My Health My Data Act: what Washington's law and the FTC's cases mean for a supplement store's pixels

Washington's My Health My Data Act (RCW 19.373) protects consumer health data, a term that includes health information inferred from nonhealth data. It reaches businesses of any size that do business in Washington or target its consumers. Beyond what an order needs, collecting that data takes consent and sharing it takes separate consent, and consumers can sue.

For a supplement store, the risk is rarely the bottle. It's what the funnel around it says about the buyer, and what its pixels carry off the site. Here is what one visit to a page built around a condition can send:

One visit to a condition-named page

What a pixel can send, step by step. A fictional page at /bloating-relief

1. 1Load
2. 2Events
3. 3Forms
4. 4Audiences

1The page loads, and its address goes along

What happens: The pixel's base code fires a PageView each time it loads, and Meta's documentation says PageView events record the URL of the page. An address like /bloating-relief says what the visitor came for.

Why it matters: Custom conversions can be defined on those recorded URLs in Events Manager, so the address can become a conversion your campaigns report on.

What goes wrong:

• A path, subdomain or campaign parameter that names a condition
• A thank-you page whose address repeats the health claim

2Every event goes with its name

What happens: Everything else you track, a play, a buy-button click, a finished quiz, goes as a standard event or a custom event you name, with any parameters you attach, such as content_name: in Meta's words, the "Name of the page/product."

Why it matters: The FTC said Monument's custom events, with titles such as "Paid: Weekly Therapy", revealed details about its users.

What goes wrong:

• Custom events named after a condition or a symptom
• A product name that is itself a health claim, sent as content_name

3What buyers type and buy

What happens: The FTC's technologists warned in 2023 that pixels can send details such as the specific items a user has purchased or "information users have typed within a form while on the site".

Why it matters: Symptoms typed into a quiz are among the kinds of data Washington's definition lists. Hashing an email may not be enough either: the same FTC post says hashing can be inadequate because hashes "can be reversed or used to link data across different databases".

What goes wrong:

• Quiz answers passed to the pixel as event parameters
• Treating a hashed email list as anonymous

4Audiences and conversions built on it

What happens: Back in the ad platform, those visits become custom audiences, lookalikes and custom conversions, and Meta now blocks the ones that suggest specific health conditions.

Why it matters: This is the step behind the GoodRx and BetterHelp cases: medication buyers uploaded for health ads, and therapy clients used to find similar people.

What goes wrong:

• Audiences named after a condition
• Buyer lists from a condition-named product uploaded for targeting

What the My Health My Data Act covers

The Act is chapter 19.373 of the Revised Code of Washington, passed in 2023 as House Bill 1155; as of October 2026 its history notes showed no later amendment (RCW 19.373). Its core is one definition: consumer health data is personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status. The law lists 13 kinds, from conditions, treatments and symptoms to biometric and genetic data and precise location that could show someone seeking care.

The last item on that list is the one marketers should read twice. It covers information used to associate a consumer with any of the others when it is "derived or extrapolated from nonhealth information", inferences included, "by any means, including algorithms or machine learning".

Prescribed medication is on the list, and a supplement isn't prescribed. The attorney general's FAQ draws the rest of the line (Washington AG):

• A purchase limited to toiletries such as toilet paper or deodorant ordinarily isn't consumer health data, but "an app that tracks someone's digestion or perspiration is collecting consumer health data".
• Non-prescription purchases count only if the business draws an inference about the consumer's health from them.
• Inferences from purchases can be consumer health data. The AG's example is a retailer that, as the media reported in 2012, gave shoppers a "pregnancy prediction score" based on what they bought.

By that reading, a sleep formula in a cart isn't automatically consumer health data. A funnel that sorts visitors by symptom, names its pages after a condition or builds an audience of "bloating quiz takers" makes the kind of link the AG's examples describe, and that link can be consumer health data. Whether yours does is a question for a lawyer, and the rest of this article is about making it an easy one to answer. This is a summary of the law and the cases, not legal advice.

The labels are usually where it shows. Here is one funnel's data, labeled two ways:

One funnel's data, labeled two ways

A fictional digestion supplement with the offer code vx03

Tells the platform what the visitor hasNames the condition

• Page address: /bloating-relief
• Custom event: IBS_quiz_complete
• Event parameter: symptom=bloating
• content_name: Gut Pain Formula
• Audience: bloating quiz takers, 30 days

Says nothing about healthUses a neutral code

• Page address: /vx03
• Custom event: quiz_complete
• Quiz answers kept off the pixel
• content_name: VX03-90, a SKU code
• Audience: vx03 engaged, 30 days

The catch: the product's name. A neutral path can't hide a name that is itself a condition.

