State Health Privacy Laws and Ad Tech: 2026 Tracker

This page is a reference, not legal advice. Dates show when each statement was checked. Confirm with counsel before relying on it.

Four states have health-specific privacy rules in force (Washington, Nevada, Connecticut, Maryland), New York's bill awaits the governor, and 20 states have comprehensive privacy laws treating health data as sensitive, 16 of them opt-in (Mayer Brown, 3 September 2026). This tracker lists each law's effective date, health definition, consent model, geofencing rule, enforcement and the consequence for ad tech.

HIPAA covers only providers, plans and their vendors. The laws below cover everyone else, including pharma brands, telehealth companies, health publishers, pharmacies' retail media units and the ad tech vendors they use. For the HIPAA layer, see HIPAA-compliant programmatic advertising.

• Effective date. The date obligations apply to most controllers. Where a law phases in, the earliest date is shown and the others are in the deep dive.
• Health data definition family. Status (broadest: anything that identifies health status, including inferences); Condition or diagnosis (Virginia-model text); Diagnosis (narrowest); CA (California's "collected and analyzed concerning a consumer's health").
• Consent model. What the law requires before processing sensitive data: Opt-in (affirmative consent), Opt-out (notice and a chance to refuse), Limit (California's right to limit use of sensitive PI), Strictly necessary (Maryland; consent is not a basis).
• Geofence rule. A ban on virtual boundaries around health facilities, with the distance.
• PRA. Private right of action under the law.
• Ad tech consequence. Our reading of what the law means for targeting (T), retargeting (R), measurement (M) and data sales (S). It is a summary, not advice.

Effective dates and consent models are from the Mayer Brown tracker current as of 3 September 2026 unless another source is shown (Mayer Brown). Health definition families were assigned from statute text; see editor note 2. Private right of action: California only, and only for data breaches (Clym, 23 June 2026).

Washington's law is the model the others copied and the only one with a private right of action. It was signed on 27 April 2023 (Washington AG Data Privacy Report, August 2026). The geofence ban (section 10) applied from 23 July 2023; the rest applied to regulated entities from 31 March 2024 and to small businesses from 30 June 2024 (Washington AG).

Three features matter most for ad tech. First, the definition. Consumer health data is "personal information that is linked or reasonably linkable to a consumer" that "identifies the consumer's past, present, or future physical or mental health status" (RCW 19.373.010). Inferences count, so a cookie that records visits to a dermatology page is in scope. Second, the consent structure. Collection requires consent or necessity for a requested service; sharing requires a separate consent (RCW 19.373.030). "Share" means to disclose, make available or provide access to a third party or affiliate, which covers a pixel firing to an ad platform (RCW 19.373.010). Selling needs a written authorization that lists the data, the buyer, the purpose and the right to revoke, and that expires one year after signature (RCW 19.373.070). Third, the geofence ban: it is unlawful to implement a geofence around an entity providing in-person health care services to identify or track consumers, collect their health data, or send them notifications or ads, where a geofence is a boundary of 2,000 feet or less from the facility's perimeter (RCW 19.373.080). There is no consent exception.

Enforcement runs through the Consumer Protection Act. The statute says a violation "is an unfair or deceptive act in trade or commerce" for the purposes of chapter 19.86 (RCW 19.373.090). That gives the Attorney General civil penalties of up to $7,500 per violation (RCW 19.86.140) and gives consumers a private action with actual damages, fees and treble damages capped at $25,000 (RCW 19.86.090). The first class action came on 10 February 2025: Maxwell v. Amazon.com, Inc. and Amazon Advertising, LLC, W.D. Wash. No. 2:25-cv-00261, alleging that Amazon's advertising SDK inside third-party apps collected location and biometric data that could reveal attempts to obtain health services (Paul Hastings, February 2025). As of 9 October 2026 the IAPP described business fears of a litigation flood as unwarranted "given the lack of lawsuits brought in the years since passage", and Attorney General Nick Brown said his office had been "thoughtful about enforcement because the law is still relatively new" (IAPP, 9 October 2026).

The AG's first Data Privacy Report, released 14 August 2026, is the best signal of what comes next. Its survey of more than 700 residents in 26 counties found 62% had found it difficult or very difficult to opt out of targeted advertising, 95% said there was no circumstance in which they would be comfortable providing personal information without informed consent, and 83% felt they had little or no control over who could access their data (Washington AG Data Privacy Report, August 2026; WilmerHale, 1 September 2026). The report recommends a comprehensive privacy law, stronger consent rules, limits on sensitive data and a data broker registry. Expect ad tech, consent design and data brokers to be the first targets.

