[Enforcement library](/enforcement)

# Washington's privacy laws: RCW 9.73 after Baker, and the My Health My Data Act

Washington has two laws that reach website tracking, and they now point in opposite directions. The 1967 privacy act, RCW 9.73, requires all-party consent to record a "private communication". On 8 October 2026 the Washington Supreme Court held that it does not reach a visitor's clicks and searches on an automated website. The 2023 My Health My Data Act (MHMDA) goes the other way for health data. It requires prior, opt-in consent before a business collects or shares "consumer health data", and private plaintiffs can sue through the Consumer Protection Act.

RCW 9.73.030, 9.73.060; RCW 19.373 (My Health My Data Act); RCW 19.86.090, 19.86.120 · Source review: 17 October 2026

- What the law says
- Who can sue and what they can recover
- How it is used against websites and apps
- How courts have ruled
- Status and what is changing
- What this means for your implementation
- Cases in the library
- Sources and limits

## What the law says

**RCW 9.73.** [RCW 9.73.030(1)(a)](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.030) makes it unlawful to intercept or record any "Private communication transmitted by telephone, telegraph, radio, or other device between two or more individuals between points within or without the state by any device electronic or otherwise designed to record and/or transmit said communication regardless how such device is powered or actuated, without first obtaining the consent of all the participants in the communication". The elements are:

- a private communication;
- between two or more individuals;
- intercepted or recorded by a device;
- without the consent of all participants.

**MHMDA.** "Consumer health data" means "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status" ([RCW 19.373.010(8)](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010)). The list includes "Data that identifies a consumer seeking health care services" and data "derived or extrapolated from nonhealth information … including algorithms or machine learning".

From 31 March 2024, a regulated entity "may not collect any consumer health data except" with consent "for a specified purpose" or as necessary to provide a requested product or service. It "may not share any consumer health data except" with consent "that is separate and distinct from the consent obtained to collect" ([RCW 19.373.030(1)](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030)). Consent "must be obtained prior to the collection or sharing" and must disclose categories, purposes, recipients and how to withdraw (§030(1)(c)).

Consent means "a clear affirmative act", and it "may not be obtained by" acceptance of general terms, by "hovering over, muting, pausing, or closing" content, or "through the use of deceptive designs" ([RCW 19.373.010(6)](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010)). The Act also bars geofencing around in-person health care facilities ([RCW 19.373.080](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080)).

## Who can sue and what they can recover

- **RCW 9.73.060.** A person injured by a violation may recover "actual damages, including mental pain and suffering", or "liquidated damages computed at the rate of one hundred dollars a day for each day of violation, not to exceed one thousand dollars", plus attorney's fees ([RCW 9.73.060](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.060)). The current text states no limitations period; treat the period as uncertain.
- **MHMDA through the Consumer Protection Act.** A violation "is an unfair or deceptive act in trade or commerce" for the purpose of the CPA ([RCW 19.373.090](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090)). A person "injured in his or her business or property" may recover actual damages, which the court may treble up to USD 25,000, plus fees ([RCW 19.86.090](https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.090)). The Attorney General can also enforce.
- **Limitations period (CPA):** "within four years after the cause of action accrues" ([RCW 19.86.120](https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.120)).

The CPA's "injured in his or her business or property" requirement is a hurdle for privacy plaintiffs. No court ruling on it under the MHMDA was found.

## How it is used against websites and apps

**RCW 9.73 claims** alleged that the Meta Pixel on hospital websites recorded patients' searches and clicks and sent them to Meta. After *Baker*, those claims survive only where a human is on the other end, such as messages to a care team.

**MHMDA claims** target apps and sites that collect or share health-related signals without separate opt-in consent. Examples include:

- app SDKs on health or fitness features;
- advertising pixels on pages about conditions or medications;
- location data near clinics.

The first reported class action, *Maxwell v. Amazon.com* (W.D. Wash. No. 2:25-cv-00261, filed 10 February 2025), alleged MHMDA and federal Wiretap Act claims over a mobile SDK. CourtListener records it as terminated on 14 April 2025 ([docket](https://www.courtlistener.com/docket/69628048/maxwell-v-amazoncom-inc/)); we did not establish why.

