What does Washington's My Health My Data Act mean for advertisers?
Part of US and Canada targeting
The short answer
Washington's My Health My Data Act, RCW 19.373, protects consumer health data: personal information linked or reasonably linkable to a consumer that identifies their physical or mental health status, including inferences. It requires opt in consent to collect or share that data, a signed authorization to sell it, and bans geofences around in-person health care providers.
Key takeaways
- The act was signed on April 27, 2023; its geofence ban applied to all persons from July 23, 2023, and its consent and policy duties from March 31, 2024, or June 30, 2024 for small businesses.
- Consumer health data includes health status inferred from nonhealth information, by any means including algorithms or machine learning.
- Personal information under the act includes data tied to a cookie ID, an IP address or a device identifier.
- A geofence under the act is a virtual boundary of 2,000 feet or less from the perimeter of a physical location.
What does Washington's My Health My Data Act cover?
The My Health My Data Act is chapter 19.373 of the Revised Code of Washington. The Washington Attorney General's FAQ (opens in a new tab) says it was signed into law by Governor Jay Inslee on April 27, 2023, and describes it as protecting health data that falls outside HIPAA. Its duties come in sections with their own dates, which have all passed: the geofence ban first, then the consent, privacy policy and sale rules.
| Duty | What it requires | Applies from |
|---|---|---|
| Geofence ban (RCW 19.373.080) | No geofence around an entity providing in-person health care used to track, collect data from or send ads to consumers | July 23, 2023, for all persons |
| Privacy policy (19.373.020) | A consumer health data privacy policy linked from the homepage | March 31, 2024; small businesses June 30, 2024 |
| Consent to collect and share (19.373.030) | Consent for a specified purpose, with separate consent to share | March 31, 2024; small businesses June 30, 2024 |
| Authorization to sell (19.373.070) | A signed valid authorization before selling or offering to sell | March 31, 2024; small businesses June 30, 2024 |
| Enforcement (19.373.090) | A violation is an unfair or deceptive act under the Consumer Protection Act | With each duty |
The AG's FAQ states that a violation is "a per se violation of the Washington Consumer Protection Act (CPA), RCW 19.86, which is enforced by the Attorney General as well as through private action." That private route sets the act apart from state privacy laws enforced only by an attorney general, which are summarized on the US state privacy laws page.
What counts as consumer health data?
Definition
- Consumer health data
- Under RCW 19.373.010 (opens in a new tab), "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status."
The statute lists what health status includes: conditions, treatment and diagnoses, use or purchase of prescribed medication, bodily functions and vital signs, gender affirming care information, reproductive or sexual health information, biometric and genetic data, precise location that could reasonably indicate an attempt to receive health services, and data identifying a consumer seeking health care. The last item reaches inferences: information processed to associate a consumer with any of those categories that is "derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning)."
The AG's FAQ gives both sides of that line. It recalls that "in 2012 the media reported that a retailer was assigning shoppers a 'pregnancy prediction score'" from purchases, and says such information "is protected consumer health data even though it was inferred from nonhealth data." It also says that "nonhealth data that a regulated entity collects but does not process to identify or associate a consumer with a physical or mental health status is not consumer health data."
| Term | The statute's definition |
|---|---|
| Personal information | Information that identifies or is reasonably capable of being associated or linked with a consumer, including data tied to "a cookie ID, an IP address, a device identifier, or any other form of persistent unique identifier" |
| Consumer | A natural person who is a Washington resident, or whose consumer health data is collected in Washington, acting in an individual or household context |
| Collect | "To buy, rent, access, retain, receive, acquire, infer, derive, or otherwise process consumer health data in any manner" |
| Precise location information | Location that identifies an individual within a radius of 1,750 feet |
| Deidentified data | Data that cannot reasonably be linked to a consumer or device, when the holder takes reasonable measures, commits publicly not to reidentify it and binds recipients by contract |
What does the act say about geofencing?
Section 080 is the act's clearest advertising rule. RCW 19.373.080 (opens in a new tab) makes it "unlawful for any person to implement a geofence around an entity that provides in-person health care services" where the geofence is used to identify or track consumers seeking health care services, to collect consumer health data, or to "send notifications, messages, or advertisements to consumers related to their consumer health data or health care services." Because it applies to "any person," the AG's FAQ says out of state entities that are persons must comply with it.
Definition
- Geofence, under the act
- Technology using GPS coordinates, cell tower connectivity, cellular data, RFID, Wifi data or other location detection to set a virtual boundary around a physical location or locate a consumer within it, limited to "a virtual boundary that is 2,000 feet or less from the perimeter of the physical location."
Who does the My Health My Data Act apply to?