Nevada passed SB 370 nine days after Washington's governor signed; it was signed on 16 June 2023 and took effect on 31 March 2024 (Hunton, June 2023; Orrick, 13 July 2023). The structure mirrors Washington: affirmative, voluntary consent to collect, a separate consent to share, and a written authorization to sell that expires after one year (NRS 603A.500, 603A.535). The geofence ban is 1,750 feet around any medical facility and applies even with consent (NRS 603A.540).

The differences are enforcement and scope. A violation "constitutes a deceptive trade practice" under NRS 598, and the chapter states that it does not create a private right of action (NRS 603A.550). Nevada's definition is tied to information "linked or reasonably capable of being linked to a consumer" and relating to health, which commentators read as slightly narrower than Washington's (Orrick, 13 July 2023). For an ad tech program, treat Nevada as Washington without the class-action exposure; the operational controls are the same.

Connecticut took a different route: it bolted health-data rules onto its comprehensive law. Public Act 23-56 (SB 3) was signed on 26 June 2023 (BCLP, 2023). It added "consumer health data", defined as personal data a controller uses to identify a physical or mental health condition or diagnosis, required consent before processing it, banned its sale without consent, and prohibited geofences within 1,750 feet of any mental health, reproductive or sexual health facility (Orrick, 24 July 2023). Orrick reads the effective date as 1 October 2023 because of a budget bill; BCLP reads it as 1 July 2023. The Attorney General has exclusive enforcement and there is no private right of action; the 60-day cure period expired on 31 December 2024 (Orrick, 24 July 2023).

Two later bills widened the net. SB 1295 took effect on 1 July 2026: the applicability threshold fell to 35,000 consumers, and any entity that processes sensitive data (which includes health data) is covered regardless of volume (WilmerHale, 31 July 2026). SB 4, signed 27 May 2026, bans the sale of any consumer's precise geolocation data from 1 October 2026 and creates a data broker registry with registration due by 1 January 2027 (WilmerHale, 31 July 2026). Holland & Knight reports that the Connecticut AG has issued "dozens" of violation notices under the CTDPA (Holland & Knight, 25 August 2026). For a location-data vendor or a DSP with a Connecticut footprint, the volume floor is gone and the geolocation product needs a consent-based redesign.

Maryland's Online Data Privacy Act is Chapter 455 of 2024, approved 9 May 2024 and effective 1 October 2025; it does not apply to processing activities before 1 April 2026 (Maryland General Assembly, SB 541; Koley Jessen, 1 October 2025). It covers controllers that process data of 35,000 Maryland consumers, or 10,000 if more than 20% of revenue comes from selling personal data (Koley Jessen, 1 October 2025).

What makes it different is that consent is not a basis. Sensitive data, which includes consumer health data defined as data used to identify physical or mental health status, may not be collected, processed or shared unless "strictly necessary to provide or maintain a specific product or service" the consumer requested, and the sale of sensitive data is prohibited outright (Koley Jessen, 1 October 2025; Baker Donelson, 23 October 2025). The statute does not define "strictly necessary". No ad targeting is strictly necessary for a product the consumer asked for, so health-based targeting, retargeting and audience sales are simply unavailable for Maryland consumers, and a consent banner does not change that. Geofencing within 1,750 feet of mental health, reproductive or sexual health facilities is banned. Enforcement sits with the AG's Division of Consumer Protection; a discretionary 60-day cure period sunsets on 1 April 2027 (Koley Jessen, 1 October 2025); Holland & Knight cites penalties of $10,000 per violation and $25,000 for repeats under the state's consumer protection act (Holland & Knight, 25 August 2026). There is no entity-level HIPAA exemption, so a hospital's non-PHI marketing data is in scope (Baker Donelson, 23 October 2025).

The New York Health Information Privacy Act has passed the legislature twice. The first version, S929, passed in January 2025 and was vetoed by Governor Hochul on 19 December 2025; the veto memo said the bill's "definitions and scope are broad" and could create uncertainty (Healthcare Brew, 12 January 2026; NY Senate, Krueger and Rosenthal statement). The revised bill, S9269/A10357, was introduced on 20 February 2026, passed the Senate 48 to 13 on 3 June 2026 and passed the Assembly on 4 June 2026; as of 17 October 2026 the Senate bill page showed no delivery to the governor (NY Senate, S9269; NYCLU, June 2026).

