State Consumer Health Data Laws and Pharma Media

Five years ago, a DTC planner could treat "privacy" as a HIPAA question with a short answer. That is no longer true. A handful of states now have laws aimed squarely at consumer health data held outside HIPAA, and comprehensive state privacy laws treat health information as sensitive. This article summarizes the laws media teams hit most often and what usually has to change. It is hedged on purpose: this area moves quickly, and none of this is legal advice.

Why state health privacy laws matter more than HIPAA for most brand media

As covered in HIPAA and pharma advertising, manufacturers are usually not HIPAA covered entities. The data behind most DTC targeting (consumer segments, contextual signals, location, site visitors) was never PHI. State consumer health data laws were written for exactly that gap. They define health data broadly, apply to companies regardless of HIPAA status, and in Washington's case allow private lawsuits.

The main state consumer health data laws

This table reflects my understanding of the laws as of 2026. Effective dates and details should be checked against current text with counsel.

Other states are moving. Several comprehensive privacy laws treat health data as sensitive and require opt-in consent to process it, and Maryland's law, effective in late 2025, is widely described as restricting the sale of sensitive data. In New York, the governor vetoed a broad health information privacy bill in December 2025; a revised version passed both houses in June 2026 and, as of this writing, its fate was not settled. Check the bill's status before planning around it.

What counts as consumer health data

The definitions are where pharma teams get caught. Washington's covers information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status. It lists examples including conditions, treatments, medications, biometric and genetic data, precise location that could indicate seeking care, and data that identifies someone seeking health services. It also includes information derived or inferred from non-health data.

That last clause matters. A segment built from grocery purchases and app usage, labeled "likely type 2 diabetes," can be consumer health data even though no health record was involved. So can a retargeting pool of people who visited a condition page on a brand site. For how these segments are built and where the lines are, see condition and ailment audience targeting.

Consent for collection and sharing

Washington and Nevada require consent to collect consumer health data beyond what is needed to provide the product or service the person asked for, and a separate consent to share it. Selling it requires a signed authorization with specific content. Consent has to be freely given, specific, and informed; a pre-checked box or a general cookie banner is unlikely to be enough.

In media terms, "sharing" can include sending health-related browsing data to an ad platform through a pixel, or passing a condition audience to a DSP. Many brands have concluded that obtaining compliant consent for every such flow is impractical and have changed the flow instead: removing third-party ad tags from condition pages, moving to contextual targeting, and using aggregated or clean room measurement. That is a business decision for the brand, made with counsel.

Geofencing near health facilities

The geofencing provisions are the clearest bright lines. Washington, Nevada, and Connecticut prohibit setting virtual boundaries around covered health facilities to identify or track people, collect their health data, or send them health-related ads. In Washington and Nevada, consent does not cure it.

Practical effects: no location-based targeting around clinics, pharmacies that provide in-person care, hospitals, or specialty centers in those states, and no "visited an oncology center" audiences built from location data for those areas. Ask vendors how their location segments are built and whether facility-adjacent signals are excluded by state. Some national location vendors have restricted these segments; others leave it to the buyer. The questions in health data provenance vendor questions are a good starting point.

What pharma media teams usually have to change

1. Inventory every audience segment and tag a health inference or condition flag on each.
2. For each flagged segment, document the data source, how consent was obtained, and which states it covers.
3. Exclude or geo-restrict location tactics near health facilities; confirm vendors apply the exclusion.
4. Remove or gate third-party ad and social pixels on condition, symptom, and savings pages until consent is in place. See tracking pixel governance.
5. Honor opt-out preference signals such as Global Privacy Control where state law requires it.
6. Add state law representations to data contracts and require notice if a vendor changes sourcing.
7. Re-review when a new state law takes effect, not just at campaign kickoff.

Practical takeaway

Run a one-hour session with your privacy lead on your top three DTC audiences and your geo tactics. For each, answer two questions: would this count as consumer health data in Washington, and what consent backs it? Where the answer is unclear, switch that tactic to contextual or aggregated alternatives until counsel resolves it. The pharma marketing compliance guide shows how this fits with the FDA and FTC rules.

Editorial note. Analysis and frameworks are the author's own and do not represent Acxiom or any current or former employer, client, or named platform. Examples labeled hypothetical or illustrative are not results from real campaigns. Nothing here is legal, regulatory, or medical advice.