Consumer Health Data Outside HIPAA: My Health My Data, the FTC, and the Apps That Know Too Much

Picture a woman in Spokane at 11:40 on a weeknight. She opens her cycle-tracking app, taps a button saying she is pregnant, and picks week six from a little scroll wheel. She closes the app and goes to sleep believing what nearly everyone believes: this is health information, so HIPAA covers it.

It almost certainly doesn't. The app is not her doctor, not her insurer, and not working for either of them. Meanwhile a piece of code the developers borrowed from an analytics company may already have written a line to a queue on her phone, something like pregnancy_week_chosen, attached to an identifier that follows her device from app to app. The next time the phone has a good connection, that line leaves.

That is close to what the Federal Trade Commission alleged in 2021 about the Flo Period & Ovulation Tracker, which it said passed information including whether a user was pregnant to analytics services as "app events." Four years later a San Francisco jury found Meta liable to a class of Flo's California users. By then the country had a new body of law aimed at exactly this gap, and most of it does not use the word HIPAA except to say where HIPAA ends.

This article maps that body of law: what HIPAA actually reaches, what happens at the system level when an app "shares" data, how the FTC turned a 1914 statute and a 2009 breach rule into a health privacy regime, how Washington built a private right of action on top of its consumer protection act, and where the courts have landed on pixels, standing, and wiretap claims as of November 2026.

The short answer

• HIPAA regulates particular entities and leaves everyone else alone. It binds health plans, clearinghouses, providers who conduct standard electronic transactions, and their business associates. A cycle tracker, step counter, supplement store, or symptom quiz that nobody's doctor or insurer engaged is usually outside it, however medical the data.
• Outside HIPAA, the FTC is the baseline regulator. Section 5 of the FTC Act reaches broken privacy promises and unfair practices. The amended Health Breach Notification Rule treats an unauthorized disclosure from a health app as a "breach," with a 60-day notice clock and civil penalties.
• Washington's My Health My Data Act is the sharpest state law. It requires consent to collect, separate consent to share, and a signed one-year authorization to sell. It bans geofences within 2,000 feet of in-person care, and it reaches consumers through the Washington Consumer Protection Act's private right of action. Nothing we found shows a court construing its key terms yet.
• Nevada and Connecticut followed with narrower versions, and the omnibus state laws add "sensitive data" rules. Nevada has no private right of action and a 1,750-foot geofence. Connecticut applies its consumer health rules to any person doing business there, with no volume threshold. Maryland, Virginia, and others have added sale bans.
• California and Illinois supply older statutes with real money attached. California's Confidentiality of Medical Information Act treats some apps as "providers of health care" and allows $1,000 nominal damages per patient without proof of harm. Illinois's Genetic Information Privacy Act has liquidated damages of $2,500 or $15,000.
• Pixel and SDK cases are now appellate law. In 2026 the Fifth Circuit held that browsing and scheduling on an eyewear retailer's site plausibly "relates to" health, and the Third Circuit held that patients have standing but affirmed dismissal of a complaint too vague about what was shared. Ninth Circuit standing law is less friendly to plaintiffs, and federal wiretap claims against the site operator keep failing on the party exception.
• Federal protection for reproductive data shrank in 2025. A Texas federal court vacated most of HIPAA's 2024 reproductive health rule. The remaining protection comes from state law and the FTC, and location data is the weak point.

What HIPAA actually covers, and why your phone is usually outside it

The Health Insurance Portability and Accountability Act of 1996 was mostly a bill about insurance portability and claims processing. Its privacy machinery exists because Congress was pushing the health system toward electronic transactions and wanted a guardrail. As the Northern District of Texas put it, Congress acted "because health information needed more protections and the world needed more acronyms," in American Hospital Ass'n v. Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024).

That origin explains the shape of the law. 45 C.F.R. § 160.103 defines three covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction, such as a claim to an insurer. The same section adds business associates, meaning outsiders who create, receive, maintain, or transmit protected health information on a covered entity's behalf. The HITECH Act provisions at 42 U.S.C. § 17934 and § 17931 made those associates directly answerable.

"Protected health information" is defined by who holds it. Under 42 U.S.C. § 1320d(6), individually identifiable health information must be "created or received by a health care provider, health plan, employer, or health care clearinghouse." A blood pressure reading in a cardiologist's chart is PHI. The identical reading typed into a wellness app by the patient, for her own use, usually isn't anything to HIPAA at all.

The enforcement structure is narrow too. There is no private right of action, as the Fifth Circuit held in Acara v. Banks, 470 F.3d 569 (5th Cir. 2006). Civil penalties come from HHS's Office for Civil Rights under 42 U.S.C. § 1320d-5, and those are not self-executing wins for the agency. In University of Texas M.D. Anderson Cancer Center v. HHS, 985 F.3d 472 (5th Cir. 2021), the court called a $4.3 million penalty arbitrary and capricious and vacated it. Criminal liability under 42 U.S.C. § 1320d-6 requires a knowing violation. For the inside view of the Privacy and Security Rules, see HIPAA Privacy and Security Compliance for Covered Entities and Business Associates.

The same data, different law

The practical test is who the app works for. A few scenarios show why:

The split rows cause most of the trouble. The Health Breach Notification Rule and Washington's statute both anticipate it by exempting PHI or activity "to the extent" an entity acts as a business associate, rather than exempting the company whole. HHS's Office for Civil Rights published a short set of health app scenarios in 2016 that remains a helpful way to think about it, and the FTC's guidance on HIPAA, the FTC Act, and the breach rule tells companies to assume more than one regime applies. For how vendor status works in the cloud context, see HIPAA Business Associates and Cloud Computing.

Two traps sit on this boundary. The first is borrowing HIPAA's prestige. The FTC charged that GoodRx displayed a seal suggesting HIPAA compliance it did not have and that Monument claimed HIPAA compliance though an outside assessor it hired found it had not fully complied. The second is that a company's own words can pull it across the line at the pleading stage. In Kady v. Opencare, Inc., No. 4:25-cv-05037 (N.D. Cal. Aug. 31, 2026), a dental referral site's privacy policy said that scheduled appointments were "considered Protected Health Information" and acknowledged business associate status. The magistrate judge took that seriously, observing "[p]erhaps tellingly" that the company did not argue the information would fall outside PHI if it were a covered entity, and let the claims go forward on that footing.

The tracking bulletin and what the hospitals won

In December 2022, OCR issued a bulletin warning that online tracking technologies on covered entities' websites could disclose PHI, and it revised the bulletin in March 2024. The hospitals sued. Judge Pittman's opinion in American Hospital Ass'n is narrower than its reputation. It addressed what the court called the "Proscribed Combination": an IP address connected to a visit to an unauthenticated public page about specific health conditions or providers.

