What the Washington pixel ruling does and does not settle for a small site

This post is not legal advice, and Peeko cannot say what any court would do with your site. What we can do is describe what the ruling decided, what it did not, and what a small site's tracker sends and keeps, so you can answer a customer who forwards you a headline that says pixels are legal.

What the court decided

In Baker v. Seattle Children's Hospital, the Washington Supreme Court affirmed the dismissal of a suit by parents who said the Meta Pixel on the hospital's public website broke the state wiretap law. PPC Land's report on the ruling quotes the majority opinion by Justice Angelis: the Washington Privacy Act, RCW 9.73.030(1)(a), "governs interception or recording of 'communication' between 'two or more individuals' and therefore excludes searches and clicks that generate an automated response." Bloomberg Law reports the same holding: the act covers communications between individuals, not the searches and clicks that generate automated responses from websites.

The allegations were specific, as PPC Land relays them. When a visitor typed a term such as "depression" into the site's search bar, the "Pixel records and relays the content of this search to Meta, which links that information to the Facebook or Instagram account." The pixel also placed the cookies _fbp and c_user on visitors' devices. The trial court dismissed the case in Feb 2024, the Court of Appeals affirmed on Aug 18, 2025 in an unpublished opinion, and the Supreme Court affirmed on Oct 8, 2026.

Read the holding for what it is. The court said which kinds of communication that one statute protects. It did not say that sending a visitor's search terms to an ad network is fine in general.

Why customers keep asking

Customers ask because this kind of tracker is on a lot of the web. The Web Almanac 2025 privacy chapter, built on HTTP Archive crawl data, lists Google Analytics at 53% and Facebook Pixel at 16% among the tracking technologies it detected. W3Techs reports Meta Pixel on 8.5% of all websites, and on 14.9% of the websites whose traffic analysis tool it can identify, as of Oct 2026. The numbers differ because the crawls and the denominators differ, so treat both as rough.

Source: HTTP Archive Web Almanac, Privacy | 2025 | The Web Almanac by HTTP Archive, 2025. Retrieved Oct 11, 2026.

What the ruling leaves open

Four things sit outside the holding, going by the reporting.

• The other claims. The parents also brought claims under the Consumer Protection Act and the Uniform Health Care Information Act, and for invasion of privacy, breach of implied contract, conversion and unjust enrichment. Those were dismissed earlier. According to PPC Land, the parents did not challenge their dismissal on appeal, so the Supreme Court did not review them. The ruling is silent on them. It is not an approval of them.
• The cookie banner. Justice González, who agreed with the result only, wrote a concurrence. It noted that the hospital's notice told patients it would not share their health information beyond the disclosures it listed, and it questioned whether a general cookie banner defeated that expectation of privacy. The majority did not address the point.
• Channels where a person answers. By PPC Land's account, the majority reserved communications where a human responds, such as a live chat. Justice González wrote that a system that does more than return stored content remains unresolved. If your site has a chat widget or an AI assistant, this is the open question closest to you.
• Everywhere else. This was a Washington court reading a Washington statute. A ruling like that tells you nothing about the statutes of other states, or about laws outside the United States.

Five questions to ask about any tracker

None of these depends on one court, and each one has an answer you can find yourself. Run them on every script on your site, Peeko's included.

1. What leaves the page? Open your site, open the browser console and run this to list every host the page has contacted:

[...new Set(performance.getEntriesByType("resource").map(r => new URL(r.name).host))].filter(h => h !== location.host)

Then open the Network tab, click one request to each unfamiliar host, and read the payload. Look for full page addresses, search terms, form entries and anything that looks like an email address. This list only covers what loaded since the page opened, so click around and run it again after you search, add to a cart or submit a form.

2. Where does it go? Name the company that receives each request. Then ask whether it can join what it received with an account it already holds about that person. In the allegations above, the harm was not that Meta received a search. It was that Meta linked the search to a Facebook or Instagram account.

