Why Washington's My Health My Data Act Can Sue Any Agency

The law that doesn't care where you are

Say your agency is licensed in Ohio, or Texas, or Florida. You've never written a policy in Washington state and have no plans to. A prospect in Tacoma searches "Medicare Advantage plans that cover insulin," clicks your ad, and lands on a comparison page you built for exactly that query. She fills out a quote form. The Meta Pixel on that quote page fires the instant it loads, sending her identity to an ad platform tied to the page she was on, the same mechanism that has already produced federal enforcement action against companies far bigger than a two-person agency.

That's the fact pattern Washington's My Health My Data Act was written to reach. The statute, codified at RCW 19.373 and commonly shortened to MHMDA, defines a "regulated entity" as any legal entity that "conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington," and that determines the purpose and means of collecting, processing, sharing, or selling consumer health data¹. Nothing in that definition asks where your office sits, where you're licensed, or whether you've ever heard of the statute. It asks whether the person on the other end of the quote form was in Washington when they filled it out.

Most agents have never run into a law shaped like this. State insurance regulation is jurisdictional, you're licensed where you're licensed, and TCPA and CAN-SPAM are federal, so the rules are the same everywhere. MHMDA is different. It's a state statute with a reach that follows the visitor, not the business. An agency running a national Meta or Google campaign for ACA or Medicare Advantage plans is, almost by construction, targeting consumers in Washington along with every other state, whether or not that was ever the plan.

What "consumer health data" actually covers

RCW 19.373.010 defines consumer health data as "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status"¹. That's a broader definition than HIPAA's protected health information, and it isn't limited to a diagnosis or a medical record. Washington's Attorney General describes the law as applying to "all persons and businesses that conduct business in Washington... and that collect, process, share, or sell consumer health data," a scope that reaches marketing and advertising data as directly as it reaches clinical records¹⁰.

For an insurance site, the practical reach is specific. A Medicare Advantage plan search that filters by a condition, an ACA subsidy calculator that returns a result tied to a household's health status, a diabetic supplies coverage page, a quote form that asks about current medications, all of these produce data that "identifies" a health status inside the statute's own definition. So does biometric data, defined separately as data generated from measuring an individual's physiological or behavioral characteristics¹, and so does precise location data that places a visitor at a specific clinic or pharmacy.

Here's the detail that trips up agents who've already done a HIPAA review and assume they're covered: RCW 19.373.100 exempts protected health information, but only "for purposes of the federal health insurance portability and accountability act," and only when it's held by "a covered entity or business associate as defined by" HIPAA⁷. Meta and Google are not HIPAA business associates for their standard advertising products. The data your pixel sends them isn't protected health information moving through a HIPAA relationship, it's consumer health data moving through an advertising relationship, which is exactly the gap MHMDA was built to close.

The consent standard a cookie banner doesn't meet

RCW 19.373.030 permits a regulated entity to collect or share consumer health data in exactly two situations: with the consumer's consent for a specified purpose, or to the extent necessary to provide a product or service the consumer actually requested³. A quote form arguably clears the second bar for the quote itself. It does not clear it for whatever an ad platform does with that visitor's data afterward, which is a separate act of sharing that needs its own basis.

The statute is specific about what "consent" has to look like before that sharing happens. The request for authorization must "clearly and conspicuously disclose: (i) The categories of consumer health data collected or shared; (ii) the purpose of the collection or sharing... including the specific ways in which it will be used; (iii) the categories of entities with whom the consumer health data is shared; and (iv) how the consumer can withdraw consent from future collection or sharing"³. A generic "we use cookies" banner names none of that. It doesn't name the categories of data, doesn't name the purpose, doesn't name who receives it, and rarely explains how to withdraw consent for future sharing specifically.

Walk through the timing, because it's the part that actually matters. A standard client-side pixel fires the moment the page loads, before a visitor has scrolled, before they've clicked accept on anything. By the time a cookie banner even renders, the request to Meta or Google has already gone out — the same pre-consent gap that decides whether a consent banner makes tracking pixels legal at all. There is no version of "the visitor consented after the fact" that satisfies a statute requiring the four disclosures above before the sharing occurs. The tag doesn't wait for permission. It was never built to.

Why this is worse than a normal privacy statute

Most state privacy laws hand enforcement entirely to the state Attorney General, which means exposure depends on that office choosing to act, with limited staff and limited cases. MHMDA does something most of those laws don't: RCW 19.373.090 states plainly that "a violation of this chapter is not reasonable in relation to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW"⁶. That's a per se violation, meaning a plaintiff doesn't have to separately prove the practice was unfair or deceptive. Proving the MHMDA violation happened is enough.