The court held that this combination cannot be IIHI (individually identifiable health information) on its own, because the statute requires information that "relates to" a person's health and a covered entity cannot know why a visitor loaded a page. "You don't have to read tea leaves to divine what that means," the court wrote, and "HIPAA doesn't mandate clairvoyance." It vacated the Proscribed Combination and denied an injunction. It also noted that much of the rest of the bulletin was "both legally and pragmatically sound." We found no appellate decision disturbing the ruling.

So logged-in patient portals, appointment flows, and authenticated pages were never touched by this case. Neither was anything outside HIPAA, which turns out to matter a great deal. As discussed below, the Fifth Circuit has since refused to extend the decision to a retail site where the plaintiffs alleged much more than an IP address.

What actually happens when an app "shares" your data

Legal arguments about "disclosure," "contents," and "interception" are arguments about plumbing, so it is worth looking at the plumbing.

The SDK. A software development kit is a bundle of someone else's code compiled into an app. Developers add one to get crash reports, install attribution, analytics, or ad measurement for free. When the app launches, the SDK initializes and collects device facts. When the developer's code calls something like logEvent("pregnancy_week_chosen"), the SDK queues that event and later sends a batch over an encrypted connection to the vendor's servers. The encryption protects the data from the coffee shop's Wi-Fi. It does nothing about the vendor, who is the intended recipient.

A simplified event looks like this (invented, with a placeholder domain):

POST https://events.analytics-vendor.example/v1/batch
app_id: com.fennimore.cycle
event_name: pregnancy_week_chosen
event_params: { "week": 6 }
advertising_id: 38400000-8cf0-11bd-b23e-10b96e40000d
device: iPhone15,2 / iOS 18.1
timestamp: 2026-03-03T23:40:12-08:00
source_ip: (visible to the receiving server)

Three facts in that payload carry the legal load. The event name was chosen by the developer, usually a marketer or engineer naming things so a dashboard makes sense, and it is frequently the health fact itself. The FTC alleged that Monument, an alcohol addiction treatment service, used event titles such as "Paid: Weekly Therapy" and "Paid: Med Management". The advertising identifier is built to be matched across apps. Apple's system prompts now gate the iOS version, but other identifiers still flow: the FTC alleged that Premom's SDK partners received non-resettable identifiers such as Wi-Fi network identifiers that "cannot be changed without buying a new device." And the IP address arrives whether or not anyone wants it, because that is how the internet works.

The pixel. On the web, the same function is a snippet of JavaScript loaded from the ad platform. In the record summarized in Doe v. Adventist Health System/West, No. B344951 (Cal. Ct. App. July 24, 2026, certified for publication Aug. 24, 2026), the plaintiffs' expert described what a pixel collects as identifiers and browsing activity, sent in HTTP requests from the user's browser straight to the platform's server. URLs travel along with them, and a URL can contain a great deal: a page path like /conditions/hiv-treatment, or in that case a "full-string" link with a unique string that allegedly would let anyone open a patient's health risk assessment report. The expert also described pixels that "ghostwrite first-party cookies" on the site's own domain to get around third-party cookie blocking.

The browser, not the hospital's server, usually does the sending. That detail powers the wiretap theory, because the platform is receiving a duplicate of what the patient sent the hospital, at about the same moment.

Server-side delivery and customer lists. Consent banners control scripts in the browser, and much of the data has moved beyond their reach. Meta's Conversions API sends events from the company's own server to the platform. The FTC's complaint against Hims & Hers describes it as creating a direct connection between the advertiser's systems and Meta's, serving the same purpose as the pixel. A customer list upload is older and blunter: the company takes a file of emails (often hashed) of people who bought a particular drug and uploads it so the platform can find those people or others like them. The FTC alleged that GoodRx uploaded lists of users who bought particular heart and blood pressure medications. Plaintiffs in Rand v. Eyemart Express, L.L.C., No. 25-10784 (5th Cir. Oct. 23, 2026), alleged the same practice with prescription eyewear.

Hashing doesn't rescue this. A hash of an email address is a stable pseudonym designed to be matched against the platform's own hash of the same address, and matching is the entire point of the upload.

Why "we don't send names" fails. The platform already knows the person. In Rand, Eyemart's counsel conceded at oral argument that the information Meta received was individually identifiable because it was linked to specific Facebook users. "This is by design," the panel wrote, since targeted advertising doesn't work otherwise.

For a full audit method, see Auditing Your Website Tracking Stack: A Practical Guide and the general survey in Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech.

The FTC: a 1914 statute doing health privacy work

Section 5 of the FTC Act, 15 U.S.C. § 45(a), prohibits unfair or deceptive acts or practices. There is no federal consumer privacy statute, so the Commission built health privacy enforcement from those two words, a body of practice Daniel Solove and Woodrow Hartzog famously described in "The FTC and the New Common Law of Privacy," 114 Columbia Law Review 583 (2014).

Deception is the easy path. A company promises it will not share health data and then does. Unfairness has statutory limits: under § 45(n), a practice must cause or be likely to cause substantial injury that consumers cannot reasonably avoid and that countervailing benefits do not outweigh.

The courts have drawn the outer lines. FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015), confirmed that unfairness reaches data security failures and that the company had fair notice. LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018), vacated a cease and desist order against a clinical lab because the order did not direct LabMD to stop any specific unfair act or practice, a reminder that order drafting has to be enforceable. AMG Capital Management, LLC v. FTC, 593 U.S. 67 (2021), held that section 13(b), 15 U.S.C. § 53, does not authorize equitable monetary relief.

AMG explains some of what comes next. Section 5 standing alone rarely produces a first-offense penalty, so a rule or statute that carries penalties has become much more useful to the Commission. That is the Health Breach Notification Rule's real importance, and it is why the FTC sometimes reaches for less obvious statutes, as it did with the opioid recovery fraud statute against Monument and the online subscription statute, 15 U.S.C. § 8403, in the Hims & Hers case.

The run of health cases

(The table draws on the FTC's press releases and complaints, available on ftc.gov; allegations in settled and pending matters are allegations.) Read across, the pattern is consistent. The FTC's orders ban health data for advertising, require affirmative express consent for other sharing, order recipients told to delete, impose a retention schedule, and require a privacy program. Almost every complaint also pleads the same small facts: the promise on the marketing page and the marketing team's use of the tool.

One detail from the BetterHelp litigation deserves a place on every general counsel's wall. The consolidated class complaint in In re BetterHelp, Inc. Data Disclosure Cases, No. 23-cv-01033 (N.D. Cal. July 15, 2024), adopted the FTC's allegation that the company had handed most decisions about its Facebook advertising to "a Junior Marketing Analyst who was a recent college graduate" with little training in safeguarding health information. Most of these cases start with someone in growth marketing pasting in a tag.

