Washington My Health My Data Act Consent Requirements: A Checklist for Health and Wellness Brands

Most US state privacy laws are built on opt-outs. Washington's My Health My Data Act (MHMDA), codified at RCW 19.373, is built on opt-in consent, and it reaches well beyond healthcare.

Washington My Health My Data Act Consent Requirements: A Checklist for Health and Wellness Brands

Supplement and nutrition brands, fitness and period-tracking apps, online pharmacies, telehealth services and wellness content sites can all process "consumer health data" as the Act defines it. The definition is broad, so the first step for any consumer brand is to check which of its data could fall within it.

The Act has applied since 31 March 2024 for most regulated entities, and since 30 June 2024 for small businesses.

Consent requirements under the MHMDA

Collection. Collecting consumer health data requires the consumer's consent, unless the collection is necessary to provide a product or service the consumer requested.

Sharing. Sharing consumer health data requires a separate consent, again unless necessary for a requested product or service. The consent to collect and the consent to share cannot be combined.

Quality of consent. Consent must be a clear affirmative act showing a freely given, specific, informed, opt-in, voluntary and unambiguous agreement. Each consent request has to include disclosures similar to a privacy policy: the categories of data, the purpose, who receives it and how to withdraw.

Sale. Selling consumer health data requires a valid authorization signed by the consumer, separate from the consents to collect and share.

Privacy policy. Regulated entities must publish a Consumer Health Data Privacy Policy and link to it prominently from the homepage, disclosing the categories of data collected, the purposes and the sources.

Enforcement. The Washington Attorney General can enforce the Act, and consumers have a private right of action through the Washington Consumer Protection Act. That combination is what makes the MHMDA a high-risk law for consumer brands.

Where marketing and product meet health data

Everyday growth tools can involve consumer health data when the products are health-related: retargeting pixels on product pages, sharing purchase audiences with ad platforms, conversion tracking for a vitamin subscription, or analytics events from a symptom checker. Each of these can mean collecting or sharing data that needs consent under the Act.

For product managers, that means mapping which pages, events and app screens could reveal health information, and deciding where the two consent requests appear in the user journey, typically before the first health-related tracking fires.

MHMDA consent checklist

• Have you mapped the data, pages and app features that could count as consumer health data?
• Do you ask for consent before collecting it, unless it is needed for a service the consumer requested?
• Do you ask separately before sharing it, including with analytics and advertising vendors?
• Are your ad and analytics tags blocked until the relevant consent is given?
• Do your consent requests explain the data, the purpose, the recipients and how to withdraw?
• Do you have a separate signed authorization process if you sell consumer health data?
• Is your Consumer Health Data Privacy Policy published and linked from the homepage?
• Can you prove when each consent was given and withdrawn?

How UniConsent handles it

The Washington consumer health data template creates two separate custom purposes, one for collection and one for sharing. Both are marked as sensitive, so US visitors have to opt in to each explicitly; accepting the banner doesn't grant them. The choices are also sent in the IAB Global Privacy Platform (GPP) string under the consumer health data category, so vendors that read GPP receive them.

Tags can be configured to load only when the relevant purpose is granted, and each choice is recorded in the UniConsent Consent DB as evidence.

For developers: the purposes are available in the web SDK and in the iOS, Android, Flutter and React Native SDKs, where your app reads the current state with getCustomConsents(). Edit the template text so it matches your data and your Consumer Health Data Privacy Policy. See the custom purposes documentation.

For the full overview, read our Washington My Health My Data Act guide, or compare it with other US state privacy laws.

This article is general information, not legal advice. Check how the Act applies to your business with your legal advisers.

About UniConsent

UniConsent is a consent management platform (CMP) for websites and apps, supporting GDPR, the UK GDPR, IAB TCF, US state privacy laws and more. Get started for free.