The revised text keeps the core. "Regulated health information" is information reasonably linkable to an individual, including through persistent identifiers such as cookie IDs or IP addresses, and collected or processed in connection with physical or mental health status, including algorithmic inferences. Processing is unlawful unless it is strictly necessary for listed purposes or supported by a valid authorization that is separate from other transactions, in plain language and at least 12-point type, with no re-solicitation for nine months after a refusal. The Attorney General has exclusive enforcement with civil penalties up to $15,000 per violation and a six-year limitation period. Compared with the vetoed version, the 2026 bill adds exemptions (Part 2 substance-use records, clinical trial data, FDA-regulated activities), removes the 24-hour waiting period and the revenue-based penalty, and shortens the effective date to six months after enactment (MoFo, 17 March 2026). Because the definition names cookie IDs and IP addresses, every bidstream and pixel flow that carries health context for a New York resident would need an authorization. Plan for it; do not build on it until it is signed.

Health-based audience targeting (T). In Washington and Nevada, you need opt-in consent to collect and a separate opt-in to share before a health-derived segment can be used on third-party media (RCW 19.373.030). In the 16 opt-in states, you need consent before processing the sensitive data at all; in Utah and Iowa, notice and an opt-out are enough (Mayer Brown, 3 September 2026). In Maryland, you cannot do it. The only architecture that works everywhere is one that does not use health data for targeting: contextual placement, or cohorts built from non-health first-party data. The HIPAA guide sets out those architectures.

Retargeting from health pages (R). A pixel on a condition page that later shows that person an ad is collection (the page visit) and sharing (the event to the platform). Under Washington's and Nevada's definitions, interest in a treatment is health data; under condition-or-diagnosis laws it depends on how specific the page is. Gate the tag behind a health-data consent, or run the page without third-party tags. The pixel problem reference lists the page types that trigger obligations.

Measurement and attribution (M). Sending a conversion event ("booked a consultation", "ordered a prescription") to a platform is sharing in Washington and Nevada and processing of sensitive data elsewhere. Aggregate measurement computed inside your own environment avoids the question. Where a clean room is used, require aggregate outputs only; see Clean rooms vs CDP.

Data sales and retail media (S). Washington and Nevada require a written authorization per consumer that expires after one year before any sale (RCW 19.373.070; NRS 603A.535); Connecticut requires consent; Maryland bans it. A pharmacy retail media network therefore has to run on front-store loyalty data and keep the prescription data behind a wall. The same separation logic a bank uses for GLBA data applies; see Ad tech compliance: PCI, HIPAA, SOC 2.

Location (geofencing). Do not build geofences around clinics, pharmacies, hospitals or mental and reproductive health facilities in Washington (2,000 feet), Nevada, Connecticut or Maryland (1,750 feet). Connecticut and Oregon ban the sale of precise geolocation outright from 1 October 2026 and 1 January 2026 respectively (WilmerHale, 31 July 2026; IAPP, 5 January 2026). The FTC's orders against Gravy Analytics and Mobilewalla, finalized 14 January 2025, bar the sale of sensitive location data including visits to medical facilities (Hunton, 4 February 2025).

Lead generation and forms. A symptom quiz, an eligibility form or a "find a treatment" tool produces health data at the moment of input. Collect it under an explicit health-data consent, keep it out of tag payloads, and never pass it to a platform as a custom audience. The FTC's Hims & Hers complaint of 29 July 2026 alleges both pixels on intake flows and customer-list uploads (Baker Donelson, 25 August 2026).

Identity. The identifiers that carry health context (cookies, device IDs, hashed emails) are the same ones the market relies on after Chrome dropped the Privacy Sandbox. The consent and suppression design must sit on top of whichever identity stack you use; see the identity and privacy hub. European readers face the same question under GDPR's special-category rules; see EU sovereign ad tech.

Which states have health-specific privacy laws? Washington (My Health My Data Act, in force from 31 March 2024), Nevada (SB 370, 31 March 2024), Connecticut (health amendments to its privacy act, 2023) and Maryland (Online Data Privacy Act, 1 October 2025, applying to processing from 1 April 2026) (Washington AG; Orrick, 13 July 2023; Koley Jessen, 1 October 2025). New York's bill passed both houses in June 2026 and awaits the governor. Twenty other states cover health data as "sensitive data" inside comprehensive laws.