The Hims & Hers complaint also shows continuity across administrations. Six weeks later, the Commission's September 2026 announcement rescinding an old policy document said that protecting sensitive health information remains a priority. Count I of the complaint pleads three representations: that sensitive information is accessed only by medical providers, that the service is private, and that it is discreet. Count II pleads failure to disclose the sharing. The portion of the complaint available publicly is heavily redacted, and nothing in it has been proven. It does not plead the breach rule, which may say something about how this Commission views that tool, although we would not read too much into one complaint.

The Health Breach Notification Rule: when "sharing" is a "breach"

Congress wrote 42 U.S.C. § 17937 into the 2009 stimulus law as a stopgap for personal health records outside HIPAA, and the FTC implemented it at 16 C.F.R. Part 318. The rule sat unused for over a decade. In September 2021 the Commission issued a contested policy statement saying health apps were covered. It first enforced the rule in GoodRx, and then rewrote the rule, 89 Fed. Reg. 47028 (May 30, 2024), effective July 29, 2024.

On September 9, 2026, the Commission rescinded the 2021 statement. That is easy to misread. The rescission says the 2024 rule amendments made the statement unnecessary, and it cites a deregulatory executive order. The rule itself is untouched. Companies that read the headline as a retreat from health app coverage have misread it, because the 2024 text does the work the statement used to do.

Here is how the amended definitions fit together, reading § 318.2:

• Personal health record: an electronic record of identifiable health information "that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual." The FTC's compliance guide says an app that can sync with a fitness tracker probably qualifies even if some users never connect one. Capacity counts, so the question is what the product can do, not what a particular user did with it.
• PHR identifiable health information: information relating to health or care that identifies the person and is created or received by a covered health care provider, among others.
• Covered health care provider: includes "any other entity furnishing health care services or supplies," and health care services or supplies includes any online service that provides "mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, diet." That language turns the app developer into the "provider," which is how an app's own data becomes covered.
• Breach of security: acquisition without the individual's authorization, including one "that occurs as a result of a data breach or an unauthorized disclosure."

That final clause is the part that catches engineers by surprise. No hacker is required. A pixel that sends covered data to an ad platform without the user's authorization is a reportable breach under the FTC's theory, and that is how GoodRx was charged. The clock is 60 calendar days from discovery, § 318.4, with discovery defined to include what the company "reasonably should have" known. Individuals must be notified. The FTC must be notified at the same time for 500 or more people, and annually for fewer. Prominent media must be notified where 500 or more residents of a state are affected. The vendor bears the burden of proving it gave notice. Violations carry civil penalties as a rule violation under 15 U.S.C. § 57a, adjusted each year and above $50,000 per violation.

Two limits deserve attention. The rule excludes HIPAA-covered entities and business associates acting as such. And the "multiple sources" requirement still means something: a simple single-purpose calorie note that truly cannot draw data from anywhere else, and takes nothing but what one user types, has an argument. In practice, an API call for a food database or a phone's health framework is often enough to end that argument. The FTC reads the phrase broadly, and no court has tested the amended text.

For how this fits with state breach statutes, see Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

Washington's My Health My Data Act

Washington passed chapter 19.373 RCW in 2023, in the year after Dobbs v. Jackson Women's Health Organization, 597 U.S. 215 (2022). Its findings say what this article's opening says: people expect HIPAA to protect their health data and it doesn't reach "certain apps and websites." Most substantive sections took effect March 31, 2024, and June 30, 2024 for small businesses. The geofence section carries no delayed date.

Who is covered

A regulated entity is any legal entity that conducts business in Washington or targets products or services to Washington consumers, and that determines the purpose and means of processing. There is no revenue threshold and no volume threshold. A small business is a subset with later dates and the same duties: fewer than 100,000 consumers a year, or under 50 percent of revenue from the data and fewer than 25,000 consumers. Nonprofits are not carved out.

A consumer is a Washington resident or "a natural person whose consumer health data is collected in Washington," and collect is defined to mean "buy, rent, access, retain, receive, acquire, infer, derive, or otherwise process." Read together, those definitions support a striking argument: a person in Ohio whose data is processed on a server in Washington could be a consumer. The attorney general's published FAQ pushes back in part, stating that "[a]n entity that only stores data in Washington is not a regulated entity," while adding that out-of-state processors for regulated entities must comply. That answers who is regulated. It doesn't fully answer who counts as a consumer once a company is regulated for other reasons, and the FAQ doesn't define "collected in Washington." Employees acting in an employment context are excluded.

What counts as consumer health data

The definition starts with personal information "linked or reasonably linkable" to a consumer that "identifies the consumer's past, present, or future physical or mental health status," and then lists thirteen categories. Three are unusually broad.

"Use or purchase of prescribed medication" and "data that identifies a consumer seeking health care services" pull in commerce and browsing. "Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies" brings in location data, with precision set at a radius of 1,750 feet.

And category (xiii) sweeps in information processed to associate a consumer with health data when it is "derived or extrapolated from nonhealth information," including through "algorithms or machine learning." The attorney general's FAQ takes a helpfully practical line here: information limited to the purchase of toiletries ordinarily isn't consumer health data, and "[n]on-prescription data is only considered consumer health data if the regulated entity draws an inference." So buying unscented lotion is not health data. A model that infers pregnancy from the lotion purchase creates health data, because the output is now being used to identify a health status. The FAQ is guidance and doesn't bind a private plaintiff or a court, and a plaintiff will point to the statute's separate categories for reproductive health and for data identifying someone seeking care. Daniel Solove's "Data Is What Data Does," 118 Northwestern University Law Review 1081 (2024), argues that this inference problem breaks the whole idea of a sensitive data category, and Washington's drafters plainly agreed with the concern.

Personal information expressly includes cookie IDs, IP addresses, and device identifiers. Health care services means anything "to assess, measure, improve, or learn about a person's mental or physical health," which is broad enough to cover a gym, a meditation app, or a nutrition coach.

Consent, sharing, and sale

The statute sets up three separate gates:

1. Collection needs consent for a specified purpose, or must be necessary to provide the product or service the consumer requested. RCW 19.373.030(1)(a).
2. Sharing needs consent "separate and distinct" from the collection consent, or the same necessity. RCW 19.373.030(1)(b). Disclosure to a processor acting within the disclosed purpose is not sharing, and neither is one to a third party with whom the consumer has a direct relationship, under stated conditions.
3. Sale needs a "valid authorization" that is "signed by the consumer." RCW 19.373.070. It must name the specific data, the seller, the purchaser with contact information, and the purpose. It must say that goods can't be conditioned on signing, that it can be revoked, and that the data may be redisclosed. It expires one year after signing. Seller and purchaser keep copies for six years. An authorization combined with another document is void.

