals violated G.L. c. 272, § 99, the state’s wiretap act, by collecting and transmitting browsing activities on the hospitals’ websites. Specifically, she alleged that the hospitals’ websites contained tracking software that allowed the hospitals and third parties to track user activity on the websites, which the third-party software providers then used to deliver targeted digital advertisements tailored to individual users. The plaintiff did not allege that any information contained in either hospital’s patient portal was intercepted or transmitted to others. The trial court denied the hospitals’ motions to dismiss the plaintiff’s claims.

The SJC granted an application for direct appellate review and reversed the trial court’s denial of the hospitals’ motions to dismiss.

As an initial matter, the court determined that the plaintiff had established standing because she alleged a particular, personalized, nonspeculative injury arising from an alleged violation of the statute. However, based on its review of the text of the wiretap act and its legislative history, the SJC could not “conclude with any confidence that the Legislature intended ‘communication’ to extend so broadly as to criminalize the interception of web browsing and other such interactions.”

The Massachusetts wiretap act makes it a crime to “willfully commit[] an interception, attempt[] to commit an interception, or procure[] any other person to commit an interception or to attempt to commit an interception of any wire or oral communication.” The statute defines “wire communication” as “any communication made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception.” “Oral communication” means “speech, except such speech as is transmitted over the public air waves by radio or other similar device.” “Interception” is defined as to “secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to such communication.” 

According to the SJC, the “legislative history is concerned with a different type of surveillance” than that alleged by the plaintiff. In this regard, the court observed that, when the statute was enacted, wiretaps involved the interception of “person-to-person conversations or messaging,” and the “legislative history is focused on the secret interception of person-to-person conversations and messaging, particularly private ones.” The court noted the inclusion in the statute of a number of examples of communications, including “conversations” in person or over “telephones” or “telegraphs,” and also observed that “[o]ur case law has never extended the meaning of ‘communication’ beyond person-to-person interactions.” The court distinguished the plaintiff’s claim against the hospitals, which involved interactions “not with another person but with a website.” According to the SJC, “there appears to be a difference in kind and not degree between interactions on a website available to the public and private conversations in your house or on your telephone.” The court expounded:

Activities such as entering a URL, accessing a specific webpage, clicking on links, and scrolling through a webpage are clearly not the type of person-to-person conversations or messaging unambiguously protected by the act. Similarly, the transmission of data about a user’s web browser configuration and IP address bear little resemblance to person-to-person conversation.

The court emphasized that, had the plaintiff alleged that her communications with a particular physician, nurse, or other medical professional been intercepted (she did not), “these would be much different cases.”

Ultimately, the court could not conclude that the Legislature “unambiguously intended to criminalize activities that do not capture such person-to-person communications or messaging.” Because the court determined that the meaning of “communication” in this context is ambiguous, it applied the rule of lenity, according to which a defendant is entitled to the benefit of any rational doubt in the construction of the statute.

In a 46-page dissent, Justice Dalila Wendlandt disagreed with the majority’s decision on numerous grounds and urged the Legislature “to correct today’s error.”