How do state consumer health data laws like Washington's My Health My Data Act affect marketing?
State consumer health data laws make health brands get opt-in consent before they collect or share health-related data for marketing, and they ban geofenced ads near care locations. Washington's My Health My Data Act is the strictest. It covers inferences from shopping and browsing, requires separate consents and a separate policy, and lets consumers sue. Connecticut and Nevada add similar rules.
- Health inferences count. Purchases or page views used to infer a condition become consumer health data in Washington.
- Two consents, not one. Washington requires consent to collect and separate consent to share; selling needs a signed authorization.
- No geofencing near care. Washington bans geofences of 2,000 feet or less around in-person health care providers for tracking or health ads.
- Consumers can sue in Washington, so one national standard built to the strictest state is often the simplest choice.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What counts as consumer health data under Washington's law?
Almost any personal information that identifies a person's past, present or future physical or mental health. That includes inferences drawn from data that is not obviously medical, such as purchases or app activity, when those inferences link a person to a health condition. HIPAA-protected health information is exempt, because HIPAA already covers it.
Washington passed the My Health My Data Act in 2023. It is codified at RCW chapter 19.373. Its main duties applied to most businesses from March 31, 2024, and to small businesses from June 30, 2024. The geofencing ban applied to everyone from July 23, 2023 (Washington Attorney General).
The Attorney General's guidance gives a useful line. Buying a prescription medicine counts. Buying toilet paper or deodorant alone does not. In between sits a wide band that marketers touch every day: a protein powder bought alongside a glucose-related search, a sleep supplement, a page view on a hair-loss article. When your systems use that data to infer something about health, it becomes consumer health data.
Who the law reaches
- Regulated entities. Businesses that do business in Washington or target Washington consumers, and decide why and how consumer health data is handled.
- Small businesses. Covered too, on the later date.
- Processors. Vendors that handle data for a regulated entity, including those outside the state.
- Consumers. Washington residents, and anyone whose consumer health data is collected in Washington.
That last point matters for national brands. A shopper from another state who browses your site from a Seattle hotel can be a consumer under the law.
Exemptions sit in RCW 19.373.100. They cover HIPAA protected health information and certain data de-identified to the HIPAA standard. A practice's patient records are therefore under HIPAA. The same practice's direct-to-consumer product shop may not be.
What consent does the law require before marketing uses health data?
Two separate consents. A business needs consent to collect consumer health data for a stated purpose, and a separate consent to share it, unless the data is needed to provide a product or service the person asked for. Selling the data needs a signed authorization. Consent must be a clear affirmative act, never a buried term.
The definition of consent is strict. It must be freely given, specific, informed, opt-in, voluntary and unambiguous. The statute rules out three common tricks: accepting general terms of use, hovering over or closing a piece of content, and "deceptive designs" that steer people toward yes.
Each consent request must say what categories of data you collect or share, the purpose, the categories of recipients, and how to withdraw. That is more than a cookie banner usually says.
| Action | What Washington requires | Marketing example |
|---|---|---|
| Collect | Consent for a specified purpose, unless necessary for the requested product or service | A quiz that asks about symptoms before recommending a product |
| Share | Separate consent from collection consent, unless necessary for the requested service | Sending quiz answers or purchase data to an ad platform or partner |
| Sell | A valid authorization signed by the consumer; both seller and buyer keep a copy for six years | Renting or trading a customer list that implies health status |
| New purpose | Prior disclosure in the privacy policy and fresh affirmative consent | Deciding later to use past buyers for lookalike audiences |
The separate privacy policy
Covered businesses must publish a consumer health data privacy policy and link to it prominently from the homepage. It sits apart from the general privacy policy. It has to say what is collected, why, from where, what is shared, with which categories of third parties and named affiliates, and how people use their rights. Marketing teams should read it before launching any new data use, because the law bars collecting or sharing beyond what that policy discloses.
Can health brands still use location targeting?
Not around places that provide in-person health care in Washington. The law bans any geofence of 2,000 feet or less around such a place when it is used to identify or track people seeking care, collect their health data, or send them health-related ads or messages. Connecticut and Nevada have similar location limits.