Does Washington's law apply to companies outside Washington? Yes. A regulated entity is any legal entity that conducts business in Washington or provides products or services targeted to Washington consumers and determines the purpose and means of processing consumer health data (RCW 19.373.010). The Attorney General notes that an entity that only stores data in Washington is not regulated, but one that targets Washington consumers is (Washington AG). The first class action was against Amazon's advertising SDK, not a Washington company (Paul Hastings, February 2025).

Is visiting a page about a condition "consumer health data"? In Washington and Nevada, usually yes if it is linked to a person: the definitions cover information that identifies health status, including inferences, and Holland & Knight's August 2026 analysis treats browsing that reveals interest in a specific treatment as health data under the MHMDA (Holland & Knight, 25 August 2026). Under condition-or-diagnosis laws it depends on specificity. Under HIPAA, a federal court held on 20 June 2024 that an IP address plus an unauthenticated page visit is not PHI (AHA, 20 June 2024). The state answer is stricter than the federal one.

Can an advertiser geofence a pharmacy or clinic? Not in Washington within 2,000 feet of any in-person health care provider, and not in Nevada within 1,750 feet of a medical facility, even with consent (RCW 19.373.080; NRS 603A.540). Connecticut and Maryland ban 1,750-foot geofences around mental, reproductive and sexual health facilities (Orrick, 24 July 2023; Koley Jessen, 1 October 2025). Elsewhere, precise geolocation is sensitive data needing opt-in in most states, and Connecticut and Oregon ban its sale.

Is New York's Health Information Privacy Act in force? No. As of 17 October 2026 it has passed both houses (Senate 3 June 2026, Assembly 4 June 2026) but has not been delivered to the governor (NY Senate, S9269). If signed, it takes effect six months later (MoFo, 17 March 2026). The 2025 version was vetoed on 19 December 2025.

Use the ad tech compliance guide to compare the related operating models, definitions and evidence before making this decision.