Consent is defined tightly, too. It can't come from general terms of use, from hovering over or closing content, or from "deceptive designs." For the design side, see Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule.

The word to watch is sell: "the exchange of consumer health data for monetary or other valuable consideration." Nobody writes a check when a pixel fires. But a plaintiff will argue that a company receiving free analytics, better ad targeting, or attribution in return for its users' events has exchanged data for valuable consideration. If that is right, ad-tech sharing of consumer health data requires a one-year signed authorization naming each purchaser, which is commercially impossible. Apart from transfers in a merger, acquisition, or bankruptcy, the Washington text excludes only exchanges with processors acting consistently with the disclosed purpose. This is probably the most consequential undecided question in the statute.

Rights, security, and processors

Consumers can confirm and access their data, get a list of all third parties and affiliates who received it along with a working contact, withdraw consent, and demand deletion. Two features are unusually hard on engineering teams. A deletion request must reach "archived or backup systems" (delayed up to six months) and must be passed on to everyone who received the data, and those recipients must honor it. Responses are due in 45 days, extendable once, with an appeal path that ends in a referral to the attorney general.

Businesses must also publish a separate consumer health data privacy policy with a prominent homepage link, and "homepage" includes an app's store page and settings. The attorney general reads this to require "a separate and distinct link" to a policy that doesn't contain additional information beyond what the Act requires. Security must meet the reasonable standard of care in the industry. Processors need a binding contract, and a processor that goes outside it becomes a regulated entity for that data. RCW 19.373.060.

The geofence ban

RCW 19.373.080 makes it unlawful for "any person" to implement a geofence around an entity that provides in-person health care services, where the geofence is used to identify or track consumers seeking care, collect consumer health data, or send notifications, messages, or advertisements related to consumer health data or health care services. The definition reaches any location technology and any virtual boundary 2,000 feet or less from the perimeter.

A consent exception doesn't appear, and there is no small business grace period. Run the numbers on a dense city and 2,000 feet from a clinic covers a lot of ordinary retail, which is why the purpose clause matters. The ban targets a geofence used for those purposes, not every geofence that happens to overlap a dentist.

Enforcement: what the private right of action really requires

RCW 19.373.090 declares that violations are matters "vitally affecting the public interest" and per se unfair or deceptive under the Consumer Protection Act, chapter 19.86 RCW. The press tends to stop there and call this a private right of action, and functionally it is, with one big caveat.

Under Hangman Ridge Training Stables, Inc. v. Safeco Title Insurance Co., 105 Wash. 2d 778 (1986), a private CPA plaintiff must prove five elements: an unfair or deceptive act, in trade or commerce, with public interest impact, injury to business or property, and causation. The statute hands plaintiffs the first three. It says nothing about the last two.

Washington has read injury generously in some settings. Panag v. Farmers Insurance Co. of Washington, 166 Wash. 2d 27 (2009), dropped any requirement of a consumer transaction with the defendant and discussed what can count as injury, though consulting a lawyer to bring the claim isn't enough. It has also drawn a firm line against dressing up personal injury: Ambach v. French, 167 Wash. 2d 167 (2009), held that a monetary loss flowing from a personal injury is not injury to business or property. So a plaintiff whose only harm is distress or loss of privacy has an Ambach problem. Expect plaintiffs to plead overpayment for a product, the lost market value of their data, and fees paid to the app. Damages are actual, with discretionary trebling capped at $25,000, plus attorney fees, under RCW 19.86.090.

Federal removal adds a second hurdle. A CAFA class action under 28 U.S.C. § 1332(d) lands in federal court, where Article III applies and where the Ninth Circuit's standing law is demanding, as discussed below.

Where the litigation stands

The first suits came in February 2025 against Amazon. Albano v. Amazon.com, Inc. and Maxwell v. Amazon.com, Inc. were consolidated as In re Amazon Ads SDK Litigation, No. 2:25-cv-00252 (W.D. Wash.), before Judge Rothstein. The theory, per public descriptions of the complaints (the Maxwell complaint is the one usually cited for the Act), is that Amazon's advertising SDK, embedded in third-party apps, collected precise location and other data without required consent. The stipulated schedule called for a consolidated complaint and a response. We found no reported ruling construing the Act, and secondary commentary through October 2026 reports none. Treat that as a status as of this writing and check the docket.

Attorney General Nick Brown told the IAPP in October 2026 that his office has been "thoughtful about enforcement because the law is still relatively new" and that "we may see more cases." No formal AG action has been publicly reported that we could find.

The legal process gap

Here is a point most summaries miss. RCW 19.373.100 exempts a long list of data, including PHI, Part 2 records, FERPA and GLBA data, and FCRA data. Subsection (3) preserves processing to prevent or respond to security incidents, fraud, and "any activity that is illegal under Washington state law or federal law." The chapter's text has no general exception for responding to subpoenas or court orders.

Think about an out-of-state subpoena seeking a Washington user's cycle data in an abortion investigation. The conduct may not be illegal under Washington law, so subsection (3) doesn't obviously help. Consent to share likely doesn't cover it. A company in that spot should get counsel immediately, and should consider what it collects in the first place, because data that doesn't exist can't be subpoenaed. See Government Data Demand Toolkit: Legal Process Review, Objections, and Notification.

A worked example: the vitamin store

Suppose Pinegap Vitamins, a small online retailer in Tacoma, sells prenatal vitamins, melatonin, and home pregnancy tests. It has about 30,000 Washington customers. Its site has a Meta pixel with standard e-commerce events, and it uploads a monthly email list of recent buyers to build lookalike audiences.

Pinegap thinks of itself as a shop. Under the Act it is a regulated entity and likely a small business, and the fact that it never touched a medical record is irrelevant. Its best argument is the attorney general's FAQ: these are non-prescription purchases, and it draws no inference about anyone's health. A plaintiff answers that a home pregnancy test relates to diagnostic testing and to reproductive or sexual health services, which the Act defines to include products, so an AddToCart event with prenatal-dha-60ct in the URL, tied to a Facebook identifier, is consumer health data being shared. The uploaded list is the weak point. A segment of recent prenatal vitamin buyers, sent to build a lookalike audience, looks a great deal like using purchases to infer pregnancy, which undercuts the FAQ argument because the inference is now the company's own.

The necessity exception does not cover this, since advertising isn't necessary to ship the vitamins. So Pinegap needs separate opt-in consent to share, and it should expect a plaintiff to argue that lookalike modeling is a sale. Its options are to strip health-revealing product data from events, to exclude these categories from list uploads, to stop the pixel on product pages or use consent gating that actually blocks the script, and to publish the separate policy. Exposure from one Washington class may not be enormous under an Ambach-limited damages theory, but fee shifting plus a federal section 5 risk from the promises on its footer make the fix cheap by comparison.

