Does geo-blocking Washington actually remove WMHMDA obligations?

Only to the extent the block genuinely prevents you from collecting consumer health data from Washington residents. If your block leaks, and IP-based state blocks commonly do, you may still be collecting data from Washington consumers while believing you are not. You would also still hold historical data collected before the block, which remains subject to obligations for as long as you keep processing it.

How accurate is IP-based state-level geolocation?

Country-level IP geolocation is generally reliable. State-level accuracy is meaningfully lower, and mobile carrier traffic in particular is often attributed to the location of a regional gateway rather than the user. Commercial geolocation providers publish their own accuracy figures, which vary by provider and region. Any state-level block should be treated as substantially effective rather than complete.

Is it cheaper to comply with WMHMDA than to block Washington?

For most small and mid-sized businesses, yes. Blocking has an ongoing engineering cost, an ongoing support cost from false positives, and a permanent revenue cost from lost customers in a state of roughly eight million people. Producing a consumer health data privacy notice, an opt-in consent flow, a sale authorization where relevant, and a rights-request process is generally a one-off project with modest maintenance.

What should I do about Washington data I already collected?

Blocking new signups does not address data already held. Consumer health data you continue to store, use, share or sell remains subject to obligations regardless of whether you are still acquiring new Washington users. Businesses in this position typically either delete the historical data, restrict further processing of it, or bring it under a compliant notice and consent framework.

Straight answer · Updated 2026

Should I Just Block Washington Users?

Q: Can I just block Washington users to avoid WMHMDA?

You can attempt it, and for a small number of businesses it is the right call. In practice, geo-blocking a single US state is harder than blocking a country: IP-based state detection is imperfect, VPNs and mobile networks routinely misreport location, and travellers and relocations create edge cases. Blocking also forfeits the revenue from a state of roughly eight million people. For most businesses the documentation work is cheaper and less disruptive than maintaining a reliable state-level block.

It's a reasonable question, and occasionally the right answer — but it's messier than it sounds

It's one of the first things founders say when they realise WMHMDA might apply to them: "Washington is one state out of fifty. Can't I just turn it off?" It's a rational reaction, not a lazy one. We'd rather give you a straight answer than pretend blocking is never sensible — sometimes it genuinely is.

Short answer: You can try, and for a small minority of businesses it's the right call. But state-level blocking is technically leaky, costs you a market of roughly 8 million people, and does nothing about data you've already collected. For most businesses the paperwork is cheaper than the block. Check if you're even in scope first — plenty of people who ask this question turn out not to be.

First, the honest gate: don't solve a problem you don't have. WMHMDA only applies if you collect data that reveals or allows inference of someone's health status. If you sell project-management software, you're probably not in scope and neither blocking nor documents are needed. Our free 60-second scope check costs nothing and may end this question entirely.

Read the full breakdown

Why blocking one US state is harder than blocking a country

Most teams have blocked a country before — for sanctions, licensing or tax reasons — and assume a state is the same job at smaller scale. It isn't, for a few structural reasons.

IP geolocation is markedly less accurate at state level. Country-level detection is generally reliable. State-level is not equally so, and accuracy varies by provider and by region. You are buying "substantially effective", not "complete".
Mobile traffic is the worst case. Carrier networks frequently route traffic through regional gateways, so a user physically in Seattle can present with an IP attributed to another state entirely — or the reverse, blocking someone who has never been to Washington.
VPNs cut both ways. A Washington resident on a VPN sails through your block. A Denver customer whose corporate VPN exits in Seattle gets locked out of a product they paid for.
People move and travel. A customer who signs up in Oregon and relocates to Washington is now a Washington consumer whose data you already hold. A block at signup doesn't catch this.
Your vendors don't inherit the block. If your analytics SDK, ad pixel or CRM continues receiving data from a user your own front end failed to block, your exposure sits there — not in the page you geo-fenced. See analytics & SDKs.

The costs people forget to count

Blocking looks free because it feels like a config change. It usually isn't.

Lost market. Washington has a population of roughly 8 million, a high concentration of tech-sector and higher-income consumers, and Seattle is a major metro. For a consumer app or DTC brand this is a meaningful revenue line to switch off permanently.
Ongoing engineering. A block isn't ship-once. Geolocation databases need updating, edge cases accumulate, and every new signup path, mobile app, partner integration and marketing landing page has to respect the same rule.
Support load from false positives. Every wrongly-blocked customer is a support ticket, and they arrive annoyed. This cost is recurring and easy to underestimate.
Brand friction. "Not available in your state" reads badly, and people screenshot it. For a health or wellness brand it invites the obvious question of what you're avoiding.

