District of Massachusetts Website Tracking Decisions Deepen Split Over ECPA Crime-Tort Exception

Recent decisions in the District of Massachusetts have sharpened the divide over whether website tracking allegations satisfy the Electronic Communications Privacy Act’s (ECPA) crime-tort exception.

The second half of 2026 has so far supplied a steady stream of conflicting rulings.

• In July, Judge Saris denied a motion to dismiss in Doe v. Children’s Hospital Corporation, following Judge Kobick’s reasoning in Doe v. Baystate Health System.
• Judge Kobick reached the same result in Vita v. Beth Israel Deaconess Medical Center in August.
• On September 21, Judge Gorton dismissed the ECPA claim in Doe v. Lawrence General Hospital, following the more restrictive rubric reflected in Progin v. UMass Memorial Health Care and Caine v. Sturdy Memorial Hospital, both decided by Judge Burroughs.
• On September 30, Judge O’Toole reached the same result in Nova v. Boston Medical Center Corp., dismissing ECPA claims  and denying plaintiff’s motion to amend as futile.
• On that same day, Judge Saylor denied a motion to dismiss in M.C. 1 et al v. Curriculum Associates, LLC, applying the crime-tort exception to the alleged facts.

The following chart summarizes District of Massachusetts website tracking ECPA crime-tort exception rulings at the pleading stage to date:

The deepening split reflected in the above chart has develop against the backdrop of a pending First Circuit ruling in Goulart v. Cape Cod Healthcare (which appeals Judge Stearns’ dismissal ruling), which may provide guidance on whether ECPA claims based on routine website tracking can survive the crime-tort exception. In anticipation of that ruling, Judge Burroughs recently stayed a similar case, McManus v. Tufts Medical Center. For a detailed discussion of the divergent decisions issued in the first half of 2026, see this prior post.

Disagreement About the Crime-Tort Exception Has Become More Pronounced

In these cases, the central issue is whether the pleaded facts plausibly show that committing an independent crime or tort was a defendant’s primary motivation or determinative factor in the alleged interception. In the absence of First Circuit guidance, courts in the District of Massachusetts have provided different answers. As we previously discussed, Progin and Caine dismissed ECPA claims because the complaints did not plausibly tie the hospitals’ use of tracking tools to an independent purpose to commit a separate crime or tort. Baystate allowed an ECPA claim to proceed where the plaintiff alleged intentional disclosure of identifiable, sensitive medical information to advertising platforms despite privacy assurances. Subsequent rulings in recent months make clear courts disagree about when allegations of knowing transmission and unauthorized disclosure support a plausible inference of a tortious purpose, as distinct from an unintended or incidental consequence of marketing activity.

Children’s Hospital, Beth Israel, and Curriculum Associates Allow ECPA Claims to Proceed

In Doe v. Children’s Hospital Corporation, Judge Saris denied the hospital’s motion to dismiss the second amended complaint. The plaintiff alleged that tracking technologies transmitted searches, provider and appointment activity, and clicks within the patient portal to Google and Facebook. Citing Baystate, the court held that the complaint plausibly alleged interception and disclosure were independent acts undertaken for the purpose of violating Massachusetts law. Whether the hospital’s primary or determinative motivation was lawful marketing, unlawful disclosure, or both could not be resolved on the pleadings.

In Vita v. Beth Israel Deaconess Medical Center, Judge Kobick again denied dismissal of an ECPA claim. The case has a lengthy procedural history, but relevant here is that plaintiff alleged the hospital’s privacy policy promised aggregate, anonymous website data and limited outside sharing, while its tracking tools transmitted identifiable searches to Meta and Google. The court reasoned that the alleged decision to obtain and disclose that information, despite that policy, plausibly supported a purpose to commit a separate privacy tort. A commercial motive did not defeat that inference.

Vita is notable because the plaintiff was not herself a patient of the hospital, although she alleged using the site to research care for herself and her husband and to access her husband’s records. The court noted that the hospital had not developed an argument distinguishing nonpatients from the patients. Its ruling therefore should not be read as a categorical holding that every website visitor is owed the same duties as a patient.

Finally, in M.C. 1 et al v. Curriculum Associates, LLC, Judge Saylor denied dismissal of the ECPA claim involving alleged collection and sharing of schoolchildren’s data through i-Ready educational software. The court followed Baystate: disclosure could constitute conduct independent of interception, and the pleaded sharing and monetization of private data supported an inference of tortious purpose. The decision expressly disagreed with reasoning that a financial motive insulates a defendant from the exception, including Goulart’s district court reasoning. Whether tortious purpose was primary or determinative required a factual record, warranting survival past the pleading stage.

Lawrence General and Boston Medical Center Reach the Opposite Result

In Doe v. Lawrence General Hospital, Judge Gorton adopted a magistrate judge’s second report and recommendation and dismissed the ECPA claim. The court held that the crime-tort exception requires an actual purpose to commit the separate tort: it is insufficient that an intentional interception carries a risk of a tortious disclosure, even one the defendant may have recognized. Applying the First Circuit’s reasoning in United States v. Cassiere, it found no plausible allegation that disclosure of private information was the hospital’s primary motivation or a determinative factor in deploying the tools.

The court expressly addressed Baystate and Vita. Although similar allegations of privacy assurances and platform warnings supported an inference of purpose in those decisions, Judge Gorton concluded that this complaint alleged at most awareness that private information might be disclosed. The court separately rejected the asserted HIPAA violation, reasoning that the complaint did not allege that the information collected from public webpages was maintained in the hospital’s records as required by law. Plaintiff filed a notice of appeal to the First Circuit earlier this month.

Also in September, in Nova v. Boston Medical Center Corp., Judge O’Toole dismissed the ECPA claim, denied amendment as futile, and remanded the remaining state claims. Applying Cassiere, Caine, and Lawrence General, the court found insufficient allegations that a privacy violation supplied the hospital’s primary or determinative motivation. Allegations of intentional disclosure contrary to privacy policies did not establish that purpose, particularly where allegations about tracking on public webpages and the portal’s login page did not plausibly support the disclosure of information maintained pursuant to HIPAA.

District of Massachusetts Awaits First Circuit Guidance

The new rulings in Children’s, Beth Israel, and Lawrence put the divide in sharper focus. Progin and Caine, followed by Lawrence, require plausible allegations that the privacy violation was intentional, not just intentional deployment and disclosure. Baystate, Children’s, and Vita permit an inference of a separate tortious purpose at the pleading stage from alleged disclosures of sensitive, identifiable health information, particularly when those disclosures conflict with privacy representations. All are pleading-stage rulings; none establishes that the defendant ultimately violated the ECPA.

The importance of the pending Goulart appeal is already affecting other cases. On September 17, Judge Burroughs stayed McManus v. Tufts Medical Center, Inc., while a motion to dismiss remains pending. The court acknowledged arguments that the claims differ from those in Goulart but concluded that the First Circuit would likely address issues material to the crime-tort exception.

The First Circuit’s forthcoming decision in Goulart is consequential beyond that appeal. It may clarify what must be pleaded about the defendant’s purpose, how a lawful commercial objective interacts with an alleged unlawful intent, and whether the alleged tort is sufficiently separate from interception. Until then, the result of a motion to dismiss in District of Massachusetts website tracking litigation may depend on both the particular allegations and the court’s approach to drawing inferences about purpose from them.