Case analysis · Updated 2026

The Amazon WMHMDA Lawsuit — and Why Small Businesses Must Act Now

February 2025 filing · verified from law-firm and news sources

On February 10, 2025, the first class action under Washington's My Health My Data Act (WMHMDA), RCW 19.373, was filed against Amazon (Maxwell v. Amazon, U.S. District Court, Western District of Washington). The complaint alleges Amazon improperly accessed and monetized health-related data collected through location-based mobile apps — data flowing through Amazon's advertising SDK.

What the lawsuit alleges

According to the law firms tracking the case, the complaint centers on three core WMHMDA violations:

• Collection without consent: health and health-related location data allegedly collected through app SDKs without the opt-in consent WMHMDA requires before any collection or sharing.
• No posted policy: failure to post a Consumer Health Data Privacy Policy describing categories of data collected, purposes, and categories of third parties shared with — a specific WMHMDA disclosure duty.
• Selling/sharing without valid authorization: alleged sale or sharing of consumer health data without a separate, valid authorization meeting the statute's requirements.

Notably, the claims are based on health-related precise location data — data that can reveal visits to fertility clinics, urgent care, and other sensitive places even when the app collecting it has no obvious health purpose.

The key lesson for small businesses

The plaintiffs' bar targets big names first. But WMHMDA's private right of action applies to every regulated entity — there is no revenue threshold, no employee count, and no "small business exemption." Consumers can sue directly for actual damages, and courts may award statutory damages up to $25,000 plus attorney fees. Washington's Attorney General can separately seek civil penalties of up to $7,500 per violation.

Solo founders running a fitness app, a wellness service, or even a website that logs sleep or nutrition data are regulated entities under the statute. Enforcement has started; the question for most small businesses is no longer whether they must comply, but whether their paperwork is ready when asked.

The 5 obligations every regulated entity has now

1. Post a Consumer Health Data Privacy Policy with the required disclosures (categories collected, sources, purposes, third parties shared with, and consumer rights).
2. Obtain opt-in consent before collecting or sharing consumer health data — separate from general terms of service.
3. Get a valid authorization before any sale of consumer health data, including a purchaser list and revocation language.
4. Honor consumer rights requests — confirm collection, access, deletion, withdrawal of consent, and a list of third parties with whom data was shared or sold.
5. Maintain a retention and disposal schedule, and instruct third parties to delete data when retention ends.

Case status (honest note)

As of the latest review, Maxwell v. Amazon remains in litigation. Case status can change quickly — motions, rulings, and settlement developments appear throughout 2025–2026. Monitor law-firm analyses for updates, and note that regardless of how this specific case resolves, the statute's private right of action and AG enforcement authority are already in force. Compliance is not dependent on this lawsuit's outcome.

FAQ