Washington's My Health My Data Act and your website's tracking

Who the Act applies to

The Act regulates any legal entity that:

• conducts business in Washington, or produces or provides products or services targeted to Washington consumers; and
• alone or jointly with others, determines the purpose and means of collecting, processing, sharing or selling consumer health data (RCW 19.373.010(23)).

You don't need an office in Washington. The Attorney General's FAQ says out-of-state businesses that provide products or services to Washington and handle consumer health data are generally covered (WA AG FAQ). A “consumer” is a Washington resident, or anyone whose consumer health data is collected in Washington (RCW 19.373.010(7)).

Dates: most obligations applied from March 31, 2024, and from June 30, 2024 for small businesses as the Act defines them. The geofencing ban has applied to everyone since July 23, 2023.

What counts as “consumer health data”

It's personal information that is linked or reasonably linkable to a consumer and identifies their past, present or future physical or mental health status (RCW 19.373.010(8)). The statute's examples include:

• health conditions, treatment, diagnoses and procedures
• use or purchase of prescribed medication
• bodily functions, vital signs and symptoms
• reproductive or sexual health information, and gender-affirming care information
• biometric and genetic data
• precise location that could indicate someone is seeking health services
• data that identifies a consumer seeking health care services
• information derived or inferred from non-health data, “including algorithms or machine learning”

“Personal information” explicitly includes data tied to a persistent identifier such as a cookie ID, IP address or device identifier (RCW 19.373.010(18)). The Attorney General adds that buying ordinary toiletries generally isn't consumer health data, but inferences drawn from purchases can be, and that buying non-prescription medication counts only when a health inference is drawn from it.

Why cookies and pixels matter

“Collect” is defined broadly: to “buy, rent, access, retain, receive, acquire, infer, derive, or otherwise process” consumer health data (RCW 19.373.010(5)). “Share” includes making data available to a third party by electronic means (RCW 19.373.010(27)).

A marketing pixel on a symptom quiz, a “book a consultation” page, or a product page for a prescription treatment can send page URLs, events and identifiers to an ad platform. Depending on what's sent and how it's used, that may be both collecting and sharing consumer health data.

What the Act requires before collecting or sharing

Under RCW 19.373.030, you may not collect consumer health data unless the consumer consents for a specified purpose, or it's necessary to provide a product or service the consumer requested. You may not share it unless the consumer gives consent that is separate and distinct from the collection consent, or it's necessary to provide a requested product or service.

Consent must be obtained before collection or sharing, and the request must clearly and conspicuously disclose:

1. the categories of consumer health data collected or shared
2. the purpose, including the specific ways the data will be used
3. the categories of entities it's shared with
4. how the consumer can withdraw consent

Consent is a “clear affirmative act” that is “freely given, specific, informed, opt-in, voluntary, and unambiguous” (RCW 19.373.010(6)). Accepting general terms of use, hovering over, muting, pausing or closing content, and agreement obtained through deceptive designs don't count.

Selling consumer health data needs a separate, signed valid authorization with set contents. It expires one year after signing, and both seller and buyer keep a copy for six years (RCW 19.373.070). A cookie banner is not that authorization.

Other obligations that touch your website

• Consumer Health Data Privacy Policy. Publish one and link to it prominently on your homepage (RCW 19.373.020). The Act defines “homepage” as the site's introductory page and any page where personal information is collected. The Attorney General says the link must be separate and distinct, and the policy may not contain information the Act doesn't require.
• Consumer rights (RCW 19.373.040): consumers can confirm and access their data, withdraw consent, and request deletion, which must be passed on to processors and third parties. You respond within 45 days of receiving the request, extendable once by 45 days.
• Geofencing. Using a geofence of 2,000 feet or less around an in-person health care provider to track consumers, collect their data, or send them health-related ads is prohibited (RCW 19.373.080).
• Exemptions include HIPAA protected health information and several other regulated data sets (RCW 19.373.100). The exemption is for the data, not the company, so a HIPAA covered entity may still hold consumer health data the Act covers.

Enforcement

A violation is an unfair or deceptive act under Washington's Consumer Protection Act (RCW 19.373.090). The Attorney General can bring cases and seek civil penalties of up to $7,500 per violation. Consumers can sue too: a private plaintiff must show injury to their business or property, and trebled damages are capped at $25,000 (RCW 19.86.090). Private lawsuits citing the Act, including claims over website pixels, have been reported (Hintze Law, Nov 2025).

Where a consent banner fits, and where it doesn't

A consent tool can help with the website part of the problem:

• Holding tags until there's a real opt-in. Analytics, marketing pixels and session tools stay off until the visitor makes an affirmative choice.
• Separate choices to collect and to share. The visitor can allow health data on your site without allowing it to go to ad platforms.
• Disclosure at the moment of choice. The banner can describe the categories, purposes and recipients, and link to your Consumer Health Data Privacy Policy.
• A record of each decision, and an easy way to withdraw consent later.

It can't fix what happens after the browser: form submissions sent to your CRM, server-side event APIs (such as a conversions API), data shared with affiliates or warehouses, whether a given use counts as a “sale”, your privacy policy wording, or your process for consumer requests. Those need your own review and, ideally, counsel.

How CookieGuard's Healthcare plan supports MHMDA consent

• Two health-data choices, “Health data” and “Share health data with partners”. Neither is ever pre-checked, sharing needs health data first, Accept All grants neither, and Reject All denies both.
• Ad tags wait for consent to share. With health-data mode on (the default), marketing tags and Google's ad signals stay off until the visitor agrees to share health data. You can also hold analytics until health data is on.
• Washington rules where they apply. Switch on MHMDA and visitors located in Washington get an opt-in banner with these choices. Location comes from the visitor's connection, which only approximates where data is collected, so you can extend the rules to all US visitors or to everyone. They also apply when a visitor's location can't be determined.
• Your Consumer Health Data Privacy Policy, linked in the banner wherever health rules apply.
• Consent records for each decision, including whether MHMDA applied and whether health data and sharing were granted, computed on the server and exportable as CSV or JSON.

Related guides: Nevada SB 370 · Tracking pixels on telehealth and health websites