And Washington's Consumer Protection Act, unlike a statute that only the Attorney General can enforce, is enforced "by the Attorney General as well as through private action"¹⁰. Any individual Washington consumer whose data was mishandled can bring their own lawsuit, without waiting for a regulator to notice, staff a case, or decide it's worth the office's time. One visitor, one plaintiffs' firm, and a filed complaint is the entire path to litigation. That structural difference, private enforcement stacked on top of a per se violation standard, is what separates MHMDA from a law that mostly lives on paper.

It's worth understanding why a plaintiffs' firm would bother with a case built around a single agency's tracking tag in the first place, because the economics are the actual engine here, not just the statute's text. RCW 19.86.090 lets a prevailing consumer recover a reasonable attorney's fee on top of any damages award⁸. That fee-shifting is what makes a case with modest actual damages worth filing at all, since the firm's own cost of bringing the claim gets paid by the losing side rather than eaten out of a small individual recovery. Pair that with a per se violation standard that removes the need to separately argue the practice was unfair, and a case that would never pencil out under an ordinary damages-only theory starts to look like a reasonable one to bring.

What it actually costs

Put the mechanism into real numbers and the shape of the exposure gets concrete. Under RCW 19.86.090, a consumer who proves a Consumer Protection Act violation, which MHMDA violations automatically are, can recover actual damages, plus the costs of the suit and a reasonable attorney's fee. A court can also, at its discretion, treble that award, with the trebled increase capped at $25,000 per case⁸. That's not a flat statutory penalty requiring no proof of harm, it's a real damages claim with a fee-shifting and trebling mechanism layered on top, which is exactly the combination that makes a case worth a plaintiffs' firm's time even when the underlying harm looks modest.

Neither number is the whole exposure. The WA figure is a cap on the trebled portion of one case, not on attorney's fees, not on actual damages, and not on how many separate visitors could each bring their own claim off the same underlying tracking setup. The FTC figure requires the FTC itself to bring an action, which takes agency resources and only happens at scale. MHMDA needs one Washington resident, one law firm willing to take the case, and a filed complaint. That's the actual comparison worth sitting with, not which number is bigger, but which one requires a regulator to move first.

The lawsuit that proves it's not theoretical

A law with a private right of action and no enforcement history is still mostly a hypothetical. MHMDA isn't in that category anymore. On February 20, 2025, a Washington resident filed the first lawsuit under the statute's private right of action, in the U.S. District Court for the Western District of Washington in Seattle, against Amazon.com and Amazon Advertising¹¹.

The complaint alleged that Amazon's advertising software development kit, licensed to a range of mobile apps, collected biometric data and precise location information that "could reasonably indicate a consumer's attempt to acquire or receive health services or supplies," and that this collection violated MHMDA alongside several federal statutes¹¹. Note what the complaint doesn't allege: a data breach, a hack, or malicious intent. It alleges an advertising SDK doing what advertising SDKs do, collecting location and behavioral signals to improve targeting, applied to data the statute treats as consumer health data because of what that location and behavior can reasonably indicate.

A Washington resident filed the case on behalf of herself and others in a similar position, which is its own signal worth noting. A private right of action paired with a class-style filing means one visitor's claim can become the vehicle for a much larger group of people who interacted with the same tracking mechanism, on the same site, in the same way. An agency running a single national ad campaign isn't looking at one visitor's potential claim in isolation, it's looking at however many Washington residents that same campaign reached, each of whom shares the identical fact pattern a plaintiffs' firm needs to build a group case.

That's the same shape of exposure a quote-page tracking pixel carries. Nobody has to intend a health data disclosure for the statute to apply. The SDK, or the pixel, only has to do what it was built to do, on a page where what it was built to do collides with what the statute defines as consumer health data.

The privacy policy and geofence rules nobody reads

Two more requirements in the statute are easy to miss because they don't look like a tracking question at all, and both are simple to check on your own site.

RCW 19.373.020 requires a regulated entity to "prominently publish a link to its consumer health data privacy policy on its homepage," and that policy has to disclose the categories of data collected and why, the categories of sources, the categories of data shared, "a list of the categories of third parties and specific affiliates" who receive it, and how a consumer exercises their rights². A generic privacy policy written for a different purpose, the kind most site templates ship with, almost never contains that specific list. It's a different document than what most agency sites currently link.

RCW 19.373.080 bans geofencing "an entity that provides in-person health care services" for three specific purposes: identifying or tracking consumers seeking health care, collecting their consumer health data, or sending them notifications, messages, or advertisements related to their health data or health care services⁵. If your agency, or a vendor running your ads, has ever set up a geofenced campaign around a clinic, a hospital, or a pharmacy to catch people walking out, that specific tactic is exactly what this section prohibits.

