You're Not HIPAA Covered, but Consumer Health Data Laws Still Apply to Your Marketing

A supplement brand founder told me last year, with total confidence, that health privacy was "a hospital problem." They sold gut health capsules online, ran Meta and TikTok ads, and had a quiz on the site that asked about bloating, sleep, and stress. No doctors, no insurance claims, no HIPAA. In their mind, that settled it.

It did not settle it. HIPAA only covers certain health care entities and the vendors that work for them. A growing set of state consumer health data laws was written specifically for everyone else: the apps, sites, and brands that collect health signals without ever touching a medical record. Washington's My Health My Data Act is the headline example, and it is the one I would worry about first if I ran marketing for a wellness, fitness, supplement, beauty, or telehealth-adjacent brand.

This post covers what these laws actually say, where marketing teams create exposure without realizing it, and the audit I run when a client asks whether their tracking setup is a problem. I am an operator who builds tracking and paid media systems, not a lawyer, and this is not legal advice. Bring what you find to privacy counsel. My job is to tell you what your site and ad accounts are really doing, which is usually the part nobody has looked at.

Why "We're Not HIPAA Covered" Is the Wrong Starting Point

Washington's legislature said the quiet part out loud in the findings section of the law. It notes that HIPAA "only covers health data collected by specific health care entities," and that health data collected by "certain apps and websites" does not get the same protection. The My Health My Data Act (RCW 19.373) was passed to close that gap.

That is the whole point of consumer health data compliance. The question is no longer "are we a covered entity?" The question is "do we collect, infer, or share information that could reveal something about a person's health?" For a lot of consumer brands, the honest answer is yes, and the data is flowing out through the marketing stack.

If you do fall under HIPAA, the pixel problem looks a little different, and I wrote that version up in our HIPAA marketing pixels diligence checklist. This post is for the brands that assumed they were outside the blast radius.

What the My Health My Data Act Actually Covers

The My Health My Data Act applies to "regulated entities," which the statute defines as any legal entity that conducts business in Washington, or produces or provides products or services targeted to Washington consumers, and that determines the purpose and means of processing consumer health data. There is no revenue threshold to get in the door. Smaller businesses get a later compliance date, not an exemption.

The definition of consumer health data is wide

The law defines consumer health data as personal information that is "linked or reasonably linkable to a consumer" and that identifies the consumer's past, present, or future physical or mental health status. The list of examples is long. It includes health conditions and treatment, use or purchase of prescribed medication, bodily functions, vital signs, symptoms, reproductive or sexual health information, gender-affirming care information, biometric and genetic data, and precise location that could reasonably indicate someone is trying to get health services or supplies.

Two parts of the definition matter most for marketers.

• Inferences count. The definition includes health information "derived or extrapolated from nonhealth information," including inferred data produced "by any means, including algorithms or machine learning." If your audience model decides someone is likely trying to conceive, that inference is in scope.
• Identifiers count. "Personal information" in the act expressly includes data tied to a persistent unique identifier, such as "a cookie ID, an IP address, a device identifier." That is exactly what an ad pixel sends.

The Washington Attorney General's office has given some useful edges here. According to Davis Wright Tremaine's summary of the AG FAQ, buying ordinary toiletries like deodorant or mouthwash is not consumer health data by itself. But health inferences drawn from purchases, such as guessing that a shopper is pregnant, are. So are data from apps that track things like digestion. The line is not the product. The line is whether you use the data to associate a person with a health status.

Who counts as a consumer

A "consumer" under the act is a Washington resident, or a person whose consumer health data is collected in Washington. Employees acting in an employment context are excluded. If you sell nationally online, you almost certainly have Washington consumers in your funnel.

The Rules That Bite Marketing Teams

Most of the act's obligations took effect March 31, 2024, with a June 30, 2024 date for small businesses, according to the Washington Attorney General's FAQ. The geofencing ban came earlier and applies to everyone. Here is what changes day to day for a marketing team.

Opt-in consent to collect, and separate consent to share

You may not collect consumer health data without consent for a specified purpose, unless the collection is necessary to provide a product or service the consumer asked for. Sharing needs its own consent that is "separate and distinct" from the collection consent. Consent has to come before the collection or sharing, and the request has to spell out the categories of data, the purpose, the categories of recipients, and how to withdraw.

The act is also blunt about what does not count as consent. Accepting broad terms of use does not count. Hovering over, muting, pausing, or closing content does not count. Agreement obtained through "deceptive designs" does not count. If your cookie banner nudges people toward "Accept all" and fires pixels before anyone clicks, that banner is not doing the job this law asks of it.

