State wiretapping laws written in the 1960s are now taking aim at targeting pixels used for standard ad measurement.
In a recent lawsuit that’s currently being heard by the Washington Supreme Court, Baker v. Seattle Children’s Hospital, the plaintiffs argue that the hospital’s use of the Meta Pixel for marketing purposes turned patients’ clicks and page views into illegally intercepted private communications, akin to spying on a phone call. The case has major implications for online advertising and user privacy.
If courts start treating browser-to-server calls as wiretaps, then ordinary web functions like analytics, attribution and fraud prevention could face a wave of copycat lawsuits and pressure to flip to an opt-in model, according to the IAB.
To unpack why the IAB filed an amicus brief in the Baker case, AdExchanger spoke with Michael Hahn, the IAB’s EVP and general counsel. Hahn explains why he thinks plaintiffs are stretching old, outdated laws for profit and why he believes modern privacy statutes should set the rules of the road instead.
AdExchanger: Why did the IAB decide to weigh in on Baker v. Seattle Children’s Hospital? What made this case different from other privacy cases where the IAB hasn’t gotten involved?
MICHAEL HAHN: The lawmakers who designed these state wiretapping laws operated in a completely different era. They were written to address interception of telephone calls, where you have a very high expectation of privacy. Now they’re being applied to routine online data flows that everyone has come to expect when they use the internet.
We’re seeing plaintiffs’ lawyers use those laws to bring what I’d call spurious lawsuits. They generate settlement demands and payments, and it’s become a mini industry for them, without actually doing anything meaningful for privacy.
Most of these cases never reach a state supreme court. This one did. When a case like this gets to the Washington Supreme Court, its impact can go far beyond a single hospital or a single pixel implementation. That’s why we felt it was important for the IAB’s voice to be heard and to provide the court with a broader industry perspective.
What makes you say these suits are driven more by money than by privacy?
I think the primary driver here is money, not the public interest. A plaintiff’s firm came to one of our events, and when we interviewed him onstage, he essentially said, “Thank you for funding my kids’ college education.” That tells you a lot about what’s going on.
If these cases were really about vindicating public privacy, I’d expect to see state governments bringing enforcement actions under these same wiretapping laws. We don’t see that. We see private plaintiffs bringing large volumes of cases under state wiretap statutes, under the Video Privacy Protection Act and a few other theories. To me, that looks like an evolving plaintiffs’ business model, not a targeted effort to rein in genuinely harmful behavior.
Put this in practical terms for publishers. What everyday web functions become risky if pixels are treated like wiretaps?
If you accept the plaintiffs’ premise, the risk extends to a huge amount of ordinary web activity. Take ad measurement. Most websites and apps are ad-supported, and advertisers don’t pay unless they can measure the ads. They want to know if a person has seen an ad, if they clicked on it, how they engaged with it and whether it resulted in a sale.
To do that, data has to flow from the publisher’s site to third parties, often via pixels. Plaintiffs are arguing that those transmissions are essentially private communications, intercepted and shared without the user’s knowledge. If you label that wiretapping, you’re potentially pulling in measurement, analytics, fraud prevention and more.
Consumers understand that when they receive free content and services, their data will be used for advertising. That’s how the free content is financed. Treating that as equivalent to someone secretly tapping a phone call in 1970 doesn’t align with how people experience the web or with what the technology actually does.
How does this wiretapping theory collide with newer state privacy laws like California’s? Are we heading toward conflicting standards?
Legislatures have already decided how they want to balance privacy with the availability of content and services. That’s what state privacy laws are about. They’re supposed to be the rules of the road for online data practices.
If you look at California’s Consumer Privacy Rights Act, for example, the decision was to give consumers the right to opt out of certain uses of non-sensitive personal information, like targeted advertising. Most state privacy laws follow that same basic structure.
State wiretapping laws, by contrast, operate more like an opt-in regime. If courts start applying those wiretap statutes to the very same online activities that privacy laws already regulate, you end up with conflicting legal regimes. On one hand, the legislature says opt out. On the other hand, a court decision effectively says: opt in or risk wiretap liability.
My view is that, as applied to ubiquitous online activities like digital advertising, older wiretap theories shouldn’t be triggered at all. Or, to the extent they could be [applied], they have been superseded by more recent, targeted privacy laws in those states.
If the Washington Supreme Court rules in favor of the plaintiffs, what does that future look like for advertisers and the open web?
The case focuses on Meta Pixel, but any pixel that tracks browser activity could be implicated, as they all function similarly. In Baker, the allegation is that deploying the pixel led to interception and sharing of browsing activity, and that a user’s clicks and searches on the site are private communications.
If the court endorses that view, you could see a world where, as a practical matter, companies feel they have to get explicit consent everywhere just to have a defense under the wiretap statute. That would push everyone toward a consent regime that no state legislature has chosen for non-sensitive data, and it would sit in real tension with opt-out-based privacy laws.
In that scenario, you’d likely see a lot more consent banners and a lot of pressure on publishers to rethink business models that rely on standard analytics, measurement and other pixel-based tools. And the impact wouldn’t be limited to targeted advertising. It would reach a broad range of online functionality that depends on data transmission.
This interview has been edited and condensed.
