{"page":"/blog/state-health-privacy-laws-ad-tech-tracker","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["State","Law","Effective","Health definition family","Consent model (sensitive data)","Geofence or location rule","PRA","Ad tech consequence"],"rows":[["California","CCPA as amended by CPRA","1 January 2020; CPRA 1 January 2023","CA: information \"collected and analyzed concerning a consumer's health\"","Limit (right to limit use and disclosure of sensitive PI)","None specific; precise geolocation is sensitive PI","Breaches only","T/R/M: opt-out of sale and sharing, honor Global Privacy Control, limit-use right for health; AG has used purpose limitation against a health publisher ($1.55M Healthline, 1 July 2025 (CA AG)). CMIA adds a private claim for medical information."],["Virginia","Consumer Data Protection Act","1 January 2023","Diagnosis","Opt-in","Sale of precise geolocation banned (per WilmerHale, 31 July 2026)","No","T/R/M on diagnosis data need opt-in; targeted-ads opt-out for everything else."],["Colorado","Colorado Privacy Act","1 July 2023","Condition or diagnosis","Opt-in","None","No","Opt-in for health-based T/R/M; universal opt-out signals mandatory."],["Connecticut","Data Privacy Act (plus health amendments, Table A)","1 July 2023","Condition or diagnosis; \"consumer health data\" added 2023","Opt-in","1,750 feet (Table A)","No","See Table A."],["Utah","Consumer Privacy Act","31 December 2023","Condition or diagnosis (medical history, condition, treatment or diagnosis)","Opt-out","None","No","Notice and opt-out suffice for health-based T/R; the most permissive regime."],["Texas","Data Privacy and Security Act","1 July 2024","Diagnosis","Opt-in","None","No","Opt-in before health-based T/R/M; opt-out of targeted ads and sale; penalties up to $7,500 per violation with a 30-day cure (Holland & Knight, 25 August 2026)."],["Oregon","Consumer Privacy Act","1 July 2024","Condition or diagnosis","Opt-in","Sale of precise geolocation banned from 1 January 2026 (IAPP, 5 January 2026)","No","Opt-in for health T/R/M; no location data sales; universal opt-out signals from 2026."],["Montana","Consumer Data Privacy Act","1 October 2024","Condition or diagnosis","Opt-in","None","No","Opt-in for health T/R/M."],["Florida","Digital Bill of Rights","1 July 2024","Diagnosis","Opt-in","None","No","Applies only above a $1 billion revenue threshold, so few ad tech firms are in scope (privacyterms.io, 24 July 2026)."],["Delaware","Personal Data Privacy Act","1 January 2025","Condition or diagnosis (including pregnancy)","Opt-in","None","No","Opt-in for health T/R/M."],["Iowa","Consumer Data Protection Act","1 January 2025","Diagnosis","Opt-out","None","No","Notice and opt-out; permissive like Utah."],["Nebraska","Data Privacy Act","1 January 2025","Diagnosis","Opt-in","None","No","Opt-in for health T/R/M; no revenue or volume threshold for most businesses."],["New Hampshire","Privacy Act","1 January 2025","Condition or diagnosis","Opt-in","None","No","Opt-in for health T/R/M."],["New Jersey","Data Privacy Act","15 January 2025","Condition, treatment or diagnosis","Opt-in","None","No","Opt-in for health T/R/M; \"treatment\" widens the definition to appointment and purchase data."],["Tennessee","Information Protection Act","1 July 2025","Diagnosis","Opt-in","None","No","Opt-in for health T/R/M."],["Minnesota","Consumer Data Privacy Act","31 July 2025","Condition or diagnosis","Opt-in","None","No","Opt-in for health T/R/M; right to question profiling."],["Maryland","Online Data Privacy Act (Table A)","1 October 2025","Status","Strictly necessary; no sale","1,750 feet","No","See Table A."],["Indiana","Consumer Data Protection Act","1 January 2026","Diagnosis (made by a health care provider)","Opt-in","None","No","Narrowest definition; inferred health interest is not sensitive, but opt-in applies once a provider diagnosis is involved."],["Kentucky","Consumer Data Protection Act","1 January 2026","Diagnosis","Opt-in","None","No","Opt-in for health T/R/M."],["Rhode Island","Data Transparency and Privacy Protection Act","1 January 2026","Condition or diagnosis","Opt-in","None","No","Opt-in for health T/R/M; 35,000-consumer threshold (IAPP, 5 January 2026)."],["Oklahoma","Consumer Data Privacy Act","1 January 2027","n/d (verify statute)","Opt-in","n/d","No","Enacted; Virginia-model per secondary sources (Enzuzo, 23 September 2026)."],["Louisiana","Data Privacy Act","1 January 2027","n/d (verify statute)","Opt-in","n/d","No","Enacted (Mayer Brown, 3 September 2026)."],["Alabama","Personal Data Protection Act","1 May 2027","n/d (verify statute)","Opt-in","n/d","No","Enacted (Mayer Brown, 3 September 2026)."],["Vermont","Data Privacy and Online Surveillance Act","1 January 2028","n/d (verify statute)","Opt-in","n/d","n/d (verify)","Enacted (Mayer Brown, 3 September 2026)."]],"sourceUrls":[["https://oag.ca.gov/privacy/privacy-enforcement-actions"],[],[],[],[],["https://www.hklaw.com/en/insights/publications/2026/08/the-pixel-problem-advertising-triggers-health-data-obligations"],["https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins"],[],["https://privacyterms.io/us-state-privacy-laws-2026"],[],[],[],[],[],[],[],[],[],[],["https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins"],["https://www.enzuzo.com/blog/us-state-privacy-laws"],["https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker"],["https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker"],["https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker"]]}