This example also shows why Rand matters outside Texas. A retailer can no longer assume that selling products instead of practicing medicine keeps its data out of health privacy doctrine.

Nevada, Connecticut, and the omnibus laws

Other states took parts of Washington's model and mostly left out the private claim.

Nevada's definition is narrower in a way that deserves emphasis. Consumer health data is information that a regulated entity "uses to identify" the health status of the consumer, and the law carves out shopping data not used to identify health status. Washington's asks more objectively whether the data "identifies" status. So a Nevada retailer with an honest non-use position stands on firmer ground than one in Washington. Nevada also lacks Washington's small-business delay, and it exempts HIPAA- and GLBA-regulated entities wholesale.

Connecticut did it differently, adding consumer health data duties to its omnibus statute. Section 42-526 bars any person from giving employees or contractors access without a duty of confidentiality, giving processors access without a compliant contract, using a geofence within 1,750 feet of a mental health or reproductive or sexual health facility to track or message consumers about their health data, or selling consumer health data without consent. These duties apply regardless of the data volume thresholds that limit the rest of the CTDPA. The 2025 amendments (S.B. 1295), mostly effective July 1, 2026, cut the general applicability threshold to 35,000 consumers and made any processing of sensitive data a trigger. Companies that used to fall under the CTDPA should recheck.

Maryland's Online Data Privacy Act is an aggressive outlier among omnibus laws, with limits on collecting sensitive data tied to what is necessary for a requested service and a bar on selling it. It uses the term "consumer health data" and has a similar geofence rule.

Virginia took a different route in 2025, adding to its Consumer Protection Act a prohibition on "[o]btaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer." Va. Code § 59.1-200(A)(85). That matters because Virginia's consumer act has a private action under § 59.1-204 for persons who suffer loss: actual damages or $500, and up to three times actual damages or $1,000 if willful. This provision may become a sleeper.

Sale-related amendments kept coming in 2026. Virginia and Connecticut barred sale of precise geolocation data, effective in July and October 2026 respectively, as reported in legislative trackers, and New Jersey moved to bar sale of sensitive data. Confirm these against enrolled text for a live question. New York's legislature passed a Health Information Privacy Act (S.929) much like Washington's, and Governor Hochul vetoed it on December 19, 2025, citing the breadth of its definitions. A revised bill (S.9269/A.10357) passed both houses in June 2026, and we found no report of the governor's action on it, so check its status.

The remaining omnibus laws treat health data as sensitive and generally require opt-in consent, with California's CCPA as the opt-out variation (a "right to limit" use of sensitive personal information). They differ on the word "diagnosis" versus "condition," and that difference is significant: a law reaching only a "diagnosis" may not cover a symptom search. The full comparison is in State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

California's CMIA: an old statute that apps walked into

California's Confidentiality of Medical Information Act, Cal. Civ. Code § 56 et seq., dates to 1981. It bars a "provider of health care" from disclosing medical information without authorization (§ 56.10) and requires it to maintain and dispose of records in a way that preserves confidentiality (§ 56.101). The remedy in § 56.36(b) is why it gets litigated: $1,000 nominal damages per patient, with no need to show actual harm, plus actual damages.

Section 56.06 is what brings software in. Subdivision (a) deems businesses "organized for the purpose of maintaining medical information" to be providers. Subdivision (b) reaches "[a]ny business that offers software or hardware to consumers, including a mobile application" designed to maintain medical information so that an individual can manage it or for diagnosis or treatment. In recent years the Legislature added mental health application information and, by A.B. 254 in 2023, reproductive or sexual health application information.

The California Supreme Court read these provisions closely in J.M. v. Illuminate Education, Inc., No. S286699 (Cal. May 14, 2026). An educational software company suffered a breach exposing students' medical information. Two of its holdings matter here, and they cut in different directions.

First, § 56.06 has limits. The plaintiff had not sufficiently alleged that Illuminate was a provider under the statute, because the company stored data to help educators evaluate and manage students and not to let individuals manage their own records. Storing medical information is not enough. The purpose has to be the one the statute describes.

Second, plaintiffs do not need to allege actual viewing. "[C]onfidentiality is breached when the information is exposed to a significant risk of unauthorized access or use." The court disapproved Regents of University of California v. Superior Court, 220 Cal. App. 4th 549 (2013), Sutter Health v. Superior Court, 227 Cal. App. 4th 1546 (2014), and Vigil v. Muir Medical Group IPA, Inc. to the extent inconsistent. Those decisions had been the leading defense authority in CMIA class actions over stolen hardware. The new standard looks at the nature of the event, its duration and extent, and mitigation. A stolen laptop taken for the hardware may fail the test. A targeted database breach is likely to meet it.

How does this hit apps and pixels? Consider three decisions.

Frasco v. Flo Health, Inc., No. 21-cv-00757 (N.D. Cal. May 22, 2025), denied summary judgment on the CMIA claim against Flo. Flo had argued that it wasn't a "provider" and that the 2023 reproductive amendment showed that earlier law didn't reach cycle trackers. Judge Donato answered that Flo "ignores the plain text" of §§ 56.05 and 56.06(b) and that overlap with a later amendment doesn't narrow the ordinary meaning. He also rejected Flo's "de-identified" argument as a jury question. The claim proceeded classwide.

M.G. v. Therapymatch, Inc., No. 23-cv-04422 (N.D. Cal. May 19, 2025), denied a motion to dismiss CMIA claims against the mental health provider platform Headway, based on information allegedly sent to Google.

Kady goes the other way on one point: the court dismissed the CMIA claim with leave to amend because the plaintiffs had not adequately alleged that a dental referral site was a provider, citing J.M. Notice how that fits with the same opinion's willingness to treat the site as a plausible HIPAA business associate. Coverage under different statutes doesn't travel together.

Adventist, discussed below, shows that "medical information" also has limits at the class stage.

Illinois GIPA and the genetic data problem

Illinois's Genetic Information Privacy Act has been on the books since 1998 and became a litigation engine only recently. Section 30 says a person may not "disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of the test." Section 40 gives "[a]ny person aggrieved" a right of action, with liquidated damages of $2,500 for negligent violations and $15,000 for intentional or reckless ones, or actual damages if greater, plus fees. The Act also bars direct-to-consumer testing companies from sharing test information with health or life insurers without written consent. Much of the recent filing activity has been against employers over family medical history in hiring, a separate story covered by the federal Genetic Information Nondiscrimination Act definitions, 42 U.S.C. § 2000ff, as well.

