What are the Washington My Health My Data Act compliance deadlines?

Apr 27, 2023: HB 1155 signed. Jul 23, 2023: Geofencing ban (Section 10) effective. Mar 31, 2024: Regulated entities must comply. Jun 30, 2024: Small businesses must comply.

When does Washington My Health My Data Act take effect?

Washington My Health My Data Act took effect on Mar 31, 2024.

Who does Washington My Health My Data Act apply to?

Any legal entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of processing consumer health data, with no revenue threshold. Small businesses (health data of fewer than 100,000 consumers a year, or under 50% of revenue from health data and fewer than 25,000 consumers) got a later compliance date.

What are the penalties under Washington My Health My Data Act?

A violation is a per se violation of the Washington Consumer Protection Act: AG civil penalties up to $7,500 per violation (RCW 19.86.140). Private right of action for actual damages, with possible treble damages and attorney fees.

Washington My Health My Data Act

In force Washington · In force Mar 31, 2024 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

ComplianceJun 30, 2024 · 2.3 years ago · Source

Small businesses must complySections 4-9 apply to small businesses.

ComplianceMar 31, 2024 · 2.6 years ago · Source

Regulated entities must complySections 4-9 (privacy policy, consent, consumer rights, sale authorization) apply to regulated entities.

Takes effectJul 23, 2023 · 3.3 years ago · Source

Geofencing ban (Section 10) effectiveBan on geofencing around health care facilities applies to all persons.

MilestoneApr 27, 2023 · 3.5 years ago · Source

HB 1155 signedGovernor signs My Health My Data Act.

Summaries for reference, not legal advice. Check the official text.

What it does

Regulated entities must publish a consumer health data privacy policy linked from their homepage and get opt-in consent to collect or share consumer health data. Selling it requires a signed authorization. Consumers get rights to access, delete and withdraw consent. Geofencing within 2,000 feet of health care facilities is banned. 'Consumer health data' is defined broadly and includes inferences from non-health data.

Who it applies to: Any legal entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of processing consumer health data, with no revenue threshold. Small businesses (health data of fewer than 100,000 consumers a year, or under 50% of revenue from health data and fewer than 25,000 consumers) got a later compliance date.
Penalties: A violation is a per se violation of the Washington Consumer Protection Act: AG civil penalties up to $7,500 per violation (RCW 19.86.140). Private right of action for actual damages, with possible treble damages and attorney fees.
Enforced by: Washington Attorney General; private right of action
Official name: Washington My Health My Data Act (HB 1155, Laws of 2023, ch. 191; RCW 19.373)
Citation: RCW 19.373; Laws of 2023, ch. 191 (HB 1155)
Topics: Health data, Privacy

Verified 2026-09-22 app.leg.wa.gov app.leg.wa.gov app.leg.wa.gov

Research notes

The treble-damages cap for private actions (RCW 19.86.090) was not re-verified for this record.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months

EnactedCalifornia

California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months

In forceCalifornia

California social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026

EnactedColorado

Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months

Questions about Washington My Health My Data Act

What are the Washington My Health My Data Act compliance deadlines?: Apr 27, 2023: HB 1155 signed. Jul 23, 2023: Geofencing ban (Section 10) effective. Mar 31, 2024: Regulated entities must comply. Jun 30, 2024: Small businesses must comply.
When does Washington My Health My Data Act take effect?: Washington My Health My Data Act took effect on Mar 31, 2024.
Who does Washington My Health My Data Act apply to?: Any legal entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of processing consumer health data, with no revenue threshold. Small businesses (health data of fewer than 100,000 consumers a year, or under 50% of revenue from health data and fewer than 25,000 consumers) got a later compliance date.
What are the penalties under Washington My Health My Data Act?: A violation is a per se violation of the Washington Consumer Protection Act: AG civil penalties up to $7,500 per violation (RCW 19.86.140). Private right of action for actual damages, with possible treble damages and attorney fees.

Deadlines

What it does

Related