The Washington definition of a geofence is "a virtual boundary that is 2,000 feet or less from the perimeter of the physical location." The ban covers clinics, hospitals, pharmacies and any other entity that provides in-person health care services. It applies to every person and business, not only regulated entities.
This rules out a familiar tactic: serving ads to phones seen near a competitor's clinic, or near a pharmacy, for a health product. It also rules out collecting location pings in those zones to build an audience later.
How three state laws compare
| Point | Washington | Connecticut | Nevada |
|---|---|---|---|
| Law | My Health My Data Act, RCW 19.373 (2023) | Consumer health data amendments to the Connecticut Data Privacy Act (2023) | SB 370 (2023), consumer health data law |
| Consent | Separate consent to collect and to share; signed authorization to sell | Consent to process consumer health data as sensitive data; consent before any sale | Consent to collect and share; authorization before sale |
| Geofencing | Banned within 2,000 feet of in-person health care providers for tracking or health ads | Banned around mental health, reproductive or sexual health facilities for health data purposes | Restricted near providers of in-person health care |
| Who enforces | Attorney General, and private lawsuits under the Consumer Protection Act | Attorney General | Attorney General |
Read the official texts before acting: the Connecticut Attorney General's CTDPA page and the Nevada SB 370 bill text. Details such as distances, thresholds and effective dates differ, and other states have bills in progress. Ask counsel which apply to your footprint.
Which everyday marketing activities do these laws affect?
Mostly the ones that move data off your site or build audiences from behavior. Pixels on product and quiz pages, purchase-based audiences, retargeting from condition content, data enrichment, affiliate and partner sharing, and location targeting are the main pressure points. Plain search ads, content, SEO and email to consented subscribers are usually manageable.
| Activity | Why it is sensitive | Safer approach |
|---|---|---|
| Ad pixels on condition or product pages | A page view on a condition-specific product can reveal a health inference to the ad platform | Keep pixels off condition-specific pages, or fire only with collection and sharing consent |
| Health quizzes | Answers are direct consumer health data | Ask for consent before the quiz, keep answers out of ad tools, explain use in plain words |
| Purchase-based lookalike audiences | A buyer list for a health product is a list of health inferences | Use only with sharing consent that names this purpose; otherwise use broad or contextual targeting |
| Retargeting from blog content | Reading about a condition can be used to infer it | Retarget from general pages, not condition articles, or seek consent |
| Data enrichment and list rental | Sharing or buying health inferences can be a sale | Avoid unless counsel approves and authorization exists |
| Affiliate and creator links | Partners may receive order data tied to products | Share only order totals and codes, not product-level detail where it implies health |
Run the audit by page type, not by tool. Group your pages into general, product, condition-related and logged-in. Then decide which tags may fire on each group, and under what consent. This is simpler to maintain than a tool-by-tool list.
Supplement and D2C brands meet these questions most often. Our guides to D2C health brand marketing and the FTC Health Breach Notification Rule cover the federal layer that sits beside these state laws.
What happens if a brand gets this wrong?
In Washington, a violation is a per se violation of the state Consumer Protection Act. The Attorney General can bring a case, and consumers can sue. That private right of action is unusual among state privacy laws and is the main reason national brands take Washington seriously. Connecticut and Nevada leave enforcement to their Attorneys General.
"Per se" means a plaintiff does not have to prove the practice was unfair in the usual way. The violation of the health data law is itself the unfair or deceptive act. Remedies under the Consumer Protection Act can include damages, injunctions and attorney fees, so defending a class claim can cost far more than fixing the setup.
Federal exposure can stack on top. The FTC has treated undisclosed sharing of health data as a deceptive practice, and the FTC's breach notification rule can apply to apps and connected products. For practices covered by HIPAA, the HHS Office for Civil Rights has its own guidance on online tracking technologies. A federal court vacated part of that guidance in 2024, the part about unauthenticated public pages, but tracking on patient portals and other authenticated pages is still covered.
Signals that draw attention
- A consumer health data policy that is missing from the homepage or copied from a general policy.
- Ad tags that fire on quiz results, checkout confirmation or condition pages without consent.
- Consent screens with pre-checked boxes or a single "accept all" button.
- Marketing emails that reveal a condition in the subject line.
How do general state privacy laws treat health data?