A path is easy to change; a product called Gut Pain Formula carries the condition into every event, order and audience that names it. That's a claims problem as well as a privacy one: in a 2021 joint warning letter with the FDA, the FTC said claims can be made "through the use of a product name, website name, metatags, or other means" (FDA). Your ad links carry labels of their own in their URL parameters; the URL parameters post shows how to keep them neutral.

Who the Act reaches, and what it asks

A regulated entity is any business that conducts business in Washington, or provides products or services targeted to consumers there, and decides the purpose and means of collecting, processing, sharing or selling consumer health data. The AG says that can include a business outside the state, but not one that only stores data in Washington.

There's no size threshold for coverage. The small-business tier, set mainly by how many consumers' data a business handles, only got a later start date, 30 June 2024 instead of 31 March 2024, and both dates have passed.

What a covered business must do, from the statute:

• Consent to collect. Collect consumer health data only with consent for a specified purpose, or as far as necessary to provide a product or service the consumer asked for.
• Separate consent to share. Sharing needs consent "separate and distinct from the consent obtained to collect", unless it's necessary for the requested product or service. Each request has to say what is collected or shared, why, with whom, and how to withdraw.
• Consent that means something. A clear affirmative act that is freely given, specific, informed, opt-in and unambiguous. Accepting broad terms of use doesn't count, nor does agreement won through deceptive designs, nor "hovering over, muting, pausing, or closing" a piece of content, so muting or pausing your VSL agrees to nothing.
• A separate policy. A consumer health data privacy policy, with a prominent link on the homepage. The AG says it must be a separate and distinct link and contain nothing the Act doesn't require.
• Rights with a deadline. Consumers can confirm and access their data, including a list of every third party that received it, withdraw consent and have the data deleted. Answers are due within 45 days, with one extension allowed.
• A signed authorization to sell. Selling consumer health data takes a signed authorization that expires after one year.

For a store, the exception carries most of the weight. Shipping an order is plainly necessary to provide what the buyer asked for. Sending the page address to an ad platform so it can find more people like them is not obviously the same thing, and that's the first question to put to counsel. Run your own funnel through these questions before that conversation:

Could Washington's law reach your funnel?

Questions to take to counsel

1Do you do business in Washington, or target products or ads at consumers there?

Yes, or not sureNo

Shipping nationwide usually means selling to Washington.

2Does anything in the funnel link a visitor to a health condition, symptom or body function: a page address, an event name, a quiz answer, an audience?

Yes, or not sureNo

3Does that data reach an ad platform or another third party, through a pixel, an SDK or an uploaded list?

Yes, or not sureNo, it stays with us

Best fit

Washington's Act may not reach you; other rules still can

You don't do business in Washington or target its consumers, so its Act may not apply. Ask the same question about Nevada's and Connecticut's laws, and about California's if you meet its thresholds. The FTC Act doesn't depend on any state.

Best fit

Keep it neutral, and confirm

You're within the Act's reach, but nothing in the funnel links a visitor to a health condition, and on the AG's reading a non-prescription purchase counts only if you draw a health inference from it. Ask counsel to confirm, and re-check the labels after every change.

Best fit

Questions about collecting

You're within the Act's reach and the funnel links visitors to a health condition, but the data stays with you.

• Is it consumer health data, or covered by an exemption?
• Is collecting it necessary for what the buyer asked for, or does it need consent for a stated purpose?
• Do you need the separate consumer health data privacy policy, linked from your homepage?
• Can you answer access and deletion requests within 45 days?

Best fit

Questions about sharing come first

You're within the Act's reach, the funnel links visitors to a health condition, and that data reaches an ad platform or another third party.

• Is sending it necessary for what the buyer asked for, or does it need its own consent, separate from the consent to collect?
• Could any of these flows count as a sale, which needs a signed authorization?
• Would neutral labels take the question off the table?
• Which of Nevada's and Connecticut's rules apply as well?

Enforcement runs through Washington's Consumer Protection Act: any violation is a per se violation, enforced by the attorney general and through private lawsuits. Law firms reported the first class action under the Act in February 2025, Maxwell v. Amazon.com, which alleges that an advertising SDK inside other companies' apps collected location data without the consents the Act requires (WilmerHale). Those are allegations, and the case's outcome isn't covered here.

