WMHMDA for Marketing & Ad Agencies

Why "we just run the ads" isn't a full defense

WMHMDA regulates anyone who collects, shares, or sells consumer health data of Washington residents — not just the named brand on a website. When an agency configures a Meta or Google pixel, sets up a CRM integration, or builds a geofenced campaign that receives or generates health-related signals (a "quiz completed: joint pain" event, a retargeting audience built from a symptom-checker funnel, a location-based push near a clinic), the agency is a party to that data flow. Contractual indemnification with the client doesn't change what the statute reaches — it only affects who pays afterward.

Common agency touchpoints that trigger WMHMDA

• Pixel and conversion-tracking setup — configuring events that pass health-condition or symptom data to ad platforms for a health, wellness, or supplement client.
• Custom and lookalike audience building — building retargeting audiences from health-related quiz completions, cart abandonment on condition-specific products, or symptom-checker funnels.
• Geofenced and location-based campaigns — any campaign radius that includes clinics, pharmacies, mental health facilities, or reproductive health providers. See the geofencing ban guide.
• CRM and email-automation integrations — syncing health-related form data (symptom checkers, condition-based lead forms) into marketing automation platforms.
• Analytics dashboard builds — building reporting that segments users by health condition or goal for a client's internal use.

Where agencies get compliance wrong

• Assuming the client's privacy policy covers the agency's work — the agency's own data handling (what it stores, which platforms it shares data to) needs its own accounting, even if the client-facing policy is the client's responsibility.
• Not verifying consent exists before activating a pixel — launching a health-data-adjacent pixel on day one of a campaign, before the client has opt-in consent flows live, creates exposure for both parties.
• Geofencing radius creep — a campaign originally scoped to a shopping mall radius that later gets expanded to "anywhere in the metro area" without re-checking whether it now overlaps a health facility.
• No data processing agreement with the client — without a clear written agreement on who is responsible for consent, disclosure, and deletion requests, both agency and client are exposed with no allocation of responsibility.

Example: an agency running a supplement brand's retargeting campaign

An agency builds a retargeting audience from a supplement brand's "energy and sleep quiz," syncing quiz-completion events (including the health-related answers) into a Meta Custom Audience, and runs geofenced mall-based ads that happen to include a radius overlapping a local urgent care clinic. This agency should: confirm the client has opt-in consent before quiz data reaches the pixel; strip or aggregate health-specific answers before they're passed as ad-platform events where possible; redraw the geofence to exclude health facilities; and put a data processing agreement in place clarifying who handles deletion requests that touch agency-side ad-platform data.