Sends commercial email, in Washington

RCW 19.373 · Read the law's page

• Washington's My Health My Data Act reaches consumer health data broadly: personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status, including inferences and non-health data that indicate a health status, such as location data suggesting an attempt to obtain reproductive or gender-affirming care.
• Do not implement a geofence around an entity that provides in-person health care services to identify or track consumers seeking care, collect their health data, or send them related notifications, messages, or advertisements.
• A violation of this Act is per se an unfair or deceptive act under the Washington Consumer Protection Act, which carries its own private right of action; a federal class action alleging SDK-based location and biometric data harvesting in violation of this Act is reported pending by secondary commentary, not independently confirmed against the court docket.

RCW 19.373; HB 1155, chapter 191, Laws of 2023 · Read the law's page

• Obtain affirmative opt-in consent before collecting a Washington consumer's health data, and separate consent before sharing it, unless the collection or sharing is necessary to provide a product or service the consumer requested; consumer health data includes any biometric identifier used to infer a health condition, whether captured live or extracted from a stored photo, video, or audio recording.
• Obtain a further signed authorization before selling consumer health data.
• Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.
• Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.

RCW 19.190.010, .020, .030, .040, .050 · Read the law's page

• Do not initiate, conspire to initiate, or assist in transmitting a commercial email message, from a Washington computer or to an address you know or have reason to know is a Washington resident's, that uses a third party's internet domain name without permission or otherwise misrepresents or obscures the message's point of origin or transmission path.
• Do not use a subject line that, based on your actual knowledge or knowledge fairly implied on the basis of objective circumstances, contains false or misleading information.