For Shopify, DTC & retail brands · Updated 2026
WMHMDA for E-Commerce & Retail Brands
E-commerce brands don't think of themselves as health data companies — but a skincare quiz, a supplement recommendation flow, or a loyalty program that tracks health-related purchase categories can all collect consumer health data under WMHMDA. If you sell to Washington residents online, RCW 19.373 applies regardless of where your business is incorporated — see WMHMDA outside Washington for the jurisdiction question.
In short: Health-related product quizzes, condition-based recommendations, and loyalty-program health data collection are all in scope. Watch for third-party marketing pixels receiving quiz answers, and location-based ad targeting near pharmacies or clinics. Generate your documents below.
Read the full guide for e-commerce & retail brands
Where retail and DTC brands collect consumer health data
It rarely looks like a hospital intake form. It looks like a "find your perfect routine" quiz, a "what's your skin type" flow, a supplement questionnaire about sleep or energy levels, or a loyalty program that tags customers by health-related interest category to personalize email offers. Each of these collects information the statute treats the same way it treats clinical data — because RCW 19.373 defines consumer health data by what it reveals about a person's physical or mental health, not by who collected it.
Common retail data flows that trigger WMHMDA
- Product-recommendation quizzes — skincare, supplement, and wellness quizzes that ask about conditions, symptoms, goals, or diagnoses to recommend SKUs.
- Loyalty and rewards programs — purchase-history-based health interest tagging used to personalize marketing.
- Post-purchase surveys — "did this help your [condition]?" follow-up emails that collect health outcome data.
- Marketing and retargeting pixels — Meta/Google/TikTok pixels that receive quiz answers or product-category events tied to health conditions.
- In-store or event geolocation marketing — location-based promotions near pharmacies, clinics, or health facilities.
Where retailers get compliance wrong
- Treating quiz data as "just marketing personalization" — if the underlying data reveals a health condition or goal, WMHMDA's consent and disclosure rules apply regardless of the business purpose.
- Sending quiz or purchase data to ad pixels without a specific opt-in — sending health-related event data to Meta, Google, or TikTok pixels can constitute "selling" or "sharing" consumer health data, which needs a distinct opt-in beyond a general cookie banner.
- Geofencing around pharmacies or clinics for ad targeting — this is explicitly banned; see the geofencing ban guide.
- No process for a Washington customer's deletion request — a consumer can request their quiz answers, purchase-linked health tags, and shared data be deleted, and the retailer needs a real process to honor that within statutory timelines.
Example: a supplement brand with a health quiz and retargeting pixels
A DTC supplement brand runs a "build your stack" quiz asking about sleep, energy, and stress levels, then uses the answers to email personalized offers and feeds quiz-completion events to a Meta ad pixel for retargeting. This brand needs: a privacy policy disclosing the health-related quiz data and the ad-pixel relationship; opt-in consent before the quiz collects any health-related answer; a distinct opt-in covering the pixel/retargeting sharing; and a working process for a Washington customer to request deletion of their quiz history and any shared ad-platform data.
Get compliant documents for your store
The WMHMDA Compliance Pack builds a privacy policy, consent form, sale authorization, retention schedule, and rights form matched to how your quiz, loyalty program, or marketing pixels actually collect and share data. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
Whether a specific quiz question or marketing integration counts as collecting "consumer health data" depends on the exact wording and data flow — this guide describes common retail patterns, not a determination for your specific store. A review of your actual quiz copy, pixel configuration, and loyalty-program data use is recommended before relying on any generated document.
FAQ
Does a Shopify quiz about skin conditions or health goals trigger WMHMDA?
Yes — if it collects health condition, symptom, or goal information to recommend products, that's consumer health data under RCW 19.373.
Do retail loyalty programs need to worry about WMHMDA?
Yes, if the program collects health-related categories or goals to personalize offers, especially if that data is shared with marketing partners.
Is location-based marketing near a pharmacy or clinic a problem?
It can be — WMHMDA's geofencing ban prohibits using location data to target or profile consumers near health-service facilities.
Does this apply to a small Shopify store, not just big retailers?
Yes — there's no revenue or size exemption in WMHMDA; scope depends on what data is collected, not company size.