The Act also bans geofences within 2,000 feet of places that provide in-person health care when they're used to track people or send them ads, which matters only if you geotarget around clinics.

California, Nevada and Connecticut

California's privacy law, the CCPA, lists "personal information collected and analyzed concerning a consumer's health" as sensitive personal information. Where a business uses it to infer characteristics about a consumer, the consumer can direct the business to limit its use, through a "Limit the Use of My Sensitive Personal Information" link on its homepage (CCPA text). Unlike Washington's law, the CCPA has thresholds: annual revenue above $25 million, adjusted for inflation; buying, selling or sharing the personal information of 100,000 or more consumers or households; or earning half or more of annual revenue from selling or sharing it. Its "share" means disclosing personal information to a third party for cross-context behavioral advertising, a definition worth reading with your ad platforms in mind.

Nevada and Connecticut wrote consumer health data into law in 2023. Nevada's law (SB 370) has applied since 31 March 2024 (NRS 603A), and Connecticut's consumer health data section since 1 October 2023 (Connecticut General Statutes). Both cover similar ground with narrower definitions, and neither lets consumers sue:

Three state consumer health data laws, side by side

Consumers can sueWashington

• In force since 31 March 2024; 30 June 2024 for small businesses
• Data that identifies health status, inferences from nonhealth data included
• Consent to collect, separate consent to share
• A separate policy, linked from the homepage
• No geofences within 2,000 feet of in-person health care
• Exempts data HIPAA already protects

Enforced by the attorney general and by consumers, through the Consumer Protection Act.

No private lawsuitsNevada

• In force since 31 March 2024
• Data a business uses to identify health status; shopping habits not used that way are left out
• Consent to collect, separate consent to share
• A policy linked from the main website
• No geofences within 1,750 feet of in-person health care
• Exempts entities subject to HIPAA

A violation is a deceptive trade practice.

Attorney general onlyConnecticut

• Consumer health data section in force since 1 October 2023
• Data used to identify a health condition or diagnosis
• Treated as sensitive data, so processing it takes consent
• No sale without consent, for any business operating in the state
• No geofences within 1,750 feet of mental, reproductive or sexual health facilities

Civil penalties of up to $5,000 per violation.

What the FTC's cases say about pixels, SDKs and other tracking tools

For a business HIPAA doesn't cover, the FTC is the federal agency to watch, through the FTC Act and, where it fits, the Health Breach Notification Rule. In July 2023 it wrote with HHS to about 130 hospital systems and telehealth providers that tracking technologies "such as the Meta/Facebook pixel and Google Analytics" may be disclosing sensitive health data, and that companies HIPAA doesn't cover "still have a responsibility to protect against the unauthorized disclosure" of it (FTC).

Five cases between February 2023 and April 2024 show how health data left websites and apps. None of the companies was a store; they ran prescription, therapy, telehealth and health-app businesses:

• GoodRx (February 2023) shared users' prescription medications and health conditions with Facebook, Google and Criteo, and uploaded the emails, phone numbers and mobile ad IDs of buyers of particular medications to Facebook to target them with health ads. It agreed to a $1.5 million civil penalty in the FTC's first action under the Health Breach Notification Rule (FTC).
• BetterHelp (March 2023, final in July) revealed emails, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest for advertising, after promising to keep health data private except for limited purposes, and used emails and the fact of therapy so Facebook could find similar people. It agreed to pay $7.8 million for refunds (FTC).
• Premom (May 2023), an ovulation-tracking app, sent health data to AppsFlyer and Google through their software development kits (SDKs): a $100,000 civil penalty, plus $100,000 to Connecticut, the District of Columbia and Oregon (FTC).
• Monument (April 2024) sent custom events with titles like "Paid: Weekly Therapy" to Meta and Google through pixels and APIs, with email and IP addresses. Its $2.5 million penalty was suspended because the company couldn't pay (FTC).
• Cerebral (April 2024) passed the data of nearly 3.2 million people to third parties such as LinkedIn, Snapchat and TikTok through tracking tools on its website and apps. Its proposed order bars using or disclosing health information for most advertising; the nearly $5.1 million in refunds was for its cancellation practices (FTC).

