Consumer Health Data Laws Reach Lenders, Carriers, and Software Platforms That Never Saw Themselves Becoming
Here is the uncomfortable part, stated first. You do not have to sell medicine, run a clinic, or employ a single physician to fall under the growing body of consumer health data laws. The statutory definitions do the work, and they reach a mortgage lender’s rate-quote page, a wireless carrier’s location logs, and a productivity app that includes a meditation timer. Washington’s version carries a private right of action, so you do not need a regulator to find you. A plaintiff’s lawyer and a browser will handle it. The right response is not alarm. It is a tracker audit, a data-flow map, a consent mechanism that actually works, and vendor contracts that say what you need them to say. Companies that complete those four tasks this quarter will spend next year reading about other people’s settlements.
The Definition Is the Trap
Washington’s My Health My Data Act, passed by the legislature in 2023 and taking effect for most businesses on March 31, 2024, protects any personal information linked or reasonably linkable to a consumer’s past, present, or future physical or mental health. That language covers the obvious categories, including conditions, treatments, diagnoses, reproductive and sexual health information, and biometric and genetic data. It also covers precise location data that could indicate an attempt to receive health services, and it treats inferences as regulated data in their own right. A company that never asks a health question can still collect health data by deduction from what a person reads and where a person goes. The statute even bars building a geofence within 2,000 feet of a health-service facility to track consumers or serve them health-related ads. The law does not care that you consider yourself to be a bank. It cares about what your pixels know.
The GLBA Card Does Not Work Here
Financial services teams seek familiar reassurance: we comply with the Gramm-Leach-Bliley Act, so state privacy laws can’t reach us. Under Washington’s statute, that card clears only part of the table. The Act’s exemption is at the data level, not the entity level. The carve-out shields information that GLBA governs. It does not place the institution itself beyond reach. Your core account records fall within the exemption. The marketing analytics that run on your public site, the advertising kit buried in your mobile app, and the location data collected by that app for reasons unrelated to GLBA do not fall within the exemption. The Fair Credit Reporting Act treats the same data at the same level. HIPAA, by contrast, carries an entity-level exemption, which is exactly why hospitals feel calmer about this law than lenders do, and why lenders cannot borrow that calm.
State lines matter more than usual here. Nevada’s companion law, Senate Bill 370, took effect the same day as Washington’s and does exempt GLBA-regulated entities outright, as well as HIPAA-covered entities. Connecticut incorporated comparable consumer health data protections into its Data Privacy Act, but it does not grant consumers a private right to sue. So, the honest answer to “are we covered” is a question in return: whose consumers are you collecting from?
The Private Right of Action Is the Part That Should Keep You Up
Washington made violations of its health data law enforceable as unfair or deceptive acts under the state Consumer Protection Act, allowing a private plaintiff, not only the attorney general, to bring a claim. That single design choice explains why Washington produces litigation that Nevada and Connecticut, which left enforcement to their attorneys general, do not. The first suit came quickly. On February 10, 2025, a consumer sued Amazon in the Western District of Washington, alleging that an advertising software development kit embedded in third-party mobile apps collected precise location data that could reveal visits to places implying a health condition. The theory is the one every general counsel dreaded: location plus inference equals health data, and health data collected without opt-in consent equals a claim. Early complaints have been thin on proof that anyone actually inferred a health condition, and courts will test how far “reasonably linkable” stretches. Betting your compliance posture on the plaintiffs’ bar losing that argument qualifies as a strategy, in the same way that crossing a highway blindfolded qualifies as a commute.
Regulators Stopped Reading the Policy and Started Watching the Wire
Private plaintiffs provide only a partial account. On July 29, 2026, the Federal Trade Commission, joined by California and Utah, sued Hims & Hers, alleging that the company told customers their health information would remain private and reach only their medical providers, then shared mental health, sexual health, and prescription details with Meta and Snap via tracking pixels. The complaint adds two charges any software executive will recognize: billing for subscriptions without clear consent and making cancellation an endurance sport. A week later, on August 5, 2026, a proposed class sued the University of Colorado Health over a Meta pixel that allegedly transmitted doctor-search activity, down to IP addresses and Facebook identifiers, from a public “find a doctor” tool and possibly the patient portal. Across the private suits and the government actions, the common thread is careful privacy policies. The gap is between what the policy promises and what the page actually transmits.
Why This Lands on Lenders, Carriers, and Software Companies
Lenders should identify which products carry a health story. A medical-financing application, a debt-consolidation page aimed at people buried in hospital bills, or a personal-loan funnel that asks the borrower for the reason for the loan all generate data that a plaintiff can recast as health-linked. Most lending sites run trackers for marketing attribution, and the raw material for a claim already sits on the page.
Carriers hold precise location data as a condition of providing service. A geofence, an analytics partner, or an advertising program that accesses that location stream can convert ordinary network data into regulated health data the moment a subscriber’s pattern passes within 2,000 feet of a clinic often enough to resemble treatment.
Software companies carry the broadest exposure because they collect on behalf of their customers. A wellness feature, a fitness integration, an HR platform that records medical leave, or an analytics kit licensed to thousands of other apps can import health data obligations the product was never designed to meet. If your kit becomes the subject of the next complaint, you will learn the statute’s contours from the docket.
The Fixes Are Boring, Which Is the Good News
This is a solvable operations problem, not a crisis, and the work pays for itself through lower exposure and more consistent customer trust. Five moves cover most of the risk.
First, inventory every tracker, pixel, tag, cookie, and software kit across your web and mobile properties, and record exactly what each one sends and to whom. You cannot defend a data flow you cannot describe.
Second, map which of those flows could touch health-linked or precise-location data and read “reasonably linkable” the way a plaintiff will, that is, broadly.
Third, make consent real. Collect opt-in consent before collecting, honor revocations when a consumer withdraws consent, obtain separate authorization before any sale, and log it all as audit-grade proof of who agreed to what and when.
Fourth, align your privacy statements with your actual behavior. If the policy says “private,” the plumbing has to deliver privacy. The cheapest settlement is the promise you never broke.
Fifth, please consider revising your vendor contracts. Every analytics and advertising partner that touches this data needs purpose limits, deletion obligations, and terms tailored to this regime, not a boilerplate addendum drafted for a different one.
Companies that do this now will stay off the dockets filling up in Seattle, San Francisco, and Denver, and they will hold something that grows scarcer each quarter: a credible, verifiable claim that they handle customer data as they say they do. In a market where trust is becoming the actual product, that claim is worth far more than the compliance hours it takes to earn.
If your organization is navigating where consumer health data laws apply to your products, trackers, or vendor relationships, I welcome the conversation. I help financial services, telecom, and software companies turn this uncertainty into a documented, defensible compliance posture. Please reach out, and we can discuss how I might help you address the concerns raised here.
Disclaimer: This article provides general informational and educational content only and does not constitute formal legal advice. The information contained herein may not reflect the most current legal developments, verdicts, or settlements. Reading this article, transmitting information through related platforms, or contacting the author does not create an attorney-client relationship. Readers should not act or refrain from acting based on any information in this article without seeking professional legal counsel tailored to their specific jurisdiction, facts, and circumstances. The author expressly disclaims all liability with respect to actions taken or not taken based on any or all contents of this publication.