The 45-day clock you didn't know you had

RCW 19.373.040 gives consumers the right to confirm what health data a regulated entity holds about them, access it, including "a list of all third parties and affiliates" it's been shared with, and request deletion⁴. None of that is unusual among modern privacy statutes. What's easy to miss is the clock: entities "shall comply with the consumer's requests... without undue delay, but in all cases within 45 days of receipt of the request," extendable once for another 45 days when reasonably necessary⁴.

Deletion carries its own wrinkle. The entity has to delete the data "from all parts of the regulated entity's... network, including archived or backup systems," though that specific part of a deletion request "may be delayed to enable restoration of the archived or backup systems," capped at six months from when the request was authenticated⁴. Almost no independent agency has a documented process for any of this. If a request landed in your inbox tomorrow, from a name you don't recognize, citing this statute, would anyone on your team know what to do with it inside 45 days?

How to check your own exposure in fifteen minutes

You don't need to hire anyone to get a first real answer. Most of this is checkable in your own browser, on your own site, right now.

What actually fixes it

The fix has a name, and it's the same underlying mechanism that closes the gap on a lot of the health-data tracking exposure agents ask about, not just this specific statute. A standard, client-side pixel runs in the visitor's own browser and sends data straight to Meta or Google the instant the page loads. There's no place to check for consent, name a recipient, or hold the event until it's appropriate to send, because the browser already sent it before your server saw the request.

Server-side, consent-gated tracking moves that step onto infrastructure you control. The event still gets captured, but it routes to your own server first. Your server checks whether the specific, named consent RCW 19.373.030 requires was actually recorded, and only then forwards a cleaned event, if it forwards one at all. The visitor's browser never talks to Meta or Google directly.

The consent banner itself has to change too, not just the plumbing behind it. A banner that says "we use cookies to improve your experience" with a single accept button doesn't do the work RCW 19.373.030 requires. The banner, or the layer behind it, needs to actually name the categories of data involved, state the specific purpose, name the categories of recipients, and give a real path to withdraw consent later, before any health-adjacent event fires anywhere. That's a content problem as much as an engineering one, and it's the piece most off-the-shelf consent management tools don't handle out of the box, because they were built for a general cookie-law standard, not this statute's specific four-part disclosure.

How we build this in

This section sticks to what's on our own live pages, verified this session. The free Audit checks whether a site's trackers are firing before consent on health and Medicare-adjacent pages, so you can see where your current site stands before deciding anything¹³. Digital Foundation ships with server-side, consent-gated tracking by default rather than a raw client-side pixel, starting at $247 a month with a 14-day free trial¹⁴.

For agencies that want the compliant-stack build done end to end, including a BAA-covered infrastructure setup, server-side tracking wired to a documented consent flow, and PHI handled only on HIPAA-eligible AWS or Azure services under a signed Business Associate Agreement, Enterprise builds run on infrastructure you own, with every access to protected health information logged inside your own tenant¹⁵. Minimum Enterprise projects start at $2,000 plus a small monthly cloud cost, typically under $200, and every build is scoped to the specific agency rather than sold as a fixed package¹⁵.

Neither of those claims is a promise about your specific legal exposure disappearing. What we can say plainly is that a client-side pixel sending health-adjacent form data to an ad platform with no named consent and no deletion workflow is not how we build a site in the first place.

Who this doesn't reach as hard

This guide concentrates on health-adjacent pages: Medicare, ACA, and anything tied to a specific condition or benefit. If your book is life insurance, final expense, or property and casualty, and your site never asks about a health condition or returns a result tied to one, your exposure under this specific statute is meaningfully lower. The definition of consumer health data is keyed to health status, not to insurance broadly.

Geography matters too. RCW 19.373.010's reach depends on conducting business in Washington or targeting products to Washington consumers¹. A single-county agency running no digital ads outside its own state, with no national campaign and no organic traffic from Washington worth mentioning, carries a genuinely different exposure than an agency running national Meta and Google campaigns for Medicare Advantage or ACA plans. You can run the check in this guide yourself and reasonably conclude your specific site is low risk. A lot of agents will, and that's a legitimate outcome, not a failure to take the law seriously.

Where it applies almost without exception is any agency running national or multi-state digital advertising for Medicare Advantage, Medicare Supplement, or ACA products, because the ad spend itself is what makes the campaign "targeted to consumers in Washington" in the statute's own language, whether or not writing business there was ever part of the plan.

Questions agents ask