• by Wendy Davis , Staff Writer @wendyndavis, April 19, 2023

Companies may soon be prohibited from using geotargeting techniques to send ads to anyone within 2,000 feet of facilities providing health care services in Washington state.

That restriction is one of several new privacy provisions in the state's sweeping My Health My Data bill, which was passed last week and is awaiting Governor Jay Inslee's signature. If enacted, the statute is expected to take effect for most companies in March of 2024.

The privacy bill appears largely driven by last year's Supreme Court decision in Dobbs (which paved the way for states to outlaw abortions), as well as current efforts in some states to restrict gender-affirming care for transgender patients. Supporters, including the ACLU of Washington, called the act “a critical step towards defending and expanding access to abortion and gender affirming care in Washington state.”

But the prohibition on geotargeted messaging, combined with the bill's broad definition of health care, could affect a wide swath of companies that might want to send messages unrelated to abortion or transgender medical care, according to Mike Hintze, former chief privacy counsel for Microsoft.

“The prohibition on geofencing could apply to a very wide range of businesses and common business activities,” he writes. “For example ... a grocery store that offers nutrition tips could be providing 'health care services' and that store’s loyalty club app that offers coupons when entering the store could, therefore, be seen as violating this prohibition.”

In addition to the ban on geotargeted ads, the bill also prohibits companies from using location-tracking technology within 2,000 feet of a health care center in order to identify consumers, or to collect health data.

Other provisions prohibit website operators and app developers from sharing health information without people's explicit consent.

While My Health My Data may well be the broadest privacy law to date, Washington isn't the first to tackle geotargeted ads.

In 2017, Massachusetts Governor Maura Healey, then serving as attorney general, sued Copley Advertising for allegedly violating a state consumer protection law by using geotargeting techniques to send anti-abortion ads to smartphones of women who visited reproductive health clinics.

Copley settled the charges by promising to refrain from using geofencing techniques to infer health information about anyone near a medical center in Massachusetts.