Three cases show the current edges. Bridges v. Blackstone, Inc., 66 F.4th 687 (7th Cir. 2023), rejected the theory that a private equity firm's all-stock purchase of Ancestry "compelled" disclosure of customers' genetic data, without deciding whether a recipient can ever be liable. A change in ownership, the court said, is just that, and a plaintiff needs facts showing a compelled disclosure.

Neblock v. Gene by Gene, Ltd., No. 24 CV 12118 (N.D. Ill. May 19, 2026), involved pixels on FamilyTreeDNA's site allegedly telling Meta and Google that a user had bought a genetic kit. The court denied the jurisdiction motion and compelled arbitration, staying the case, because users clicked to accept terms when creating accounts to see their results. For a defense lawyer that is the win. For a compliance lawyer, the underlying theory still stands untested. Mass arbitration is its own hazard, as Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem explains.

The 23andMe bankruptcy brought the sale problem into public view. The opinion in In re Chrome Holding Co. (f/k/a 23andMe Holding Co.), No. 25-40976 (Bankr. E.D. Mo. Nov. 26, 2025), addresses a landlord dispute but recites the basic history of a business built on saliva samples and highly sensitive personal information. A sale of customer data in bankruptcy runs through 11 U.S.C. § 363(b), which has its own limits where a privacy policy restricts transfer. Washington's Act excludes from "sale" a transfer in a merger or bankruptcy only where the acquirer "complies with the requirements and obligations in this chapter." So any acquisition diligence memo that treats user health data as a simple asset is incomplete. Biometric parallels are covered in Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois.

The courts and the pixels: a map of the litigation

No federal statute gives consumers a health privacy claim, so plaintiffs plead wiretap statutes, state consumer law, common law torts, and contract. Five issues recur.

Issue 1: Article III standing

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), building on Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), requires a concrete injury with a close relationship to a harm traditionally recognized at common law, and named "disclosure of private information, and intrusion upon seclusion" among the examples. The general doctrine is explained in Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims.

The circuits now look like this. In video and browsing cases, Salazar v. NBA, 118 F.4th 533 (2d Cir. 2024), Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), and Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), found standing. Pileggi compared the pixel to a magazine seller nosing around in someone's mailbox. Against that, Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025), found no concrete injury where session replay software tracked a person's visit to a pet supply site, because she did not explain how the tracking caused harm like the highly offensive intrusions the common law recognized. In re BPS Direct, LLC, 175 F.4th 423 (3d Cir. 2026), split the difference among plaintiffs: those whose full card numbers were captured had standing, and others did not.

Health data has largely come out on the plaintiffs' side of that line. In Santoro v. Tower Health, No. 24-3173 (3d Cir. Aug. 28, 2026), the court held that patients who alleged that a provider secretly shared their health information with Meta alleged a harm analogous to intrusion upon seclusion, and it rejected the public disclosure analogy because nothing was publicized. It described its standing holding as limited to patients sharing their own health conditions with their provider. In Rand, the Fifth Circuit accepted both analogies, saying the mailbox comparison applies "with even more force" to personal health information. The two courts therefore differ slightly about public disclosure, though the difference doesn't change the outcome in either case.

Ninth Circuit district courts are working out what Popa leaves. Kady found standing for dental information. Outside that circuit, Hayward v. mParticle, Inc., No. 25 Civ. 8173 (S.D.N.Y. Sept. 1, 2026), dismissed for lack of standing a suit over identity-resolution software that collected names, email addresses, phone numbers, and device identifiers through non-health apps, reasoning that such data was not highly sensitive. Expect content to decide these motions. What was disclosed matters more than the mechanics.

The Flo court addressed a related question about SDK vendors. In its 2022 order, it dismissed claims against AppsFlyer because the complaint did not say the company used the data. But in its September 2024 summary judgment order, it held that plaintiffs against Google need not show that the data was "used" or further disclosed, since obtaining it without consent is the privacy injury. Read together, an SDK vendor's exposure tends to depend on what the record shows it did with the data and whether the vendor's own conduct can be tied to the injury.

Issue 2: Is this health information at all?

Rand is the new leading case. Five Facebook users sued Eyemart under the federal Wiretap Act, Missouri and Illinois eavesdropping laws, intrusion, and contract. They split themselves into people who browsed prescription eyewear and people who bought it. The district court dismissed, finding that browsing shared no health information and that the buyers had not shown the prescription itself reached Meta, relying on a sample screenshot in the complaint.

Judge Higginson reversed. "IIHI is not so narrow," the panel wrote. "It need not reveal a specific diagnosis or condition," and information that pertains to a condition or the provision of care is enough. Citing district court decisions about hospital search bars and Walgreens' product pages for pregnancy tests and diabetes kits, it held that activity on the site of a health care products and services provider "pertains to individuals' vision." It treated the screenshot as an example and faulted the district court for drawing inferences against the plaintiffs. The panel expressly declined to reach the substantive claims and remanded. The opinion is two weeks old as of this update, so check for a rehearing petition.

Rand also limits American Hospital Ass'n. Eyemart relied on it, but the panel read it as a case about an IP address connected to a visit, whereas these plaintiffs alleged Meta got specific searched products and providers paired with Facebook profiles. The court added that plaintiffs "do not assert a HIPAA claim, nor could they," since the parties were simply borrowing HIPAA's definition. Keep that limit in mind. Rand tells you what plausibly counts as private health information for these state and federal claims at the pleading stage, not that a chain of eyewear stores is a HIPAA covered entity (although the plaintiffs alleged it holds itself out as one).

Compare Doe v. Shady Grove Reproductive Science Center, P.C., No. 8:24-cv-02368 (D. Md. Sept. 30, 2025), denying dismissal where the disclosed fact was that plaintiffs had contacted a fertility clinic. The nature of the entity can itself reveal the condition.

The counterweight is Santoro. Plaintiffs refused repeatedly to say what they had looked up, insisting that "the one click is the same as 400 clicks." The trial judge told them he could only write that what Meta got was "blah, blah, blah." The Third Circuit affirmed dismissal with prejudice on narrow procedural grounds, because they never properly sought leave to amend until after judgment. And in Nichols v. PeaceHealth Networks on Demand LLC, No. 2:25-cv-01831 (W.D. Wash. Mar. 4, 2026), a plaintiff who omitted the specifics "to protect her privacy" had her ECPA complaint dismissed without prejudice. Plaintiffs in these cases should plead sites, pages, and conditions under a pseudonym if necessary. Rand and Santoro can coexist: Rand's plaintiffs described what they did, and Santoro's would not.

Issue 3: Wiretap claims and the party exception

The federal Wiretap Act, 18 U.S.C. § 2511, is a one-party consent statute. Under § 2511(2)(d), a party to a communication or someone with a party's consent may intercept, unless the interception is "for the purpose of committing any criminal or tortious act." The statute offers civil damages under § 2520, and that is why it attracts these cases.