Each order banned sharing health information for advertising in some form. The lesson that carries over to a supplement funnel is mechanical: the FTC named the channels, from pixels and SDKs to uploaded customer lists, and in Monument's case the event titles themselves.

The whole sequence, laws and cases together:

Health data and ad tracking, 2023 to 2025

State laws, FTC cases and a platform rule

1. 1 February 2023FTC v. GoodRxThe FTC's first action under the Health Breach Notification Rule.
2. 2 March 2023FTC v. BetterHelpFinal order on 14 July 2023.
3. 17 May 2023FTC v. Easy Healthcare (Premom)SDKs sent health data to AppsFlyer and Google.
4. 20 July 2023FTC and HHS letterIt names the Meta pixel and Google Analytics.
5. 23 July 2023Washington's geofencing banIn force for any person, regulated entity or not.
6. 1 October 2023Connecticut's consumer health data sectionApplies to any business operating in the state, whatever its size.
7. 31 March 2024Washington and NevadaWashington's main duties for regulated entities, and Nevada's SB 370, take effect.
8. 11 and 15 April 2024Monument, then CerebralPixel event titles at Monument; tracking tools at Cerebral.
9. 26 April 2024Health Breach Notification Rule amendedHealth apps and similar technologies outside HIPAA. Effective 29 July 2024.
10. 30 June 2024Washington: small businessesThe later start date for the small-business tier.
11. 10 February 2025Maxwell v. Amazon.com filedReported by law firms as the first class action under the Act. The claims are allegations.
12. 2 September 2025Meta's health-condition restrictionsAudiences and custom conversions suggesting specific health conditions are flagged and blocked.

The Health Breach Notification Rule is narrower than its reputation. Its 2024 amendments cover "health apps and similar technologies not covered by HIPAA" and count an unauthorized disclosure as a breach (FTC); they took effect on 29 July 2024 (Federal Register). But the rule applies to vendors of personal health records: electronic records that can draw information from multiple sources and are managed by or for the individual (16 CFR 318.2).

A store that sells bottles and runs a pixel probably isn't one. A brand that offers a diet, sleep or symptom-tracking app that pulls data from more than one source may be, and that's one more question for counsel.

Meta's and Google's own limits

The ad platforms set rules of their own, and those apply whatever the law says. Since 2 September 2025 Meta has been flagging custom audiences, lookalikes and custom conversions that suggest specific health conditions, with "arthritis" and "diabetes" as its own examples. Flagged audiences can't be used in new campaigns, and neither can flagged custom conversions, though you can request a review (Meta for Developers).

Meta doesn't say what its check reads, so treat names, rules and URLs alike. The Facebook ads for supplements post covers the rest of Meta's rules for the category.

Google lists health among its sensitive interest categories. When you promote in one, Customer Match and your data segments aren't supported, because such audiences "may inadvertently contain sensitive user signals", and its health category includes products to treat or manage chronic conditions (Google). For a supplement, positioning a product to treat a chronic condition is also a disease claim, which the VSL compliance guide covers.

How to audit what your pixels send

Start with the inventory. Washington's access right includes a list of every third party that received a consumer's data, and you can't produce that list without knowing which tags send what, and where. Then fix the labels, settle consent with counsel, and repeat the audit whenever the funnel changes.

Two RevvyScales settings help with the first two steps. Pixels are set once on a folder or a VSL, so the pixels RevvyScales loads for a funnel sit in one place (pixels). And a VSL, folder or presell can live at a custom path on your own domain (custom domains), so the address the pixel reports can be a code like /vx03 instead of a condition. The VSL tracking guide explains how pixels and server events fit together.

The audit, in the order to run it:

Pixel audit for a supplement funnel

• List every tag on every funnel page: pixels, SDKs, analytics, chat and heatmap scripts, custom code
• Load each page with the platform's test tool or the browser's network panel open, and note what each tag sends: the address, event names, parameters
• Replace condition words in paths, subdomains, campaign parameters and thank-you pages with neutral codes
• Rename custom events and audiences that name a condition, and send SKU codes instead of product names in parameters
• Keep quiz answers and symptoms out of pixel events entirely
• Check custom conversions and audiences for anything that suggests a health condition
• Ask counsel whether you need consent to collect, separate consent to share and a separate consumer health data privacy policy
• Keep a list of every third party that receives data, with a contact for each, ready for an access request
• Read each tool's terms on health data before you send it anything
• Repeat the audit after every new page, product name, tool or tracking change

0 of 10 done