Does Washington's My Health My Data Act Ban Geofencing Around Health Care Facilities?

Yes. Washington's My Health My Data Act (MHMDA) bans implementing a geofence around an entity that provides in-person health care services in order to identify or track consumers seeking health care, collect their health data, or send them health-related messages or advertisements. The restriction, codified at RCW 19.373.080, took effect in mid-2023.

What the Ban Actually Covers

The law's reach is broader than "hospitals and clinics" might suggest. Legal analysis from the Future of Privacy Forum reads "health care services" widely enough to cover gyms, mixed-use complexes that include a health clinic, and general retail stores that happen to house a health-related service. A geofence drawn around any of those locations to identify visitors, build health-inference profiles, or serve them targeted ads falls within the prohibition — not just geofences around traditional medical facilities.

Who Has to Comply

The MHMDA applies to any legal entity that conducts business in Washington, or that produces or provides products or services targeted to Washington consumers — a bar legal commentary describes as low, since simply making a website accessible from Washington or advertising into the state can be enough to bring a business into scope.

Why This Carries More Risk Than Most State Privacy Rules

Unlike several comprehensive state privacy laws that rely solely on attorney general enforcement, the MHMDA includes a private right of action, run through Washington's Consumer Protection Act (RCW 19.86.090). That means an individual consumer — not just the state AG — can sue a business directly over a violation, which materially raises the litigation exposure compared to opt-out-style laws enforced only by a regulator. Legal commentary disagrees on the exact remedy available: several law firm analyses describe recovery as tied to actual damages, trebled up to a $25,000 cap, plus attorney's fees, while at least one industry compliance brief describes a separate statutory-damages model — so don't assume a single fixed per-violation number without checking current case law. Washington joins Nevada, Connecticut, and New York as among the few states specifically prohibiting geofencing around health care facilities.

What Advertisers Should Check Now

• Location-based ad vendors: Confirm any programmatic or location-data vendor used for geofenced campaigns excludes health care facility addresses from Washington targeting lists.
• Retargeting pools: Audit whether a retargeting audience could have been built from visits to a clinic, pharmacy counter, or wellness center without that being the intended trigger.
• Message content: Even outside a geofence, sending health-related ad messages built from inferred health data carries separate MHMDA restrictions beyond the geofencing rule itself.

Bottom Line

If any part of your location-based targeting touches Washington, exclude health care facility geofences specifically — the private right of action means a single overlooked campaign can turn into a lawsuit, not just a regulatory warning letter.

Sources: RCW 19.373.080; RCW 19.86.090; Future of Privacy Forum, "A New Paradigm for Consumer Health Data Privacy in Washington State" and its MHMDA legislation policy brief (fpf.org); Hunton Andrews Kurth Privacy and Cybersecurity Law Blog, "New Washington State Geofencing Ban Set to Take Effect in July" (huntonprivacyblog.com); Cooley, "Washington State's My Health My Data Act FAQ Part Three: Enforcement Risks" (cdp.cooley.com); D3RX, "Washington's My Health My Data Act: Healthcare Practice Implications" (d3rx.com).