1. Mayer Brown, State Privacy Law Tracker (current as of 3 September 2026). https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker
2. IAPP, Joe Duball, "New year, new rules: US state privacy requirements coming online as 2026 begins" (5 January 2026). https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins
3. IAPP, US State Privacy Legislation Tracker (updated 8 September 2026). https://iapp.org/resources/article/us-state-privacy-legislation-tracker
4. Clym, "U.S. State Privacy Laws: The 2026 Comparison Guide" (23 June 2026). https://www.clym.io/blog/us-privacy-law-comparison-map
5. privacyterms.io, "20 US State Privacy Laws in 2026: The Full List and Tracker" (24 July 2026). https://privacyterms.io/us-state-privacy-laws-2026
6. Enzuzo, "U.S. State Privacy Laws: 2026 Tracker and Compliance Guide" (updated 23 September 2026). https://www.enzuzo.com/blog/us-state-privacy-laws
7. RCW 19.373.010, Definitions. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010
8. RCW 19.373.030, Collection or sharing of consumer health data. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030
9. RCW 19.373.070, Sale of consumer health data. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070
10. RCW 19.373.080, Geofence restrictions. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080
11. RCW 19.373.090, Application of consumer protection act. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090
12. RCW 19.86.090, Civil action for damages (treble damages). https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.090
13. RCW 19.86.140, Civil penalties. https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.140
14. Washington State Office of the Attorney General, "Protecting Washingtonians' Personal Health Data and Privacy" (accessed 17 October 2026). https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
15. Washington State Attorney General, Data Privacy Report 2026 (released 14 August 2026). https://agportal-s3bucket.s3.us-west-2.amazonaws.com/Data%20Privacy/DPR_2026_final.pdf
16. WilmerHale, "Washington Attorney General Publishes First Data Privacy Report" (1 September 2026). https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260901-washington-attorney-general-publishes-first-data-privacy-report
17. IAPP, Jedidiah Bracy, "Washington's attorney general reflects on state's privacy legislation and enforcement" (9 October 2026). https://iapp.org/news/a/washingtons-attorney-general-reflects-on-states-privacy-legislation-and-enforcement
18. Paul Hastings, "Biometrics Litigation Update: First Class Action Complaint Filed Under Washington's My Health My Data Act" (February 2025). https://paulhastings.com/insights/ph-privacy/biometrics-litigation-update-first-class-action-complaint-filed-under-washingtons-my-health-my-data-act-is-your-company-ready
19. EPIC, "Alive and Kicking: Washington State's My Health My Data Act Goes into Effect Today" (31 March 2024). https://epic.org/alive-and-kicking-washington-states-my-health-my-data-act-goes-into-effect-today/
20. Nevada Revised Statutes, Chapter 603A (NRS 603A.400 to 603A.550). https://www.leg.state.nv.us/nrs/NRS-603A.html
21. Orrick, "Nevada's New Consumer Health Data Privacy Law: 6 Things to Know" (13 July 2023). https://www.orrick.com/en/Insights/2023/07/Nevadas-New-Consumer-Health-Data-Privacy-Law-6-Things-to-Know
22. Hunton Andrews Kurth, "Connecticut and Nevada Legislatures Pass Health Data Laws" (June 2023). https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticut-and-nevada-legislatures-pass-health-data-laws
23. Orrick, "The Consumer Health Data Amendments to the Connecticut Data Privacy Act: Six Things to Know" (24 July 2023). https://www.orrick.com/en/Insights/2023/07/The-Consumer-Health-Data-Amendments--to-the-Connecticut-Data-Privacy-Act
24. BCLP, "Expansion of Connecticut Data Privacy Act" (2023). https://www.bclplaw.com/en-US/events-insights-news/expansion-of-connecticut-data-privacy-act.html
25. WilmerHale, "Connecticut Amends Its Data Privacy Act to Increase Data Protections" (31 July 2026). https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260731-connecticut-amends-its-data-privacy-act-to-increase-data-protections
26. Maryland General Assembly, SB 541 (2024), Maryland Online Data Privacy Act of 2024, Chapter 455. https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS
27. Koley Jessen, "Maryland Online Data Privacy Act" (1 October 2025). https://www.koleyjessen.com/insights/publications/maryland-online-data-privacy-act
28. Baker Donelson, "Maryland's New Online Data Privacy Act: Sweeping Protections for Consumer Health Data" (23 October 2025). https://www.bakerdonelson.com/marylands-new-online-data-privacy-act-sweeping-protections-for-consumer-health-data-and-implications-for-health-care-life-sciences-and-ai
29. New York State Senate, Bill S9269 (2025–2026 session), action history. https://www.nysenate.gov/legislation/bills/2025/S9269
30. Morrison Foerster, "NYHIPA Returns in 2026: Revised Health Information Privacy Bill Introduced in New York" (17 March 2026). https://www.mofo.com/resources/insights/260316-nyhipa-returns-in-2026-revised-bill
31. Healthcare Brew, "New York's governor vetoes popular health data privacy bill" (12 January 2026). https://www.healthcare-brew.com/stories/2026/01/12/new-york-governor-vetoes-health-data-privacy-bill
32. New York State Senate, "Statement From Senator Liz Krueger And Assemblymember Linda Rosenthal On Governor's Veto Of New York Health Information Privacy Act" (December 2025). https://www.nysenate.gov/newsroom/press-releases/2025/liz-krueger/statement-senator-liz-krueger-and-assemblymember-linda
33. NYCLU, "State Legislature Passes New York Health Information Privacy Act" (June 2026). https://www.nyclu.org/press-release/state-legislature-passes-new-york-health-information-privacy-act
34. Holland & Knight, Brett Elliott and Shalyn Watkins, "The Pixel Problem: Advertising Triggers Health Data Obligations for Medical Aesthetic Practices" (25 August 2026). https://www.hklaw.com/en/insights/publications/2026/08/the-pixel-problem-advertising-triggers-health-data-obligations
35. California Department of Justice, Office of the Attorney General, "Privacy Enforcement Actions" (Healthline Media, 1 July 2025). https://oag.ca.gov/privacy/privacy-enforcement-actions
36. Hunton Andrews Kurth, "FTC Finalizes Orders Against Data Brokers Over Sensitive Location Data" (4 February 2025). https://www.hunton.com/privacy-and-information-security-law/ftc-finalizes-orders-against-data-brokers-over-sensitive-location-data
37. Baker Donelson, "FTC Targets Hims & Hers Over Health Data Sharing" (25 August 2026). https://www.bakerdonelson.com/ftc-targets-hims-hers-over-health-data-sharing-the-tracking-tools-are-now-part-of-the-case
38. American Hospital Association, "Judge rules in favor of AHA, vacating HHS online tracking bulletin" (20 June 2024). https://www.aha.org/news/news/2024-06-20-judge-rules-favor-aha-vacating-hhs-online-tracking-bulletin-unlawful-and-beyond-agency-authority

• 18 October 2026: aligned the title and heading and applied recorded source-URL corrections where needed. Factual research cutoff remains 17 October 2026.

• 17 October 2026. First edition: 5 health-specific entries (4 in force, 1 pending) and 24 comprehensive laws (20 in effect, 4 enacted). Next review 15 January 2027.