For businesses outside Washington State · Updated 2026
Does WMHMDA Apply to Businesses Outside Washington?
WMHMDA is frequently confused for a law that only applies to Washington-based companies, the way some state employment or tax laws work. It doesn't work that way. The statute is triggered by whose data you collect and what kind of data it is — not by where your headquarters, servers, or incorporation documents are located. A company based in Texas, California, or another country can be squarely within scope the moment it has Washington consumers.
In short: Your company's location is irrelevant — WMHMDA applies based on whose data you collect (Washington residents) and what kind of data it is. Geo-blocking other states doesn't cover Washington unless you specifically block it too. Check your applicability below.
Read the full breakdown
The actual test, in plain language
- Do you collect or process personal information?
- Could that information be linked to a consumer and reveal something about their physical or mental health status?
- Do you determine the purpose and means of that processing (rather than simply processing on someone else's behalf)?
- Do any of your consumers reside in Washington State, or is the processing otherwise connected to conducting business in Washington?
If the answer to all four is yes, physical location is irrelevant. See the full test on our applicability page.
Example: a Texas-based supplement brand selling nationwide via Shopify
A supplement company headquartered and incorporated in Texas, with no employees or offices in Washington, sells nationally through a Shopify storefront and collects quiz answers about customers' health goals and conditions to recommend products. Because the storefront is open to Washington residents and the health-related quiz data is collected from them, this company is within WMHMDA's scope despite having zero physical connection to the state. It needs the same privacy policy, consent flow, and rights-request process as a Washington-based competitor.
Common (incorrect) assumptions we see
- "We geo-block California and the EU for privacy laws, so Washington is covered too." — Not unless you've specifically geo-blocked Washington as well.
- "We only have a handful of Washington customers, so the risk is too small to matter." — Volume isn't part of the applicability test, and enforcement doesn't require a minimum number of affected consumers.
- "Our terms of service say Delaware law governs, so Washington law doesn't apply." — Choice-of-law clauses in your own terms don't override a state's statutory consumer-protection reach.
"Then can we just block Washington?"
It's the natural next question, and it's a fair one — sometimes blocking genuinely is the right call. But state-level geo-blocking is leakier than country-level blocking, it forfeits a market of roughly 8 million people, and it does nothing about data you've already collected. We've written an honest breakdown of when it works and when it doesn't: should I block Washington users?
If you have a physical location in Washington, read this too
Everything above concerns applicability, which doesn't depend on where you are. But enforceability does. A business with premises, staff and assets in Washington is far easier to serve and collect against than one with no US presence — which makes multi-site operators a more realistic defendant than a larger overseas company doing the same thing. See WMHMDA for multi-location & franchise businesses.
Confirm your exposure in under two minutes
Run the free applicability check to see whether your out-of-state business is in scope, then generate matching documents if you are.
Check My Applicability — FreeLegal limitations
Jurisdictional reach for state privacy statutes is a genuinely unsettled area of law in some fact patterns, particularly around what counts as "conducting business in Washington." This page explains the general framework, not a jurisdictional legal opinion for your specific situation — consult an attorney if your business has a close or contested case.
FAQ
Do we need to be headquartered in Washington for WMHMDA to apply?
No — applicability turns on whose data you process, not where your company is based.
We have no physical presence in Washington — are we exempt?
Not automatically — if Washington consumers use your product and you collect health-revealing data, you can still be in scope.
How do we know if we have Washington consumers?
Check your analytics for Washington-based traffic or sign-ups, especially if your product is available nationally without geo-restriction.
Does wmhmda or mhmda apply to an international company with U.S. customers?
Yes, if Washington residents are among those customers and health-revealing data is collected from them.