First Lawsuit Filed Under Washington’s My Health My Data Act

On February 10, 2025, a Washington state resident filed a lawsuit on behalf of herself and similarly situated individuals against Amazon under the Washington My Health My Data Act (MHMD). This is the first lawsuit brought under MHMD’s private right of action.

Because MHMD regulates non-HIPAA consumer health data, broadly defined, and allows any Washington resident (and others whose consumer health data is collected in Washington) to enforce alleged violations, businesses should take notice of this development and re-assess if they may have exposure under it or need to improve their MHMD compliance program.

What MHMD Regulates

MHMD regulates entities that (1) conduct business in Washington or produce or provide products and services targeted to “consumers” in Washington, and (2) determine the purpose and means of the collection of consumer health data. “Consumers” includes Washington residents as well as any individuals whose consumer health data is collected in Washington.

Moreover, the definition of “consumer health data” is far-reaching. It includes not only what would traditionally be considered health information, such as individually identifiable information regarding an individual’s physical and mental health and condition, but also biometric data and precise location information that could indicate a consumer’s attempt to acquire or receive health services or supplies.

What the Plaintiff Alleges

The plaintiff alleges that Amazon violated MHMD by failing to (1) obtain the plaintiff’s consent prior to collecting her consumer health data, including location and biometric data, and (2) provide disclosures that must accompany a request for consent.

The complaint continues to allege that Amazon used its software development kit (its “SDK”) embedded in thousands of apps across the Google Play Store and Apple App Store to collect the location data of millions of smartphone users. According to the complaint, the location data may provide insights into the user’s health, such as tracking visits to a cancer clinic or health behaviors, such as trips to the gym. The complaint further alleges that, while the user may agree to share their location data with the app, they have no idea that Amazon, through its SDK, is also obtaining that data and monetizing it.

The plaintiff argues that her data has tangible value and so these actions caused her harm in the form of lost money or property. Notably, the same federal district court in which this complaint was filed has accepted a similar theory of harm in another recent case. Castillo v. Costco Wholesale Corp (W.D. Wash. Nov. 14, 2024).

What it Means

MHMD provides a private right of action through the Washington Consumer Protection Act (the “CPA”). Under the CPA, a plaintiff must prove that the defendant’s action:

1. Results in an unfair or deceptive act or practice,
2. Occurring in trade or commerce,
3. Impacting the public interest,
4. Injuring the plaintiff in their business or property, and
5. There is a causal link between the defendant’s unfair or deceptive act or practice and the injury suffered.

If there is a violation of MHMD, the first three elements of a CPA claim are presumed to be met. As such, a plaintiff needs to prove only injury and the causal link.

If the court allows this lawsuit to proceed, particularly in terms of injury, it may open the floodgates to substantial class action litigation arising under MHMD.

What to Do

If you haven’t considered your company’s MHMD compliance obligations or are revisiting them, we recommend you prioritize these four action items:

• Determine whether your company’s activities fall under the broad scope of MHMD. If yes, determine if any exemptions apply.
• Draft necessary consents. These consents cannot be buried in other documents, such as Privacy Notices and Terms of Use. MHMD has specific content and form requirements. For example, you may need to modify your “cookie banners” to meet MHMD’s consent requirements when using marketing or analytics pixels or other tracking technologies in the context of consumer health data.
• Post a consumer health data privacy policy on your company’s website. Meet MHMD’s content and posting requirements.
• Review your company’s collection of consumer health data, including via its website. Determine if third parties collect consumer health information for analytics, marketing, or other reasons. If yes, your company will likely need to execute data processing agreements with those third parties and obtain consumer consent.

We are committed to helping our clients determine their obligations, defend their practices, and update their compliance programs to address consumer health data laws. If you face an enforcement action or lawsuit under these laws—or if you would like advice on how to avoid them—please contact one of the authors (Thora Johnson, Aravind Swaminathan, Sundeep Kapur, Emily Tabatabai, Peter Graham) or another member of the Orrick team.