A separate consumer health data privacy policy

Regulated entities need a consumer health data privacy policy that lists the categories of health data collected, the purposes, the sources, what is shared, the categories of third parties and specific affiliates it goes to, and how consumers can exercise their rights. A link to it has to be prominently published on your homepage. A paragraph buried in your general privacy policy is not what the statute describes.

Selling requires a signed authorization

Selling consumer health data requires a "valid authorization" signed by the consumer. The statute lists what it must contain, including the name and contact information of the buyer, the purpose of the sale, a statement that the consumer can revoke it, and an expiration date one year from signing. Both seller and buyer have to keep copies for six years. "Sale" means exchanging the data for money or "other valuable consideration," which is the phrase that should make you look hard at any data-sharing arrangement with an ad platform or partner.

The geofencing ban

The act makes it unlawful for any person to put a geofence around an entity that provides in-person health care services if the geofence is used to identify or track consumers seeking care, collect their consumer health data, or send them notifications, messages, or ads related to their health data or health care services. A geofence under the act is a virtual boundary 2,000 feet or less from the facility's perimeter. That section has applied to all persons since July 23, 2023.

Think about what that means for a med spa, an IV hydration studio, a physical therapy adjacent fitness concept, or a supplement brand that wants to target people leaving a clinic. "Health care services" in the act is defined broadly as services that "assess, measure, improve, or learn about" a person's mental or physical health. Local geo campaigns that were routine a few years ago deserve a second look.

Consumer rights

Consumers can confirm whether you collect their health data, access it along with a list of the third parties and affiliates you shared it with, withdraw consent, and demand deletion. Deletion has to reach backups and has to be passed along to every processor and third party you shared with. You generally have 45 days to respond.

The Private Right of Action, and the Amazon Case

This is the part that separates Washington from most state privacy laws. A violation of the My Health My Data Act is treated as a violation of the Washington Consumer Protection Act, which the Attorney General enforces and which private plaintiffs can also use. The AG's own FAQ confirms enforcement "through private action."

There is an important limit. As Husch Blackwell's Byte Back analysis explains, the act does not offer statutory damages the way California's CIPA does. A private plaintiff still has to show injury to business or property caused by the violation. The Consumer Protection Act allows actual damages, attorney's fees, and treble damages capped at $25,000. That is a narrower path than many headlines implied, but it is still a path, and class actions multiply small numbers.

The first class action under the act was filed in February 2025. In Maxwell v. Amazon.com (W.D. Wash.), the plaintiff alleged that Amazon's advertising SDK, embedded in third-party apps, collected precise location data that could indicate attempts to get health services, without the consent the act requires. Amazon denied the claims. Many articles still describe this case as pending, but the federal docket shows it was consolidated into In re Amazon Ads SDK Litigation, Maxwell voluntarily dismissed her claims without prejudice on May 29, 2025, and the consolidated case was closed in June 2025 after a further voluntary dismissal. There was no ruling on the merits.

My read: the lack of a court decision does not mean the law is toothless. It means the key questions, like what injury a plaintiff has to show, are still open. And the theory in that complaint was an SDK quietly collecting location signals. That is a marketing technology fact pattern, not a hospital one.

Nevada, Connecticut, and the Other States Following Washington

Washington is not alone. Several states have added consumer health data rules, and the details differ in ways that matter.

Nevada SB 370

Nevada's SB 370 took effect March 31, 2024. It follows the Washington model: a consumer health data privacy policy, affirmative consent to collect or share outside of what is needed to provide a requested product or service, written authorization to sell, and consumer rights to access and deletion. Its geofencing ban covers a virtual boundary within 1,750 feet of medical facilities and other providers of in-person health care services or products. The big difference is enforcement. Nevada does not include a private right of action. Enforcement runs through the Attorney General.

Connecticut's consumer health data amendments

Connecticut amended its existing privacy law, the CTDPA, through Public Act 23-56 (SB 3). The consumer health data provisions took effect in 2023, and Orrick notes a budget bill pushed their start to October 1, 2023. Key points for marketers:

• The consumer health data rules apply to persons who do business in Connecticut or target its residents, regardless of the CTDPA's usual size thresholds.
• No person may sell or offer to sell consumer health data without first getting the consumer's consent.
• No person may use a geofence within 1,750 feet of a mental health facility or reproductive or sexual health facility to identify, track, collect data from, or send notifications to a consumer about their consumer health data.
• Processing consumer health data generally requires opt-in consent, consistent with how the CTDPA already treats sensitive data.