The site or app is a party to its own communication with the user. So a claim against the operator needs the crime-tort exception, usually with HIPAA's criminal provision as the predicate, and courts disagree sharply about how far that goes.

• Purpose is the battleground. In re Meta Pixel Healthcare Litigation, 647 F. Supp. 3d 778 (N.D. Cal. 2022), denying a preliminary injunction, saw a "not-insignificant chance" the exception would apply, but the tests in that district often ask whether the primary motivation was to injure plaintiffs tortiously. The 2023 motion to dismiss order sustained the ECPA and CIPA claims against Meta.
• In re Group Health Plan Litigation, No. 23-cv-267 (D. Minn. Dec. 21, 2023), let the claim proceed on allegations of use for advertising without consent, in violation of HIPAA.
• Nichols states the stricter view, that an interception for financial gain is often not enough and the plaintiff must plead an unlawful act independent of the interception itself.
• Sweat v. Houston Methodist Hospital, No. 4:24-cv-00775 (S.D. Tex. Sept. 22, 2025), is the rare case decided on a full record, and it gives the defense its best facts. The hospital's marketers testified uniformly that they thought the Pixel returned aggregate data, relied on an agency and on Meta's filtering statements, and reacted with immediate questions when a reporter called. The court called this at most negligence, which doesn't meet a purpose requirement, and granted summary judgment. The lesson runs both ways: documented innocence works, but a company that knows of the problem and keeps the tag running won't have that testimony.

Vendor-side claims look different. Under In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), the simultaneous, unknown duplication of a user's communication does not make the platform a party. The Flo court nonetheless granted Meta summary judgment on the federal claim because Flo, a party, consented, and the federal statute requires only one. Federal claims are therefore vulnerable on both sides, for opposite reasons, although the Meta Pixel court let the claim past the pleadings. Hannant v. Culbertson Memorial Hospital Foundation, No. 4:24-cv-04164 (C.D. Ill. Mar. 19, 2026), adds a narrower pruning: relying on earlier authority that merely licensing MyChart doesn't make a hospital an electronic communication service provider, it dismissed claims that require that status, under § 2511(3)(a) or the Stored Communications Act.

California changes the math. CIPA requires consent of all parties, and its statutory damages of $5,000 per violation (Cal. Penal Code § 637.2) make the stakes enormous. That's why the most important trial in this area was a CIPA trial.

Issue 4: "Contents"

Wiretap statutes protect the "contents" of a communication under 18 U.S.C. § 2510(8), not routing data. In re Zynga Privacy Litigation, 750 F.3d 1098 (9th Cir. 2014), said that record information like a basic URL is not contents, while a URL containing a search term might be. Health pixel cases live on that line.

The cleanest recent illustration is Shah v. MyFitnessPal, Inc., No. 25-cv-04430 (N.D. Cal. Sept. 28, 2026), where users alleged the site kept tracking them after they rejected optional cookies. One plaintiff read about the app and clicked "Recipes." That was merely browsing a public website, so his wiretap claim failed. Another began signing up and selected health goals such as "lose weight" while entering her name and gender. That was a communication telling the site something about herself, and her claim survived, along with a pen register claim. The complaint also alleged a search for "obesity" being passed to an analytics firm.

The practical line is roughly between what the user reads and what the user tells you, and forms are the danger zone. Intake quizzes are all "tell."

Issue 5: Class certification, removal, and arbitration

Adventist is the most useful class opinion so far. The trial court denied certification, reasoning that each user's data would need individual review. The Court of Appeal reversed in part. For the health risk assessment subclass, whether the system uniformly sent a link to each report was answerable by common proof, and whether Meta's and Google's systems' processing amounts to viewing is a merits question common to the class. For patient portal users, the CIPA claim could also rest on the same baseline data (cookies, page views, URLs, IPs) for everyone. But the CMIA claim failed there, because substantial evidence supported the conclusion that portal URL terms weren't universally "medical information." So the same pixel can certify under one statute and not another.

The forum fight mostly ended where it began. Hospitals tried removing under the federal officer statute, 28 U.S.C. § 1442, arguing that federal digital health incentives put them in the government's service. Doe v. Cedars-Sinai Health System, 106 F.4th 907 (9th Cir. 2024), rejected that, joining other circuits. Arbitration is the better forum defense where a contract exists, as Neblock shows, under 9 U.S.C. § 2. But Flo's class waiver did not hold up, and a company can't compel arbitration of a user who never clicked anything. Visitors who never make an account are the classic gap. For class mechanics, see Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy.

Flo: the case that went to a jury

Frasco began in early 2021, within weeks of the FTC's announcement. It tells the whole story of this field in one docket.

The SDK facts were developed through years of discovery. Google, Flurry, and Flo settled, Flo during trial, for a reported combined total of $59.5 million according to class counsel's case page, with a final approval hearing calendared for October 29, 2026. The summary judgment order on Meta and Flo disposed of most claims against Meta (federal wiretap, California computer crime for lack of proven damage or loss, aiding and abetting, and unfair competition) while sending the CIPA § 632 claim and the CMIA claim forward. On August 1, 2025, the jury found Meta liable under CIPA § 632, the eavesdropping provision. Reports indicate Judge Donato denied Meta's motions to decertify and to set aside the verdict in September 2025, and that damages remained undecided well into 2026. A statutory figure of $5,000 per violation multiplied across a class is a number that would invite serious due process argument and appellate attention. Check the docket before relying on the current posture.

The dismissal of the computer crime claim is an interesting side note: it failed because the excluded damages expert was the only evidence of "damage or loss." For the federal analogue, see The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement.

Reproductive health and location data

Dobbs changed the threat model. Before 2022 the feared recipient of cycle data was an advertiser. After it, the feared recipient includes a prosecutor or a private litigant under a bounty statute.

Federal protection went backward. HHS issued a 2024 rule barring covered entities from using or disclosing PHI to investigate lawful reproductive care, with an attestation requirement. On June 18, 2025, in Purl v. U.S. Department of Health & Human Services, No. 2:24-cv-228 (N.D. Tex.), Judge Kacsmaryk vacated most of it nationwide. HHS's website confirms the vacatur and that Notice of Privacy Practices changes tied to substance use records under 42 C.F.R. Part 2 were left in place, with the February 16, 2026 compliance date for those changes now passed. Secondary reports say appeals were dropped. In any event, that rule never applied to an app outside HIPAA.

What remains for non-HIPAA data is what this article has been describing. Washington's definition names reproductive information and abortion directly, and treats efforts to research services as covered. California's A.B. 254 treats reproductive or sexual health application information as medical information. Virginia's provision reaches disclosure without consent. None of these statutes tells a company what to do with a valid out-of-state warrant.

