Massachusetts Wiretap Act and Website Tracking: Inside the Reasoning of Vita v. New England Baptist Hospital

Chapter 272, Section 99 and Its Civil Remedy

The Massachusetts wiretap act is section 99 of chapter 272 of the General Laws, a single long section divided into lettered paragraphs. Paragraph A is a codified preamble. Most of it concerns organized crime and the need for judicially supervised surveillance by law enforcement, but its last finding is the one private litigants cite: "the uncontrolled development and unrestricted use of modern electronic surveillance devices pose grave dangers to the privacy of all citizens of the commonwealth. Therefore, the secret use of such devices by private individuals must be prohibited."

Paragraph B supplies the vocabulary. A wire communication is "any communication made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception." An oral communication is speech, excluding speech broadcast over the public air waves. Interception means "to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to such communication." Contents means "any information concerning the identity of the parties to such communication or the existence, contents, substance, purport, or meaning of that communication."

Two features of that text drive the website cases. The statute requires the prior authority of all parties, and it defines only two kinds of communication, wire and oral. There is no third category for electronic communications of the kind the federal Wiretap Act has carried since 1986.

Paragraph C makes a willful interception, an attempt, or procuring another person to intercept a crime punishable by a fine of up to $10,000, imprisonment in state prison for up to five years or in a jail or house of correction for up to two and a half years, or both a fine and imprisonment. Paragraph Q gives a civil cause of action to an aggrieved person whose wire or oral communications were intercepted, disclosed or used, against any person who did so, with these remedies:

• Actual damages, "but not less than liquidated damages computed at the rate of $100 per day for each day of violation or $1000, whichever is higher"
• Punitive damages
• A reasonable attorney's fee and other litigation disbursements reasonably incurred

The only statutory defense written into paragraph Q is good faith reliance on a warrant issued under the section. As the Supreme Judicial Court restated in Vita, quoting its 1989 decision in Pine v. Rust, a civil claim does not require the conduct to be willful or to rise to the level of a crime. That combination, a liquidated damages floor without proof of loss and an all-party consent rule, is why the statute became a vehicle for class actions against Massachusetts website operators.

How Vita Reached the Supreme Judicial Court

Kathleen Vita filed two putative class actions in Suffolk Superior Court in 2023, one against Beth Israel Deaconess Medical Center and one against New England Baptist Hospital. A Superior Court judge denied both hospitals' motions to dismiss and reported her decisions to the Appeals Court under Mass. R. Civ. P. 64 (a). The Supreme Judicial Court allowed direct appellate review, heard argument on April 3, 2024, and decided the consolidated cases on October 24, 2024. The slip opinion is docketed as SJC-13542. Justice Kafker wrote for the court; Justice Wendlandt dissented alone.

The complaints described Meta Pixel and Google Analytics code on both hospitals' sites. As the opinion summarizes them, the code collected the URLs and titles of pages visited, browser and device settings, third-party identifiers and IP addresses, along with a list of user activity: scrolling and clicking (on BIDMC's site, through an optional Google Analytics feature), whether a user reached a new-patient appointment form and which department was chosen, search terms entered on the site, the filters applied on a Find a Doctor page, and whether a user clicked the patient portal's login or sign-up button. The software on NEBH's site also transmitted the name of the user's doctor.

The court separated those general allegations from what Vita said about herself. She alleged that she used the sites to look up doctors and to search for information on symptoms, conditions and procedures. She did not allege that her husband's portal records were intercepted, that any message to a clinician was intercepted, or that she booked an appointment online. The opinion's footnotes return to that distinction several times, noting that no class had been certified and that she was the only named plaintiff.

The hospitals first argued that Vita lacked standing. The court disagreed. Because paragraph Q provides statutory damages regardless of actual loss, and because her allegations fell within the area of concern of the act, she had alleged a particular, nonspeculative injury. That holding matters for what followed: the case was decided on the meaning of the statute, not on a threshold bar of the kind federal courts have applied to session replay claims under other states' wiretap acts.

Why the Majority Read 'Communication' Narrowly

The statute defines wire and oral communications but never defines communication itself. The majority treated that gap as the whole case and worked through four sources.

The statutory text. The court pointed to provisions that use "communications" and "conversations" interchangeably in the warrant requirements, and to repeated references to telephone and telegraph lines. From those it concluded that the plain meaning plainly covers person-to-person conversations and messages, including e-mail, text messages, chats and instant messages. Browsing was different: the user "is not speaking or messaging with another person but rather interacting with the website." The majority added that the definition of contents, by referring to "parties to such communication," seems to assume at least two people, which in its view reinforced the ambiguity rather than resolving it.

Dictionaries. The majority found dictionary definitions too varied to settle the question. Some speak of an exchange of information without saying who is on either end; others, such as Merriam-Webster's "between individuals," point toward people on both sides.

Legislative history. The court traced the act to a special commission created in 1964 and its reports from 1967 and 1968. The record discussed "room bugs," a "parasite bug" smaller than a pack of cigarettes, and the revelation that the telephone company had been monitoring customer calls. There was, the majority wrote, "no discussion whatsoever of computers or software," and no discussion of older analogies to web analytics such as broadcasters tracking viewing or mail-order businesses sharing customer lists.

Case law and the federal comparison. The court said its own decisions had always involved person-to-person conversations or messages, including Commonwealth v. Moody, which held that the act reaches cell phone calls and text messages. Federal decisions treating GET requests as communications did not help, because the federal statute was amended in 1986 to add a defined category of electronic communication, "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature." The Massachusetts act was never similarly amended, and the federal act also contains a one-party consent exception that the state act lacks.