The part that catches people out: historical data

This is the single biggest gap in the blocking plan. Blocking new signups from tomorrow does nothing about the Washington consumer health data already sitting in your database, your backups, your CRM and your analytics warehouse.

Obligations attach to your ongoing processing, so data you continue to hold, use, share or sell remains in scope regardless of whether you're still acquiring new Washington users. A business that blocks and considers the matter closed has usually addressed the smaller half of its exposure. Realistically the options for the historical data are to delete it, to restrict further processing of it, or to bring it under a compliant notice and consent framework — and the last of those is the documentation work you were trying to avoid.

When blocking genuinely is the right call

We're not going to pretend the answer is always "buy our thing." Blocking is a reasonable decision if:

You already geo-restrict for other reasons. If you're licensed per-state, or already blocking states for regulatory reasons, adding Washington is a marginal change to infrastructure you maintain anyway.
Your Washington volume is genuinely negligible and your data is genuinely sensitive. A niche B2B tool with three Washington users, handling detailed mental health information, may reasonably decide the exposure isn't worth the market.
You're pre-launch and deliberately sequencing. Launching in a subset of states while you build compliance properly is a legitimate staging decision, not an evasion.
Your business model genuinely can't comply. If your entire revenue depends on selling health-inferred data in ways the act prohibits, documentation won't fix that — and you need a lawyer, not a template.

The comparison most businesses land on

For a typical app, DTC brand or wellness service, the arithmetic tends to go one way. Blocking is a permanent revenue cut plus a permanent maintenance obligation, and it still leaves your historical data exposed. Documentation is a one-off project — a consumer health data privacy notice, an unbundled opt-in consent flow, a sale authorization if you sell, a retention schedule and a rights-request process — with light ongoing upkeep, and it leaves the Washington market open.

Put bluntly: most people asking "should I block Washington?" are trying to avoid an afternoon of paperwork by permanently closing a market of 8 million people and taking on an ongoing engineering burden. Once framed that way, the answer is usually obvious.

If you do decide to block, do it properly

Should you go ahead, treat it as a real project rather than a checkbox: apply the block at every entry point including mobile apps and APIs, not just the marketing site; decide what happens to existing Washington users already in your system; make sure third-party tags and SDKs stop receiving their data too; document the decision and the date, because "we blocked Washington" is only a defence if you can evidence it; and revisit accuracy periodically as geolocation data drifts. This is worth a conversation with counsel — a partial block that you believe is complete is arguably a worse position than no block at all.

The usually-cheaper path

Answer seven questions and the generator produces your five Washington draft documents — privacy policy, consent form, sale authorization, retention schedule and rights request form. Read every one in full, free, and decide afterwards whether it beats switching off a state. Most people find it does.

Generate My Compliance Pack — $99.99

Not sure you're even in scope? Run the free scope check first →

Scope & limitations of this page

This is general commercial and practical guidance for business owners, not legal advice, and reading it does not create an attorney-client relationship. Whether geo-blocking meaningfully reduces your exposure depends on your actual technical implementation, your data flows and the historical data you hold — none of which we can assess. Geolocation accuracy figures vary by provider and change over time; verify current performance with your own vendor. If you are considering blocking as a compliance strategy, that decision is worth discussing with an attorney licensed in Washington before you rely on it.

FAQ

Can I just block Washington users to avoid WMHMDA?

You can attempt it, and occasionally it's right. But state-level blocking is leaky, forfeits a market of roughly 8 million people, and doesn't address data you already hold. For most businesses the documentation is cheaper.

Does geo-blocking actually remove my obligations?

Only to the extent the block genuinely stops you collecting from Washington residents. Leaky blocks mean you may still be collecting while believing you aren't — and historical data stays in scope regardless.

How accurate is state-level IP geolocation?

Less accurate than country-level, and notably weaker for mobile carrier traffic routed via regional gateways. Treat any state block as substantially effective rather than complete, and check your provider's published figures.

Is complying cheaper than blocking?

For most small and mid-sized businesses, yes. Blocking carries ongoing engineering cost, support cost from false positives, and permanent lost revenue. Documentation is largely a one-off project.

What about Washington data I already collected?

Blocking new signups doesn't touch it. Data you continue to hold, use, share or sell stays in scope — so you'd delete it, restrict processing, or bring it under a compliant framework.

Would blocking hurt my SEO or app store presence?

Not directly in ranking terms, but blocked users who bounce are still users who bounced, and "not available in your state" messaging tends to attract negative reviews and screenshots. It's a brand cost more than a technical one.