Most comprehensive state privacy laws classify health information as sensitive data. That usually means opt-in consent before processing it, or at least a clear right to limit its use. So even outside Washington, Connecticut and Nevada, health brands should assume that health-related marketing data needs more care than ordinary browsing data.
Virginia is a good example of the general model. Its law treats a mental or physical health diagnosis as sensitive data that needs consent. Our guide to the Virginia Consumer Data Protection Act explains how that works for healthcare marketing.
The practical difference is scope. General privacy laws often apply only above revenue or volume thresholds. The health-specific laws in Washington and Connecticut apply to consumer health data without those thresholds. A small brand can be outside the general law and still inside the health law.
One design that works across states
Many brands choose to build one standard and apply it nationally. It is easier than running a different site for each state, and it lowers the risk of a mistake in the strictest one. A national standard usually includes the separate health data policy, opt-in consent before any health-related sharing, no geofencing around care locations, and neutral email subject lines.
How should a health brand plan marketing under these laws?
Start from the strictest rule, map data by page type, get consent where it is needed, and grow through channels that do not depend on health inferences. Put one senior person in charge of signing off on new data uses, so growth and privacy decisions are made together rather than in separate meetings.
- Inventory. List every place you collect data that could reveal health, including quizzes, carts, forms and chat.
- Classify pages. General, product, condition-related and logged-in. Set tag rules for each.
- Write the policy. Publish the consumer health data policy and link it from the homepage.
- Build consent. Separate collection and sharing choices, plain words, no dark patterns, logged records.
- Retire risky tactics. Geofencing near care sites, list rental, and purchase-based audiences without consent.
- Lean on durable channels. Search, SEO, content, marketplaces where you sell, consented email and creator partnerships with clear disclosures.
- Review quarterly. New laws keep arriving, and new tools keep getting added.
At Ichelon Consulting US, Santosh Reddy, Partner, leads this kind of work as fractional CMO for health brands and digital health companies. We sign a BAA with every US client and work alongside your counsel, not in place of them. Learn about the fractional CMO service or book a call.
Related pages from the US team
Fractional CMO for healthcare companies
Senior marketing leadership that signs off on new data uses.
FTC Health Breach Notification Rule
The federal rule for health apps and connected products.
Virginia Consumer Data Protection Act
How a general state privacy law treats health data.
D2C health brand marketing
Channels that grow a health brand without relying on health inferences.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
What is Washington's My Health My Data Act?
It is a 2023 Washington law, codified at RCW chapter 19.373, that protects consumer health data outside HIPAA. It requires consent to collect and separate consent to share that data, a signed authorization to sell it, and a separate consumer health data privacy policy linked from the homepage. It also bans geofencing around health care locations.
Does the My Health My Data Act apply to businesses outside Washington?
It can. The law covers businesses that do business in Washington or target Washington consumers. It protects Washington residents and anyone whose consumer health data is collected in Washington. A national supplement or telehealth brand that sells to Washington buyers should assume the law applies and confirm with counsel.
Does consumer health data include inferences from shopping or browsing?
Yes, under Washington's law. Data that is not medical on its face becomes consumer health data when it is used to infer or link a person to a health condition. The Attorney General's guidance says buying prescription medicine counts, while buying ordinary items like toilet paper or deodorant alone does not.
Can a health brand use geofencing ads in Washington?
Not around in-person health care locations. Washington bans geofences of 2,000 feet or less around such places when they are used to track people seeking care, collect their health data, or send health-related ads. Connecticut restricts geofencing around mental, reproductive and sexual health facilities for health data purposes.
Is HIPAA data covered by the My Health My Data Act?
No. Protected health information under HIPAA is exempt, as is certain information de-identified under the HIPAA standard. A medical practice's patient records stay under HIPAA. A product shop, quiz or app run outside the HIPAA relationship can still fall under the Washington law.
Who enforces Washington's consumer health data law?
The Washington Attorney General, and consumers through private lawsuits. A violation is a per se violation of the state Consumer Protection Act, so the violation itself is treated as the unfair or deceptive act. Connecticut and Nevada leave enforcement of their consumer health data laws to their Attorneys General.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Not sure which of your tags touch health data?
A 30-minute call with the US team. We will walk through your page types, tags and consent flow, and show you what to change before it becomes a legal question.