Does Washington's My Health My Data Act Apply to My Marketing?
Last updated: August 10, 2026 ยท By Jason Garrett, Founder, Coast Studio. Not legal advice. Full legal landscape: The State of HIPAA Tracking.
If you market to Washington consumers and touch anything health-related, assume it applies. MHMDA reaches past HIPAA's covered entities to almost any business handling "consumer health data," and it is the law marketers should worry about most, because it comes with a private right of action.
Why it is broader than HIPAA
HIPAA binds covered entities and their business associates. MHMDA binds businesses handling consumer health data about Washington residents — a category that sweeps in wellness brands, DTC health companies, and apps that never touch a HIPAA obligation. "Consumer health data" is defined broadly enough to include data that infers a health condition from behavior, which is exactly what an ad pixel does.
The consent standard that changes everything
MHMDA requires opt-in consent before collecting consumer health data, and separate consent before sharing it. That is stricter than the notice-and-opt-out model most marketing stacks assume. A pixel that fires on page load, before the visitor agrees, is the default violation. Firing ad tags only after affirmative consent — the MHMDA standard — is the fix, and it is the standard we expect more states to copy.
The teeth: a private right of action
Most privacy laws are enforced by regulators. MHMDA lets consumers sue. The first class actions are already moving, which is why plaintiff firms treat it as a live theory alongside wiretapping claims. That combination — broad scope plus private suits — is what makes it the state law to design around.
What to do
- Run a consent management platform and gate all ad and analytics tags behind opt-in for Washington traffic.
- Keep consent logs with timestamps, tied to what you send downstream.
- Keep health data out of ad platforms that sign no BAA, consent or not — consent permits sharing, it does not make the recipient compliant.
FAQ
We're not based in Washington. Does it still apply?
Location of your business does not matter; the residency of the consumer does. If Washington residents can reach your funnel, plan for it.
Is a cookie banner enough?
Only if it is a true opt-in gate that blocks tags until consent, not a notice that fires tags on load. Most banners are the latter.
Do other states have this?
Washington was first and strictest; Nevada and others have followed with similar consumer-health-data rules. The opt-in posture travels well.
Sorting out your exposure?
Coast Studio runs compliance-first paid media for regulated health brands — we map your legal exposure and build tracking that holds up. Not legal advice.
Book a Consultation