Washington Privacy Act & Website Tracking Litigation
What This Statute Says (Plain Language)
Washington's Privacy Act is among the older all-party consent statutes: it generally requires the consent of all participants before private communications or conversations are intercepted or recorded. Washington also enacted the My Health My Data Act (MHMDA), a separate consumer-health data privacy law with a private right of action that interacts with website tracking concerns.
Why It Appears in Website Tracking Litigation
Plaintiffs have asserted Washington Privacy Act theories against website tracking technologies, and MHMDA has opened an adjacent avenue for claims involving health-related browsing data collected by pixels and analytics on health-adjacent websites. The combination keeps Washington in the active tier of website tracking litigation states.
Practical Implications for Website Operators
Washington's website tracking exposure runs on two tracks. The first is the Washington Privacy Act itself — one of the older all-party consent statutes, with a 'private communications' framing that predates the web and comparatively little website-specific case law. The second, and in current filings the more consequential, is the My Health My Data Act (MHMDA): a separate consumer health data law, effective 2024, that carries a private right of action through the state's Consumer Protection Act and reaches 'consumer health data' defined far more broadly than clinical records.
The pattern in tracked matters is health-inference tracking: advertising pixels, SDKs, and analytics receiving page URLs or browsing signals from which a visitor's health condition or interest can allegedly be inferred. That puts an unusual set of operators in scope — not just providers, but pharmacies, supplement and wellness retailers, fitness services, and any site whose page URLs name conditions, symptoms, or treatments. For those operators, an ordinary marketing tag on a condition-specific page is the core alleged fact.
Litigation Risk in Plain Language
Under the Privacy Act itself, liquidated damages are modest ($100 per day up to $1,000, plus actual damages including mental pain and suffering), and the statute's application to website data flows is comparatively undeveloped — which cuts both ways, since neither side has a wall of precedent. The realistic risk driver is the combination: Privacy Act theories pleaded alongside MHMDA and Consumer Protection Act claims, where the health-data framing raises the stakes considerably.
MHMDA's breadth is the contested frontier. Its definition of consumer health data extends to inferences, biometrics, and precise location tied to health, so the classification of ordinary marketing data on health-adjacent sites is exactly what early motions are testing. Until that boundary settles, the exposure question for operators is concrete: which pages could support a health inference, and which third parties receive data from them.
What Operators Commonly Review
These are the configuration reviews we most often see performed by operators of websites serving visitors in this jurisdiction — informational starting points, not legal requirements and not legal advice:
- Map every page that could support a health inference — conditions, symptoms, treatments, medications, wellness products — and inventory the third-party tags firing on them.
- Verify advertising pixels and analytics do not receive condition-specific page URLs, search terms, or form values from those pages.
- Gate non-essential tracking behind consent for Washington visitors, with particular attention to transmission that begins on page load.
- Review scheduling, chat, and intake embeds on health-adjacent pages — the referring page URL alone can be the sensitive datum.
- Treat any recording feature (session replay, call recording) under the state's all-party consent standard.
How This Statute Compares
Consent standard, private right of action, and statutory damages are the structural features that most shape where website tracking claims are filed. Here is how the other electronic interception statutes we track compare:
| Statute | Consent Standard | Private Right of Action | Statutory Damages |
|---|---|---|---|
| California Invasion of Privacy Act (CIPA) | All-party | Yes | $5,000 per violation or three times actual damages (Cal. Penal Code § 637.2) |
| Federal Wiretap Act (ECPA Title I) | One-party | Yes | The greater of actual damages, $100 per day of violation, or $10,000 (18 U.S.C. § 2520) |
| Florida Security of Communications Act (FSCA) | All-party | Yes | The greater of actual damages, $100 per day of violation, or $1,000 (Fla. Stat. § 934.10) |
| Illinois Eavesdropping Act | All-party | Yes | Actual and punitive damages; injunctive relief (720 ILCS 5/14-6) |
| Maryland Wiretapping and Electronic Surveillance Act | All-party | Yes | The greater of actual damages, $100 per day of violation, or $1,000, plus punitive damages and fees (§ 10-410) |
| Massachusetts Wiretap Act | All-party | Yes | Actual damages, not less than $100 per day of violation or $1,000, plus punitive damages and fees |
| Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) | All-party | Yes | The greater of actual damages, $100 per day of violation, or $1,000, plus punitive damages and fees (18 Pa. C.S. § 5725) |
Jurisdiction Context
See the full Washington website tracking litigation page for the current risk guideline (Moderate), tracked matter counts, and trend data.
Tracked Cases Invoking This Statute
No tracked cases currently link to this statute in our source set. This reflects our tracked sources, not an absence of litigation.
Common Questions
Is the Washington Privacy Act the same as Washington's consumer privacy law?
No. The Washington Privacy Act (RCW 9.73) is the state's decades-old communications interception statute requiring all-party consent. The My Health My Data Act is a separate 2024 consumer health data law with its own obligations and a private right of action via the Consumer Protection Act. Website tracking matters in Washington increasingly involve both, but they are distinct statutes with different elements.
Why does MHMDA matter for a business that isn't a healthcare provider?
MHMDA defines 'consumer health data' broadly enough to reach inferences drawn from browsing behavior — so wellness retailers, supplement sellers, fitness services, and similar businesses can hold covered data without ever touching a medical record. Whether particular marketing data qualifies is being actively litigated; that uncertainty is itself a reason for health-adjacent operators to review their tracking configuration.
What damages apply in Washington website tracking matters?
The Privacy Act provides actual damages (including mental pain and suffering) or liquidated damages of $100 per day up to $1,000. MHMDA claims proceed through the Consumer Protection Act, which provides actual damages, potential trebling within statutory limits, and fees. As in other states, aggregate class exposure rather than per-person figures drives the economics.
Related Intelligence
Further Reading
- Your website may be sharing more than you think — our plain-language overview of hidden tracking, wiretap exposure, and Global Privacy Control.
- Website wiretap lawsuits by state — risk guidelines and tracked matter counts for all 50 states.
Sources
Statutory text and public commentary are the basis for this page; tracked litigation sources will be listed as the intelligence engine links them to this statute.
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website