Maryland and New York

Maryland's Online Data Privacy Act, in effect since October 1, 2025, treats consumer health data as sensitive data. Under Section 14-4707, a controller may not collect, process, or share sensitive data unless it is "strictly necessary" to provide or maintain a specific product or service the consumer requested, and may not sell sensitive data at all. The law has applicability thresholds, so check whether you meet them, but for brands that do, it is stricter than a consent model.

New York's legislature passed a Health Information Privacy Act in early 2025 that Governor Hochul vetoed in December 2025. A revised version passed both chambers in 2026. When I checked in late October 2026 it was still awaiting the governor, so it is not law yet. It is worth watching if you sell into New York.

The Federal Layer: FTC Health Data Enforcement

State laws are not the only exposure. The FTC has been going after non-HIPAA health brands for sharing health signals with ad platforms for years.

• GoodRx (2023). The FTC's first enforcement action under the Health Breach Notification Rule alleged GoodRx shared health information with Facebook, Google, and others. GoodRx agreed to a $1.5 million civil penalty and a ban on sharing health data for advertising.
• BetterHelp (2023). The FTC finalized an order requiring BetterHelp to pay $7.8 million for consumer refunds and banning it from sharing health data for advertising, over allegations it shared data such as email addresses, IP addresses, and health questionnaire information with platforms including Facebook and Snapchat.
• The updated Health Breach Notification Rule. The FTC's amended rule, effective July 29, 2024, makes clear it covers many health apps and similar technologies not covered by HIPAA, and that an unauthorized disclosure, not just a hack, can be a breach that triggers notice.

Read those cases as a marketer and the pattern is obvious. None of them were about stolen databases. They were about pixels and integrations doing exactly what they were installed to do.

Where Wellness Brand Pixel Compliance Breaks Down

When I audit a wellness or consumer health brand, the exposure almost never sits in the CRM. It sits in the marketing stack, in places nobody thinks of as "health data systems."

Pixels on health pages

A Meta, TikTok, or Google tag on a page titled "Hormone Balance Support" or "Anxiety Relief Gummies" sends the page URL, the event, and identifiers like cookie IDs and IP addresses to the ad platform. Put those together and you can argue the platform now knows a specific person was interested in a health condition. Add-to-cart and purchase events on condition-specific products make it worse.

Quizzes and intake forms

Product quizzes are conversion gold and a compliance hazard. "What is your main concern? Sleep, stress, digestion, low libido." If the answers land in URL parameters, custom event names, or form-field auto-capture, they can end up with every vendor on the page. I have seen quiz answers sitting in plain text in an analytics tool's event stream.

SDKs in your app

Fitness and tracking apps are full of third-party SDKs for ads, attribution, and analytics. Each one is a potential "share" under the act, and some collect location. The Amazon complaint was built on this exact fact pattern.

Audience targeting and lookalikes

Uploading a customer list of people who bought a menopause product, or building a lookalike off them, may share consumer health data with the platform. Interest-based targeting that infers a condition raises the same inference question the act explicitly covers.

Geofencing and location campaigns

Any campaign that draws a boundary near clinics, pharmacies, therapy offices, or similar providers needs a hard look under Washington, Nevada, and Connecticut. The distances and the covered facilities differ by state, so do not assume one rule fits all three.

Retargeting

Following someone around the internet with ads for the yeast infection product they looked at is the user experience these laws were written to stop. If it would make the customer uncomfortable to see, assume a regulator would find it interesting too.

If this sounds familiar, the same tools also drive the California wiretapping claims I covered in our CIPA website wiretapping post. One audit can address both.

A Consumer Health Data Compliance Audit for Marketers

This is the checklist I work through. It is technical and practical on purpose. Legal decides what the rules require. Marketing and engineering have to prove what the stack actually does.