The policy and consent duties fall on a regulated entity: any legal entity that "Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington" and that determines the purpose and means of collecting, processing, sharing or selling consumer health data. Government agencies, tribal nations and their contracted service providers are excluded. The AG's FAQ adds that "An entity that only stores data in Washington is not a regulated entity," and that out of state processors for regulated entities must comply.
| Role | Statutory test | Key duties |
|---|---|---|
| Regulated entity | Does business in or targets Washington and decides purposes and means | Privacy policy, consent to collect, separate consent to share, authorization to sell |
| Small business | A regulated entity handling data of fewer than 100,000 consumers a year, or under 50 percent of revenue from that data and fewer than 25,000 consumers | The same duties, from June 30, 2024 |
| Processor | Processes consumer health data on behalf of a regulated entity or small business | Processes only under a binding contract with the regulated entity and its instructions; out of state processors included |
| Any person | Natural persons, corporations, trusts, associations and partnerships | Geofence ban and the sale authorization rule |
Consent under the act has a specific meaning. It is "a clear affirmative act" that is opt in, and it may not be obtained through acceptance of general terms of use, by "hovering over, muting, pausing, or closing a given piece of content," or through deceptive designs. Sharing needs consent "separate and distinct" from collection consent, unless sharing is necessary to provide a product or service the consumer requested. A sale needs a signed authorization that names the buyer and the purpose and expires one year after signing.
Does contextual health advertising involve consumer health data?
The statute answers this through its definitions rather than an advertising exemption. Consumer health data must be personal information linked or reasonably linkable to a consumer, and the AG's FAQ says nonhealth data not processed to associate a consumer with a health status is not consumer health data. Choosing a health article as a placement is a decision about a page. Whether the campaign around that page processes consumer health data depends on what else happens to the data tied to the people who read it.
Data points in a health campaign to map against RCW 19.373
- Which identifiers the campaign receives or stores, since cookie IDs, IP addresses and device identifiers count as personal information.
- Whether any system infers a health status about a person from page visits, searches or purchases, which the act treats as consumer health data.
- Whether a health related audience segment built from Washington consumers is shared with a third party or sold.
- Whether any location setting draws a boundary of 2,000 feet or less around an in-person health care provider.
- Whether a tag or pixel on a health landing page sends data to a partner, which may be sharing under the act.
A site list built from the meaning of pages, with no identifiers attached, sits on the page side of that map. Measurement tags, retargeting pools and audience layers sit on the people side. IP address treatment in other laws is covered in IP addresses as personal information.
What does a Washington health campaign look like on a real brief?
Fictional example
Physical therapy clinics in Spokane and Yakima
An unnamed physical therapy clinic group plans display ads in Spokane and Yakima, eastern Washington, to announce weekend appointments. An early draft of the plan asked for a one block radius around partner orthopedic clinics. The planner flags it against RCW 19.373.080, since the clinics provide in-person health care and the radius is under 2,000 feet, and the radius comes out.
The plan instead targets the two metro areas and a site list of running, injury recovery, workplace ergonomics and regional sports pages, chosen by page content. The team drops a retargeting pool built from visits to its own pain symptom pages, and records which tags fire on the booking landing page.
How does PlacementGraph build a health site list without personal data?
Frequently asked questions
Does the act apply to businesses outside Washington?
It can. A regulated entity includes one that produces or provides products or services targeted to consumers in Washington, wherever it is based. The AG's FAQ says out of state processors for regulated entities must comply, and that out of state entities that are persons must comply with sections 9 and 10, the sale and geofence rules.
Is buying toilet paper or deodorant consumer health data?
The AG's FAQ says information about the purchase of toilet paper or deodorant is not consumer health data. It also says an app that tracks digestion or perspiration does collect consumer health data, and that inferences drawn from purchases to associate a consumer with a health status are protected.
What must a consumer health data privacy policy disclose?
RCW 19.373.020 requires a policy, linked prominently from the homepage, that discloses the categories of consumer health data collected and why, the categories of sources, the categories shared, the third parties and affiliates it is shared with, and how consumers can exercise their rights. New categories or purposes need disclosure and affirmative consent first.
Does deidentified data fall under the act?
Personal information excludes deidentified data, defined as data that cannot reasonably be linked to a consumer or a device, held by an entity that takes reasonable measures, publicly commits not to reidentify it, and contractually binds recipients to the same terms.
Sources
- Protecting Washingtonians' Personal Health Data and Privacy (My Health My Data Act FAQ) (opens in a new tab)Washington State Office of the Attorney General
- RCW 19.373.010, Definitions (opens in a new tab)Washington State Legislature
- RCW 19.373.020, Consumer health data privacy policy (opens in a new tab)Washington State Legislature
- RCW 19.373.030, Collection or sharing of consumer health data (opens in a new tab)Washington State Legislature
- RCW 19.373.070, Valid authorization to sell (opens in a new tab)Washington State Legislature
- RCW 19.373.080, Geofence restrictions (opens in a new tab)Washington State Legislature
- RCW 19.373.090, Application of consumer protection act (opens in a new tab)Washington State Legislature
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.