3. What is stored under a stable identifier? List the cookies and local storage keys your scripts write:

document.cookie.split("; ").filter(Boolean).map(c => c.split("=")[0])
Object.keys(localStorage)

document.cookie cannot see cookies marked HttpOnly, so also check the Application tab in your browser's developer tools. Then ask how long each identifier lives and whether you can delete one person's records.

4. Can a free text field leak into it? A site search box, a contact form and a chat widget are the places where visitors type things you did not plan for. If an event or a URL carries what they typed, the tracker has it.

5. Does a person or an AI answer? The reserved question in the ruling is about channels where something other than a fixed page replies. If you have one, treat it separately from your page view counts.

What Peeko sends and keeps

Here is how Peeko answers those five questions, so you can check the claims against your own Network tab instead of taking our word.

What leaves the page. Peeko is one script tag with a site key. It sets no cookie and needs no configuration once it is on the page. It records page views, and five kinds of click with no code at all: outbound, phone, email, whatsapp and form. Anything else is a data-peeko-event attribute or a window.peeko.event call, which takes one name and one optional string and no properties object. A string is still a string, so do not put an email address or a search term in an event name. Visits from ChatGPT, Claude, Perplexity, Copilot and Gemini are counted from ordinary page views by their referrer, which is covered in how to count visits from AI assistants by referrer.

Where it goes. To Peeko's ingest endpoint. It answers 204 to every well formed beacon, valid key or not, so the endpoint cannot be used to find out whether a key is real.

What is stored. No IP address is ever stored. A visitor is the first part of a one way keyed hash of their address and browser string, and the address itself is never written to a database or a log. The hash behind the People number mixes in the date and is re-salted every day, so nobody can be followed from one day to the next.

The part that is a stable identifier. A second hash, without the date, is what tells a returning visitor from a new one and strings a person's page views into a journey. It is the identity behind goals, funnels and revenue. That is the item to weigh on question 3: it is how Peeko recognizes the same person on a later day, and it is why those features work without a cookie. Page views, events and AI crawler hits are kept three years by default, and a site owner can set that window anywhere from 30 days to ten years.

Sales without a cookie. Revenue attribution uses a page token minted per page view and good for 48 hours, passed into the Checkout session as metadata, so a verified sale carries its page and source. Peeko never holds a Stripe API key. The only credential it stores for revenue is the webhook signing secret, which proves an event came from your account and does nothing else. The full flow is in following an AI referral to signup without cookies.

Crawlers. AI crawler tracking is a separate server side path, because crawlers do not run JavaScript. No address and no visitor hash exist on that path at all. Peeko keeps the raw user agent up to 512 characters so old hits can be reclassified as its list of 55 agents from 21 companies grows. The method for naming who sent a request without addresses is in naming the operator of an AI agent without IP addresses.

Compared with the pixel in the Seattle allegations, the shape is different. Peeko sets no cookie, and a visitor is represented by the hashes above. That is a description of what we built, not a ruling on how any court would read your site, your visitors or your state's law.

What to tell a customer who asks

Short answers hold up better than reassurance. Something like this works:

1. A court in Washington decided that one state wiretap law did not reach a hospital's pixel on its public pages. It did not decide the other privacy claims or what a cookie banner changes.
2. Here is the list of hosts our site contacts, and what each one receives.
3. Here is what we store under a stable identifier, and how long we keep it.
4. We do not collect free text such as search terms or form entries in our analytics. Say that only if you have checked it in your own Network tab.

The fourth line is the one to earn before you say it. If you run a new site with an AI coding agent, ask the agent to run the console snippets above and paste the output, then read it yourself. For a sense of what else shows up in server logs on a young site, AI crawlers on a new site in the first 30 days shows the traffic you can expect that never touches a script at all.

What this does not settle

A narrow ruling gives a narrow comfort. It does not make a tracker safe, and it does not make one unsafe. A week from now there may be another case under another statute, and the five questions will still be the ones that matter, because they ask what a visitor's data does after it leaves their browser. Answer them for each script on your site, write the answers down, and update them when you add a script.