1. Map your health signals. List every product, page, quiz, form, app screen, and email flow that touches a health condition, symptom, body function, medication, reproductive topic, or care-seeking behavior. Include inferences your team or tools make.
2. Inventory every tag and SDK. Use a browser network inspector and a tag audit, not your tag manager's container list. Note what fires on health pages, what fires before consent, and what each one sends.
3. Check URLs, event names, and parameters. Look for health terms in page paths, query strings, UTM parameters, and custom event names. "purchase_menopause_kit" is a data point you just shared.
4. Turn off automatic form capture. Disable features that auto-collect form fields or page content in pixels and session tools, especially on quizzes and intake forms.
5. Fix consent so it actually blocks scripts. Under the My Health My Data Act, consent must come before collection or sharing, and sharing needs its own consent. Test that tags stay off until the right choice is made, and that "decline" really means nothing fires.
6. Publish a consumer health data privacy policy. Make it a separate, specific policy and link it prominently from your homepage, as Washington requires.
7. Review audiences and list uploads. Stop building audiences from health-condition purchasers or quiz answers unless counsel has signed off on consent and the sharing model.
8. Kill or redraw geofences. Pull any campaign with a boundary near health care facilities, and set a written rule with your agency so it does not come back.
9. Read your vendor terms. Find out whether each platform can use your data for its own purposes. That can turn a processor into a third party and a "share" into something closer to a "sale."
10. Stand up a rights request process. Access, withdrawal, and deletion requests need a path that reaches every vendor you shared with, within the deadlines.
11. Move conversion signals server side. More on this below. It is the single biggest risk reducer I know.
12. Document it. Keep a dated record of what you found and fixed. If you are raising money or selling the company, buyers will ask, and it belongs in any marketing due diligence review.

Why Offline Conversion Tracking Is the Safer Path

I have a strong opinion here. For health-adjacent brands, browser pixels are the wrong default. Every pixel on a health page is a third party watching your customer in real time, and you do not fully control what it collects.

Offline conversion tracking flips the model. The customer's data comes to your systems first. You decide what verified outcome to send to Google or Meta, through a server-side, first-party connection, after the customer has consented. You can send "a purchase happened, worth $60" without sending which product, which page, or which quiz answer. Ad platforms still get the signal they need to optimize. Your customer's health interest stays with you.

It is not a free pass. You still need proper notice and consent, and hashed identifiers are still personal information. But it shrinks the number of vendors touching health signals, and it gives you a clean answer when someone asks what you share. It also tends to produce better data, which I explain in why you should fix tracking before scaling ad spend and in our breakdown of the cookieless measurement stack operators actually run.

What This Means for Owners and Investors

If you own or are buying a wellness, fitness, supplement, beauty, or telehealth-adjacent brand, treat health data privacy law for marketers as a value issue, not just a legal footnote. A messy pixel setup can mean rework, a slower diligence process, or a negotiation point. For private equity sponsors, I would add a consumer health data check to every consumer health deal, the same way you would check TCPA consent on a lead gen business. Our TCPA consent guide covers that side, and our PE advisory work folds both into portfolio reviews.

If you want help with the technical half, that is what our marketing compliance practice does. You can also see how this fits with HIPAA, TCPA, and FTC issues in our guide to marketing compliance for regulated industries, or browse more on the Impaxium blog.

FAQ

Does the My Health My Data Act apply if my company is not HIPAA covered?

Yes, the My Health My Data Act was written mainly for companies outside HIPAA. It applies to entities that do business in Washington or target Washington consumers and process consumer health data, and it exempts information that is already protected health information under HIPAA.

Is a supplement or wellness brand collecting consumer health data?

Often, yes, if it collects or infers information about a person's health status, symptoms, body functions, or care-seeking. Quiz answers, condition-specific purchases, and inferences from browsing can all qualify, while ordinary toiletry purchases on their own generally do not, according to the Washington AG's guidance.

Can I use Meta or TikTok pixels on a wellness site?

You can, but pixels on health-related pages are the most common source of exposure under these laws and FTC enforcement. At minimum, block them until valid consent, keep them off condition-specific pages, strip health terms from URLs and events, and consider moving conversions server side.

Is geofencing near clinics illegal?

In Washington it is unlawful to geofence within 2,000 feet of an in-person health care provider to track people seeking care, collect their health data, or send them health-related ads. Nevada and Connecticut have similar bans at 1,750 feet, with different lists of covered facilities.

Can consumers sue under the My Health My Data Act?

Yes, violations are enforceable through the Washington Consumer Protection Act, which includes private lawsuits as well as Attorney General enforcement. Plaintiffs still have to show injury to business or property, and the first class action, against Amazon, was voluntarily dismissed in 2025 without a ruling.

Does Nevada's consumer health data law have a private right of action?

No, Nevada SB 370 does not give consumers a private right to sue. Enforcement runs through the Nevada Attorney General.

Is offline conversion tracking compliant with consumer health data laws?

Offline conversion tracking is usually a safer path, not an automatic pass. It lets you send only consented, verified outcomes from your own systems instead of letting browser pixels capture health browsing, but you still need notice, consent, and counsel's review.

Is this legal advice?

No, this is an operator's view of how marketing technology creates consumer health data risk. Talk to privacy counsel about how these laws apply to your business.