Having found the term ambiguous, the majority applied the rule of lenity. Although Vita's claims were civil, the same definitions govern criminal prosecutions carrying up to five years in prison, and the court cited the principle that a statute with both civil and criminal applications is construed consistently in both. It then pointed to breadth: the statute draws no line between medical information and any other information, or between hospital websites and any other website. It asked whether a music or sports site that tracks visitors and shares the data with advertisers would be committing a crime, and observed that "thousands of website owners" could face criminal and civil exposure under the broader reading.

The Dissent

Justice Wendlandt's dissent begins from the word "any." The definition of wire communication covers "any communication" transmitted in part by wire or cable, and, citing the Supreme Court's reading of "any" as meaning "of whatever kind," she read the phrase as leaving no room for ambiguity. In her view the telephone and telegraph references in the warrant provisions show that the Legislature knew how to limit a provision to particular equipment when it wanted to, and the single reference to "conversations" in the warrant section does not narrow the definition.

The dissent also recast the facts. Rather than "web browsing," it described patients asking the hospitals' systems for doctors who matched gender, location and specialty preferences, inquiring about treatments, and submitting forms to book appointments or reserve a place in an urgent care line, "just as they might by e-mail or by telephone." On a motion to dismiss, the dissent said, those allegations had to be accepted as pleaded.

Its most technical point concerned contents. The federal statute defines contents as information about the "substance, purport, or meaning" of a communication, and federal courts have used that definition to exclude routing information. The Massachusetts definition adds "the identity of the parties" and "the existence" of the communication. On the dissent's reading, URLs, page titles, clicked links, browser data and IP addresses are protected contents under the state text even where they would not be under the federal one.

The dissent would also have rejected the hospitals' remaining defenses at the pleading stage. It pointed to the hospitals' privacy policies, which, as the majority's own summary of the complaints records, said website data was collected "on an aggregate, anonymous basis" and "not shared with other organizations," and it read the act's "intercepting device" exception as limited to telephone and telegraph equipment furnished by a carrier, which the hospitals did not contend their tracking code was. It closed: "Lamentably, the court is right about one thing; the Legislature will need to correct today's error."

What Vita Left to the Legislature

The majority framed its holding as an instruction to the General Court: "If the Legislature intends for the wiretap act's criminal and civil penalties to prohibit the tracking of a person's browsing of, and interaction with, published information on websites, it must say so expressly." It also listed other routes it described as more directly aimed at the conduct alleged, among them the privacy statute at G.L. c. 214, s. 1B, claims under c. 93A for deceptive privacy policies, patients' confidentiality rights under c. 111, s. 70E, and the federal criminal provision at 42 U.S.C. 1320d-6. It cited Doe v. Tenet Healthcare Corp., a District of Massachusetts order from April 2024 allowing negligence, contract, fiduciary, privacy and c. 93A claims over hospital website tracking to proceed.

Two limits on the holding are stated in the opinion. Vita did not allege interception of anything inside the patient portals, and the court wrote that if her communications with a particular physician or nurse had been intercepted, "these would be much different cases." The majority had already said that online chats and instant messages "where actual people communicate with each other" are plainly covered. The decision addresses interactions with published website content, not person-to-person messaging that happens to run through a website.

Several wiretap bills were filed in the 194th General Court, which began in 2025. Their bill history pages, as retrieved on October 12, 2026, show the following:

• S.1266 (Senator Tarr) would replace the definition of wire communication with one covering transfers by "wire, cable, wireless, electronic, digital, radio, electromagnetic, satellite, cellular, optical or other technological means" and "any transfer of signs, signals, writing, images, photographs, videos, texts, sounds, data or intelligence of any nature transmitted in whole or in part by using a cellular telephone, smartphone, personal data assistant or similar device." The text does not mention websites. It accompanied a study order on December 18, 2025.
• H.1935, filed by request, would add an exception allowing a person not acting under color of law to intercept a wire communication containing speech, or an oral communication, where that person is a party or one party has consented. It accompanied a study order on March 26, 2026.
• S.1204 (Senator Moore) rewrites the law enforcement findings in the preamble and the list of designated offenses but leaves the definitions of communication and interception untouched. It was reported favorably on October 9, 2025 and referred to Senate Ways and Means.

None of the three has been enacted, and none would directly change the browsing question Vita decided. The definition of wire communication the majority read remains the one in force.

Massachusetts Beside Pennsylvania and Florida

The contrast with the two other state wiretap statutes covered on this site is mostly a matter of definitions. Pennsylvania's 18 Pa.C.S. s. 5702 and Florida's s. 934.02(12) both define an electronic communication as any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature, the same formula the federal statute uses. Website traffic fits that text without any argument about whether a person is on the other end. The Vita majority made this point itself, noting that a 2017 amendment to Pennsylvania's section 5704 replaced "telephone calls" and "conversations" with references to oral, electronic and wire communications.

The remedies are close to identical. Pennsylvania's section 5725 and Florida's s. 934.10 both set liquidated damages at $100 a day or $1,000, whichever is higher, with punitive damages and fees, which is the Massachusetts formula. Florida adds equitable and declaratory relief and a good faith defense broader than the Massachusetts warrant defense.

Where Massachusetts is broader is contents. Pennsylvania and Florida define contents by substance, purport or meaning. Massachusetts adds identity and existence. That is the textual hook the dissent used, and it is the reason a future plaintiff who alleges an interpersonal exchange over a website, rather than browsing, would be arguing under a definition that on its face reaches who was communicating and that a communication occurred.

The procedural posture also differs. The leading Pennsylvania and Florida session replay rulings came from federal courts, several of them decided on Article III standing or personal jurisdiction without reaching the merits. Vita came from the state's highest court, found standing under state law, and decided the statutory question directly. It is the state's highest court construing a definition that the General Court has not changed since.

Frequently Asked Questions