Washington My Health My Data Act for advertisers: the text, the consents and the lawsuits so far

What the statute says. A regulated entity is any legal entity that conducts business in Washington, or targets products or services to consumers there, and that decides the purpose and means of handling consumer health data (RCW 19.373.010(23)). A consumer is a Washington resident, or anyone whose consumer health data is collected in Washington (RCW 19.373.010(7)). A small business is a regulated entity below 100,000 consumers a year, or below 25,000 consumers with less than half its revenue from health data (RCW 19.373.010(28)).

Processors act under a binding contract. A processor that goes beyond its instructions becomes a regulated entity for that data (RCW 19.373.060). The sale and geofence sections are wider still: they bind "any person" (RCW 19.373.070; RCW 19.373.080).

What the Attorney General has said. Storing data in Washington does not by itself make a company a regulated entity. Out-of-state processors for regulated entities must comply, and so must out-of-state persons under the sale and geofence sections (Washington AG, FAQ 3).

The exemptions are mostly data-level. The act excludes protected health information under HIPAA, data handled under GLBA and FCRA, and some research data (RCW 19.373.100). It does not exclude HIPAA covered entities as such. A hospital's website analytics that are not PHI can therefore sit inside the act, unless they are "intermingled" with PHI in the way subsection (1)(b) describes.

Read each row with its facts. The test turns on whether the data is linkable to a person and whether it identifies, or is used to infer, a health status.

"Collect" is defined to include "infer" and "derive" (RCW 19.373.010(5)). A DSP that builds a health inference from bid-stream signals is therefore collecting, even if no one typed in a symptom.

What the statute says. Collection needs consent "for a specified purpose", or must be necessary for a product or service the consumer asked for (RCW 19.373.030(1)(a)). Sharing needs a second consent, separate from the first, or the same necessity (.030(1)(b)). Each request must name the data categories, the purpose, the categories of recipients and how to withdraw (.030(1)(c)).

Consent must be opt-in and unambiguous. Accepting broad terms of use, closing a piece of content, or agreeing through a deceptive design does not count (RCW 19.373.010(6)). "Share" covers any disclosure to a third party or an affiliate. Disclosure to a processor is excluded only when it serves the purpose for which the data was collected (.010(27)).

The policy link. Each regulated entity needs a consumer health data privacy policy, linked from its homepage (RCW 19.373.020). The AG says it "must be a separate and distinct link" with nothing extra in it (FAQ 4).

An example. A telehealth brand runs a symptom quiz and fires an ad platform's tag on the results page. The quiz answers are collected by the brand. The tag sends them, or an event naming the condition, to the platform. Under the definitions, that second step is sharing, unless the platform acts only as the brand's processor for that purpose.

What practitioners do (practice, not law). Many teams ask for the two consents on separate screens and log each one against the identifiers it covers. Tags on health pages often stay off until both are recorded, which a consent management platform (CMP) can enforce.

What the statute says. Selling, or offering to sell, consumer health data without a valid authorization is unlawful (RCW 19.373.070(1)). "Sell" means an exchange "for monetary or other valuable consideration" (.010(26)). The authorization must be in plain language, signed and dated, and must name:

1. The specific health data to be sold.
2. The seller and the buyer, with contact details.
3. The purpose, including how the buyer will use the data.
4. That goods or services cannot be conditioned on signing.
5. The right to revoke, and how.
6. That the buyer may redisclose the data.
7. An expiry date one year from signature.

A form combined with other documents is invalid, and so is one that conditions service on signing (.070(3)). The consumer gets a copy. Seller and buyer each keep the form for six years (.070(4)-(5)).

What the AG has said. If a consumer later asks for deletion, a company may meet both duties by redacting the data description in the retained form (FAQ 7).

What the statute says. No person may place a geofence around an entity that provides in-person health care services for three purposes (RCW 19.373.080). The banned purposes are to identify or track people seeking care, to collect their health data, and to send them notifications, messages or ads about their health data or care. A geofence is a virtual boundary of 2,000 feet or less from the site's perimeter (.010(14)).

The section has no consent exception in its text. "Health care services" includes the "use or purchase of medication" (.010(15)), which reads as reaching pharmacies. Whether a general store with a pharmacy counter is such an entity is a question for counsel.

What practitioners do (practice, not law). Location buyers commonly load exclusion lists of clinics, hospitals and pharmacies into their DSP and check vendor polygons against the 2,000-foot line.

The statute. Violations run through the Consumer Protection Act (RCW 19.373.090). The Attorney General can seek civil penalties of up to $7,500 per violation (RCW 19.86.140). A private plaintiff must be "injured in his or her business or property" and may recover actual damages, fees and discretionary trebling capped at $25,000 (RCW 19.86.090).

The Attorney General. The AG's guidance calls any violation a "per se violation" of the Consumer Protection Act (FAQ 2). We found no public enforcement action by the AG under RCW 19.373 as of 9 November 2026. In an interview, Attorney General Nick Brown described his office's approach as "thoughtful" because the law is new (IAPP, 9 October 2026).

The courts. The table lists suits pleading MHMDA claims that we could confirm on a docket. Status is as shown on CourtListener on 9 November 2026.

In the dockets we read, no court has ruled on what the act's definitions mean. The pending California case is the one to watch for a first reading.

This map reads the statute against common components. It describes where each section bites, not what a given company must do.

What practitioners do (practice, not law). Some advertisers keep health pages free of third-party tags and buy contextual targeting instead. Others route health events only to vendors under processor contracts. The pixel problem guide covers tag patterns in more depth.

• "Other valuable consideration." Ad platforms often take data in exchange for services, not cash. Whether that is a sale under .010(26) is not settled by any ruling we found.
• Processor status of ad platforms. The share exception needs a processor acting within the original purpose. Platforms that use data across clients may not fit.
• The injury requirement. RCW 19.86.090 needs injury to business or property. How courts apply it to privacy harms under this act is untested in the dockets above.

Nevada wrote a narrower version of the same model; see Nevada's consumer health data law. Connecticut took a different route inside its general privacy act; see Connecticut's consumer health data rules. The ad tech compliance hub collects the related federal and state pages.

1. Washington State Legislature, Chapter 19.373 RCW, Washington my health my data act (full chapter, sections .005 to .900), checked 9 November 2026. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true
2. RCW 19.373.010, Definitions. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010
3. RCW 19.373.020, Consumer health data privacy policy. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.020
4. RCW 19.373.030, Collection or sharing of consumer health data. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030
5. RCW 19.373.060, Processors. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.060
6. RCW 19.373.070, Valid authorization to sell. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070
7. RCW 19.373.080, Geofence restrictions. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080
8. RCW 19.373.090, Application of consumer protection act. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090
9. RCW 19.373.100, Exemptions. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100
10. RCW 19.373.900, Short title. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.900