Washington My Health My Data Act

The My Health My Data Act applies to any legal entity that does business in Washington or targets Washington consumers. There’s no revenue threshold and no general nonprofit exemption. Its core duties have applied since March 31, 2024, and to small businesses since June 30, 2024.

It’s not only for health companies. “Consumer health data” is broad: it includes data that identifies someone seeking health care, location data that could show a visit to a health provider, and health inferences drawn from non-health data. The Attorney General gives purchases of toiletries as an example.

Publish a Consumer Health Data Privacy Policy, and link to it prominently from your homepage. The Attorney General says it must be a separate and distinct link, not just part of your main privacy policy.

• Collect health data only with consent for a specified purpose, or where needed for a service the consumer asked for.
• Share it only with a separate consent.
• Sell it only with a valid authorization signed by the consumer, which expires after one year.

“Sharing” is defined broadly, including making data available or providing access to it. An ad or analytics pixel that sends health-related page views to a third party can fall within it.

• Rights to access the data, including a list of every third party and affiliate it was shared with; delete it, including from backups (within six months); and withdraw consent.
• Respond within 45 days, extendable once by 45 more. Free up to twice a year.
• Appeals: decided within 45 days, with how to contact the Attorney General.

Geofencing within 2,000 feet of an in-person health care provider, to track consumers, collect their data or send health ads, is banned.

A violation is an unfair or deceptive act under Washington’s Consumer Protection Act. The Attorney General can seek up to $7,500 per violation. Unlike almost every state privacy law, consumers can sue too, for actual damages, treble damages up to $25,000, and attorney fees.

The first class action was filed against Amazon in February 2025, alleging its ads SDK collected precise location data without consent; it has been consolidated in federal court in Seattle.