{"page":"/blog/state-health-privacy-laws-ad-tech-tracker","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["State","Law, citation","Effective","Health data definition","Consent model","Geofence rule","PRA","Enforcement","Ad tech consequence"],"rows":[["Washington","My Health My Data Act, RCW 19.373 (signed 27 April 2023)","Geofence ban 23 July 2023; regulated entities 31 March 2024; small businesses 30 June 2024 (WA AG)","Status: \"identifies the consumer's past, present, or future physical or mental health status\" (RCW 19.373.010)","Opt-in to collect; separate opt-in to share; written authorization to sell, expiring after one year (RCW 19.373.030; RCW 19.373.070)","2,000 feet or less around any entity providing in-person health care; no consent exception (RCW 19.373.080)","Yes, via CPA: actual damages, treble up to $25,000, fees (RCW 19.86.090)","AG under CPA, up to $7,500 per violation (RCW 19.86.140)","T: health-based targeting only with opt-in to collect and to share. R: retargeting from health pages is sharing; needs the second consent. M: sending health events to a platform is sharing. S: audience sales need the one-year written authorization. Applies to any entity targeting Washington consumers."],["Nevada","SB 370 (2023), NRS 603A.400 to 603A.550 (signed 16 June 2023)","31 March 2024 (Orrick, 13 July 2023)","Status-type: personally identifiable information linked or reasonably linkable to a consumer and relating to health (NRS 603A.430)","Affirmative, voluntary consent to collect; separate consent to share; written authorization to sell, one-year expiry (NRS 603A.500, 603A.535)","1,750 feet around any medical facility, even with consent (NRS 603A.540)","No (NRS 603A.550)","Violation is a deceptive trade practice under NRS 598 (NRS 603A.550)","Same T/R/M/S pattern as Washington without the private suit. The 1,750-foot ban reaches location-based campaigns around clinics and pharmacies."],["Connecticut","Consumer health data amendments to the CTDPA, Public Act 23-56 (signed 26 June 2023); amended by SB 1295 (2025) and SB 4 (2026)","1 October 2023 for the health provisions per Orrick; 1 July 2023 per BCLP (see editor note) (Orrick, 24 July 2023; BCLP, 2023)","Condition or diagnosis: \"personal data that a controller uses to identify a consumer's physical or mental health condition or diagnosis\" (Orrick, 24 July 2023)","Opt-in before processing; no sale without consent (Orrick, 24 July 2023)","1,750 feet around mental, reproductive or sexual health facilities (Orrick, 24 July 2023)","No","AG exclusive; 60-day cure expired 31 December 2024 (Orrick, 24 July 2023). From 1 July 2026 any processing of sensitive data triggers the law regardless of volume; from 1 October 2026 sale of precise geolocation is banned (WilmerHale, 31 July 2026)","T/R/M on health data need opt-in. S banned without consent. Any ad tech vendor processing Connecticut health data is in scope after 1 July 2026 even with a small footprint. Location products cannot sell precise geolocation after 1 October 2026."],["Maryland","Online Data Privacy Act, Chapter 455 of 2024 (approved 9 May 2024)","1 October 2025; does not apply to processing before 1 April 2026 (Maryland General Assembly, SB 541; Koley Jessen, 1 October 2025)","Status: data used to identify physical or mental health status, plus condition or diagnosis (Baker Donelson, 23 October 2025)","Strictly necessary for a requested product or service; consent is not a basis; sale of sensitive data banned (Koley Jessen, 1 October 2025)","1,750 feet around mental health, reproductive or sexual health facilities (Koley Jessen, 1 October 2025)","No","AG Division of Consumer Protection; 60-day discretionary cure sunsets 1 April 2027 (Koley Jessen, 1 October 2025); penalties up to $10,000 per violation, $25,000 for repeats (Holland & Knight, 25 August 2026)","T/R on health data are not strictly necessary for anything a consumer asked for, so they are off the table. M: health-event sharing with a platform is processing beyond necessity. S: banned. The strictest state for ad tech."],["New York (pending)","Health Information Privacy Act, S9269/A10357 (2026); predecessor S929 vetoed 19 December 2025","Six months after enactment, if signed (MoFo, 17 March 2026)","Status: \"regulated health information\" reasonably linkable to an individual, including via cookie IDs or IP addresses, and processed in connection with health status, including inferences (MoFo, 17 March 2026)","Valid authorization required unless strictly necessary; authorization must be separate, plain-language, 12-point; no re-solicitation for nine months (MoFo, 17 March 2026)","Not addressed in the sources reviewed","No; AG exclusive (MoFo, 17 March 2026)","AG; up to $15,000 per violation; six-year limitation period (MoFo, 17 March 2026)","If signed: T/R/M/S on health data need a standalone authorization. Cookie IDs and IP addresses are named as linkable identifiers, which reaches pixel and bidstream flows directly. Status as of 17 October 2026: passed both houses, awaiting the governor (NY Senate, S9269)."]],"sourceUrls":[["https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy","https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010","https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030","https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070","https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080","https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.090","https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.140"],["https://www.orrick.com/en/Insights/2023/07/Nevadas-New-Consumer-Health-Data-Privacy-Law-6-Things-to-Know","https://www.leg.state.nv.us/nrs/NRS-603A.html"],["https://www.orrick.com/en/Insights/2023/07/The-Consumer-Health-Data-Amendments--to-the-Connecticut-Data-Privacy-Act","https://www.bclplaw.com/en-US/events-insights-news/expansion-of-connecticut-data-privacy-act.html","https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260731-connecticut-amends-its-data-privacy-act-to-increase-data-protections"],["https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS","https://www.koleyjessen.com/insights/publications/maryland-online-data-privacy-act","https://www.bakerdonelson.com/marylands-new-online-data-privacy-act-sweeping-protections-for-consumer-health-data-and-implications-for-health-care-life-sciences-and-ai","https://www.hklaw.com/en/insights/publications/2026/08/the-pixel-problem-advertising-triggers-health-data-obligations"],["https://www.mofo.com/resources/insights/260316-nyhipa-returns-in-2026-revised-bill","https://www.nysenate.gov/legislation/bills/2025/S9269"]]}