Washington's Health Privacy Law Reaches Further Than You'd Think
Washington's My Health My Data Act sounds like it belongs to hospitals and health tech companies. In practice, its definition of "consumer health data" is broad enough to catch a meaningful slice of ordinary Shopify sellers, and unlike most comprehensive privacy laws, it lets individual consumers sue directly.
What Counts as Health Data Here
MHMDA's definition goes well beyond medical records. It covers data that identifies a consumer's past, present, or future physical or mental health status, which in practice can include fitness and wellness tracking data, reproductive or sexual health information, purchases of supplements or health-adjacent products, and even location data near health-related facilities.
There is no revenue threshold and no consumer-count threshold in this law at all. If you collect data that falls within this definition, the law applies, regardless of your store's size.
The Sector Most Likely to Be Caught Off Guard
Stores selling supplements, vitamins, fitness wearables, reproductive health products, or anything marketed around wellness outcomes are the most likely candidates to trigger this law without realizing it. A general apparel or home goods store almost certainly falls outside it. A store selling menstrual tracking devices or fertility supplements almost certainly falls inside it.
What Compliance Actually Requires
MHMDA requires a separate, dedicated consumer health data privacy policy, distinct from your general privacy policy. It requires affirmative opt-in consent before collecting this data, not just an opt-out mechanism. Selling health data requires signed written authorization, a notably higher bar than a simple opt-out link. Consumers also get the right to withdraw consent and the right to delete their health data.
The Detail That Changes the Stakes
MHMDA violations carry a private right of action under the Washington Consumer Protection Act. That means individual consumers, not just the state Attorney General, can sue directly. This puts Washington in the same elevated-risk category as Illinois's BIPA, a meaningfully different enforcement posture than the AG-only laws in most other states.
What to Actually Check
If any part of your product line touches health, wellness, fitness, or reproductive health, even loosely, it's worth a direct look at whether your data practices meet MHMDA's opt-in consent and dedicated-policy requirements specifically, rather than assuming your general privacy policy already covers it.
Check Your Washington Exposure
All information in this article is sourced from the Washington My Health My Data Act (RCW § 19.373) and the Washington Attorney General's published guidance. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks Washington as part of its ongoing state-by-state privacy coverage. Your store's readiness is calculated based on your actual inputs and current policy documents.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's Washington privacy readiness at getregulens.com
Further Reading
Q4 Is Starting — Here's the Multi-State Compliance Check Most Sellers Skip Before It Does
Fourth quarter brings the highest sales volume of the year for most Shopify sellers, which means it also brings the highest chance of crossing a state threshold you haven't checked yet.
Twenty States. One Question Most Sellers Haven't Asked Yet.
As of mid-2026, twenty U.S. states now have comprehensive privacy laws in effect, with four more already signed and coming. Most Shopify sellers checking their compliance still only think about California.