Website privacy law by state

Website privacy law in Washington for medical practices

No comprehensive privacy law Washington has no comprehensive consumer privacy law in effect. That does not mean a practice website in Washington is unregulated: the state wiretapping statute, federal rules, and the law of every state your visitors sit in all still apply.

Attorney review pending. Every statute reference on this page is reproduced from its citation and has not been reviewed by counsel for Consential. It is a description of what exists, not advice about what to do, and it is not a legal opinion about your practice.

What actually applies: the recording and interception statute

This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.

Citation: Wash. Rev. Code § 9.73.060
Consent regime: All-party consent
Private lawsuits: Yes. A private party can sue.
Damages named: Greater of actual damages, $100 a day, or $1,000, plus attorney fees and costs
Observed filing volume: High

Washington pairs an all-party wiretap statute with the My Health My Data Act — the most aggressive combination in the country for a health-related website.

Health data law in Washington

My Health My Data Act (MHMDA)

Citation: Wash. Rev. Code ch. 19.373; remedy via Consumer Protection Act, RCW 19.86.090
Private lawsuits: Yes
Damages named: Actual damages, trebled up to $25,000, plus injunctive relief and attorney fees

Enforced through a private right of action under the Consumer Protection Act. Neither statute provides statutory damages, so a plaintiff must prove actual damages — but 'consumer health data' is defined broadly enough to reach an ad identifier tied to a visit to a treatment page.

Your state is not the only one that applies

Wiretap exposure follows the visitor, not the practice. A Washington practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from Washington wherever your servers are.

Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.

The federal floor

HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.

Neighbouring states

Idaho · Oregon

Sources

Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/

Figures last reviewed July 25, 2026.

Scan your site free Talk to us