## How courts have ruled

| Case | Court | Date | Holding |
| --- | --- | --- | --- |
| \[Baker v. Seattle Children's Hospital\](/enforcement/baker-v-seattle-childrens) | Wash. Supreme Court | 8 October 2026 | RCW 9.73.030(1)(a) "excludes searches and clicks that generate an automated response from SCH's website"; dismissal of the Meta Pixel claim affirmed (\[opinion, pp. 2, 10–11\](https://www.courts.wa.gov/opinions/pdf/1045905.pdf)) |
| \[Popa v. Microsoft\](/enforcement/popa-v-microsoft) | 9th Cir. (from W.D. Wash.) | 26 August 2025 | A Washington federal court case, but the claims were under Pennsylvania's WESCA. Dismissed for lack of standing (\[opinion, p. 6\](https://cdn.ca9.uscourts.gov/datastore/opinions/2025/08/26/24-14.pdf)) |

**What Baker leaves open.**

- **Human counterparts.** The court did not decide whether the statute applies when a corporation communicates through individuals, because those facts were "not conceivably raised by the complaint" (opinion, p. 9 n.6).
- **The patient portal.** The court limited its review to the public website, not the MyChart portal (p. 5 n.5).
- **Other claims.** It did not address the Consumer Protection Act, health care information, privacy, contract or unjust enrichment claims, which the plaintiffs had not appealed (pp. 9–10 n.7).
- **The concurrence.** Justice González, concurring in the result, "would also recognize that private communications transmitted between an individual and individuals working for a corporation are protected by our privacy act" ([concurrence, p. 2](https://www.courts.wa.gov/opinions/pdf/1045905.pdf)).

We found no appellate decision applying the MHMDA.

## Status and what is changing

**Status, 17 October 2026:**

- **RCW 9.73** no longer supports pixel claims over automated website pages, under *Baker*.
- **The MHMDA** is in force for regulated entities from 31 March 2024 ([RCW 19.373.030](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030)). It has no published merits ruling.

Expect Washington health-tracking claims to move from RCW 9.73 to the MHMDA and the CPA, and to chat and messaging features where a person replies.

## What this means for your implementation

The MHMDA's consent model is stricter than a typical cookie banner:

- consent must be prior, opt-in and for a specified purpose;
- sharing needs its own consent, separate from collection.

For anything that touches health:

- List pages, app screens and events that could identify health status, including inferences: condition pages, symptom checkers, pharmacy and clinic locators, period or fitness features.
- Keep advertising pixels and SDKs off those surfaces unless you have separate sharing consent.
- Do not treat "closing" a banner as consent; the statute excludes it.
- Check location collection around health facilities.

### How Inth catches this

- **Code audit:** flags a pull request that adds an advertising or analytics SDK to health-related routes, and traces health fields and location data to the vendor.
- **Website audit:** records vendor requests from health-related pages, with the page, time, visitor region and consent state.
- **Consent banner:** Washington is not in the default opt-in regions. Teams can create a Washington policy so that tags wait for an affirmative choice. Whether the banner's categories meet the MHMDA's separate-consent and disclosure rules is for your legal team.
- **Evidence:** consent records with the choice, country and policy.

Inth does not see in-app SDK traffic or server-side sharing, which are common MHMDA risks.

## Cases in the library

- [Baker v. Seattle Children's Hospital](/enforcement/baker-v-seattle-childrens)
- [Popa v. Microsoft](/enforcement/popa-v-microsoft)
- [Kaiser Permanente](/enforcement/kaiser-permanente) (Washington Privacy Act among the pleaded claims)
- [In re Otter.ai](/enforcement/in-re-otter-ai) (Washington Privacy Act among the pleaded claims)

## Sources and limits

- RCW [9.73.030](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.030), [9.73.060](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.060), [19.373.010](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010), [19.373.030](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030), [19.373.080](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080), [19.373.090](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090), [19.86.090](https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.090), [19.86.120](https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.120)
- [Baker v. Seattle Children's Hospital, No. 104590-5 (8 October 2026)](https://www.courts.wa.gov/opinions/pdf/1045905.pdf)
- [Popa v. Microsoft, 9th Cir. No. 24-14](https://cdn.ca9.uscourts.gov/datastore/opinions/2025/08/26/24-14.pdf)
- [Maxwell v. Amazon.com, W.D. Wash. 2:25-cv-00261 (CourtListener docket)](https://www.courtlistener.com/docket/69628048/maxwell-v-amazoncom-inc/)

Source review: 17 October 2026. This page summarises the statutes and the cited decisions at their procedural stage. It is not legal advice. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.