Location is the weakest point. Your phone's coordinates are collected by apps with no health purpose, and then resold through brokers. In FTC v. Kochava, Inc., No. 2:22-cv-00377 (D. Idaho), the FTC alleged that the company sold timestamped coordinates tied to mobile advertising IDs, from 125 million monthly active users, precise enough to locate a device at sensitive sites such as abortion clinics. The court dismissed the first complaint in 2023 because the injury allegations weren't substantial enough, then denied dismissal of the amended complaint in February 2024, accepting that an invasion of privacy and a significant risk of secondary harm from third parties can each be substantial injury under § 45(n). In May 2026, the FTC announced a stipulated order barring Kochava and its subsidiary from selling sensitive location data without affirmative express consent and requiring a sensitive location program and supplier assessments. The FTC took similar positions in earlier orders against other location data sellers. For a consumer view, see Personal Privacy: Data Brokers, Surveillance, and Your Rights Over Your Own Information and, for the same brokers from a different direction, People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions.

Geofence bans have a specific history. In 2017, the Massachusetts attorney general reached a settlement with Copley Advertising over geofenced ads aimed at people inside or near reproductive health clinics. Washington, Nevada, Connecticut, and Maryland have since put the idea into statute. The Fourth Amendment doesn't fill the gap. Carpenter v. United States, 585 U.S. 296 (2018), restrains the government's demand for cell-site records, not a private sale.

A second worked example: the cycle app under subpoena

Suppose Fennimore, a cycle app based in Oregon with users in every state, has a user living in a state that bans abortion after six weeks. The app stores daily cycle logs and a coarse location for weather-based symptom tips. A county prosecutor serves a subpoena for her records.

HIPAA doesn't apply, so no HIPAA process governs and Purl is beside the point. Oregon's omnibus law and Washington's Act aren't obviously controlling for a user living elsewhere unless her data is collected or processed in Washington, which depends on where Fennimore's servers and vendors are. The company's duties are mostly contractual and reputational: whatever its policy promised about law enforcement requests, section 5 will hold it to that. It should challenge overbreadth, notify the user if permitted, and produce only what is compelled. Her cycle log is responsive if Fennimore has it.

The most useful protections were engineering decisions made two years earlier. If logs were end-to-end encrypted with keys on the device, the company would have nothing readable to produce. If it dropped location to city level or discarded it after a day, the location request would come up empty. That is why data minimization is a legal strategy in this field. See Data Minimization and Avoiding the Over-Retention of Personal Information.

What is unsettled

We would watch these questions:

1. Does sharing with ad platforms count as a "sale" under Washington's "other valuable consideration" language? No court has said. The answer may decide whether ad-tech for covered data is possible at all in Washington.
2. What is "injury to business or property" for a privacy violation under RCW 19.86? Ambach limits personal injury recoveries, and Panag is generous elsewhere. An early appellate ruling here sets the value of every MHMDA claim.
3. How far does "collected in Washington" reach? The attorney general says storage alone doesn't make an entity regulated, but the processing-based reading of "consumer" has extraterritorial and dormant Commerce Clause problems waiting. So does the FAQ's inference limit on non-prescription purchases, which has no court behind it yet.
4. Does a broad consumer health statute face a First Amendment challenge? Sorrell v. IMS Health Inc., 564 U.S. 552 (2011), applied heightened scrutiny to a Vermont law restricting sale and use of prescriber data for marketing. Sale restrictions aimed at particular content and speakers could draw a similar argument. Consent-based and even-handed rules are better positioned than Vermont's was, but no court has decided this for these statutes.
5. Will Rand's reading of "relates to" spread, or will courts stay close to American Hospital Ass'n? A hospital search query may fall between the two.
6. What does the amended breach rule's "multiple sources" capacity require? The FTC's reading is broad and untested.
7. What happens to statutory damages in Frasco? The appellate answer will set the settlement value of CIPA cases nationwide.
8. Does Popa reach health data in the Ninth Circuit? District courts are distinguishing it by sensitivity. A published opinion would help.

How the regimes fit together on a bad day

Any one company's disclosure event can trigger many of these at once. A pixel found firing on a symptom checker may mean a section 5 deception exposure if the policy promised otherwise, a Health Breach Notification Rule notice duty within 60 days if the product is a PHR, MHMDA consent and sale violations as to Washington consumers, a CMIA claim for California users if the product maintains medical information, a CIPA class action, and possibly HIPAA obligations if one of the customers is a hospital. Timing conflicts are built into this. Ordinarily you want to stop the bleeding, preserve evidence, and investigate under privilege. The 60-day clock runs from when you reasonably should have known, and a notice under the breach rule invites the class action that the investigation was trying to assess.

The companion documents handle the doing. Bringing a Health App Into Compliance With Consumer Health Data Laws: A Practical Guide goes step by step; the Consumer Health Data Compliance Checklist: A Practical Checklist is the review tool; and the Consumer Health Data Toolkit: Consent Forms, Data Maps, and Breach Notification Decisions holds the working papers. For scholarly background, Paul Ohm's "Sensitive Information," 88 Southern California Law Review 1125 (2015), and Danielle Citron and Daniel Solove's "Privacy Harms," 102 Boston University Law Review 793 (2022), are the best places to start on why sensitive data and harm are so hard to pin down.

The law here is moving faster than most companies' tag managers are audited. If your product sits anywhere near this line, MC Law can help you work out which of these regimes apply and what to change first. This article is general information and is not legal advice for a specific situation.

Related Documents

Related Articles

• HIPAA Privacy and Security Compliance for Covered Entities and Business Associates: the regime on the other side of the line this article draws.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: the wider wiretap litigation beyond health data.
• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: the omnibus statutes and their sensitive data provisions.
• Telehealth Law: Licensure, Prescribing, Reimbursement, and Privacy: the clinical side of companies like those in the FTC's cases.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the standing doctrine behind Rand, Santoro, and Popa.
• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: the state statutes that run alongside the FTC's rule.
• People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions: how data brokers get sued under a different body of law.
• The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement: the federal analogue to the loss problem that sank the computer crime claim in Flo.

Related Guides

• Bringing a Health App Into Compliance With Consumer Health Data Laws: A Practical Guide: the sequenced compliance project built on this article.
• Auditing Your Website Tracking Stack: A Practical Guide: how to find out what your site actually sends.
• HIPAA Business Associates and Cloud Computing: when a vendor crosses into HIPAA.

Related Checklists

• Consumer Health Data Compliance Checklist: A Practical Checklist: a desk tool for the full review.

Related Toolkits

• Consumer Health Data Toolkit: Consent Forms, Data Maps, and Breach Notification Decisions: templates, clauses, and decision trees.
• Government Data Demand Toolkit: Legal Process Review, Objections, and Notification: working papers for the subpoena problem.