Federal Case Tests Washington State’s Health Data Privacy Law

SEATTLE — Amazon is facing a potential class-action lawsuit alleging it violated Washington state’s My Health My Data Act by secretly collecting and monetizing consumer health data. The lawsuit, filed in the U.S. District Court for the Western District of Washington, marks the first legal test of the state’s groundbreaking health data privacy law.

Lawsuit Alleges Unlawful Data Collection

The complaint, filed on behalf of plaintiff Cassaundra Maxwell and other affected individuals, accuses Amazon of harvesting biometric and location data through its advertising software embedded in mobile applications. The lawsuit claims that Amazon’s software development kits (SDKs) allowed the company to collect personal health-related data without user consent, violating both state and federal privacy laws.

According to the lawsuit, Amazon’s ad tracking technology is embedded in thousands of third-party apps, including OfferUp and The Weather Channel. These SDKs allegedly operated in the background, collecting precise location information that could indicate when users sought health-related services.

“Amazon collected Plaintiff’s consumer health data, including biometric data and precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies,” the lawsuit states.

Washington’s Health Privacy Law Under Scrutiny

Washington’s My Health My Data Act, passed in 2023, was designed to protect sensitive health information that is not covered under the federal Health Insurance Portability and Accountability Act (HIPAA). The law was enacted following the U.S. Supreme Court’s 2022 decision overturning Roe v. Wade, with the intent of shielding individuals seeking reproductive healthcare from potential data tracking.

The law mandates that companies obtain explicit consent before collecting or sharing consumer health data and grants individuals the right to sue for violations. Critics have warned that the law could lead to an increase in litigation, but this case is the first to invoke its protections.

Amazon Denies Wrongdoing

Amazon has denied the allegations, stating that it does not collect consumer health data as defined under the Washington law. A company spokesperson defended Amazon’s practices, saying:

“Our agreements with publishers prohibit them from sending us any information that could be considered Consumer Health Data under WA's My Health My Data Act, and we have long prohibited publishers from sending us precise location and biometric data [...] If they do accidentally send us this information, we immediately discard and do not use it.”

Despite Amazon’s assurances, the lawsuit contends that the company’s data collection practices amount to deceptive and unfair business conduct under the state’s Consumer Protection Act.

Broader Legal Implications

In addition to Washington’s health privacy law, the lawsuit alleges violations of the Federal Wiretap Act, the Stored Communications Act, and the Computer Fraud and Abuse Act. Legal experts suggest that the case could set a precedent for how companies handle consumer health data nationwide.

If found liable, Amazon could face significant financial penalties. Washington’s law allows for penalties of up to $7,500 per violation, and the plaintiffs seek monetary damages, injunctive relief, and attorney’s fees.

As the first major legal challenge under Washington’s My Health My Data Act, the lawsuit against Amazon will likely influence future debates on digital privacy and consumer rights in the tech industry.