WMHMDA Geofencing Ban Explained: What's Prohibited Around Health Facilities

What the law actually says

RCW 19.373 prohibits any regulated entity or small business from implementing a geofence around an entity that provides in-person health care services where the geofence is used to:

1. Identify or track a consumer seeking health care services;
2. Collect consumer health data from a consumer; or
3. Send a notification, message, or advertisement to a consumer related to their consumer health data or health care services.

The statute specifically calls out mental health facilities and reproductive or sexual health facilities as covered health care facility types, in addition to health care facilities more generally.

What counts as a "geofence" here?

A geofence, in this context, is a virtual perimeter defined around a real-world physical location — typically implemented through GPS, Wi-Fi, Bluetooth beacons, or cell-tower triangulation — that triggers an action (like a notification or a data collection event) when a device enters or exits that perimeter. WMHMDA specifically references a geofence of approximately 2,000 feet from a facility providing in-person health care services as within the scope of this restriction.

Why this specific provision matters so much

This is the provision most likely to be violated unintentionally, because it usually isn't your own code that creates the problem — it's a third-party advertising or analytics SDK bundled into your app that you didn't build and may not have fully audited. The Maxwell v. Amazon complaint, filed February 10, 2025, specifically alleged that health-related location data was collected through app location SDKs without proper consent, tied to geofencing around health facilities — making this the first real-world test of exactly this provision. Read the full breakdown in our Amazon WMHMDA lawsuit analysis.

Real-world scenarios that can trigger this ban

• An advertising SDK in your app triggers a push notification to users who spend time within ~2,000 feet of a reproductive health clinic.
• A location-based marketing platform tags devices that visited a mental health treatment center and later serves them retargeted ads.
• An analytics vendor flags "health facility visit" as a behavioral segment and shares that inference with your business or its partners.
• A loyalty or rewards app collects location pings near hospitals or urgent care centers and uses that to infer a health condition for personalization.

Notice that in every scenario, the business running the app may not have written the geofencing logic itself — it lives inside a third-party SDK. That does not remove liability: if you determine the purpose and means of using that location data (for example, by choosing to integrate that SDK and enabling the feature), you can be treated as the regulated entity responsible for the violation.

How to audit your app or site for geofencing risk

1. Inventory every third-party SDK with location, advertising, or analytics capability — not just the ones you added yourself, but every transitive dependency.
2. Ask each vendor directly whether their SDK implements any geofencing functionality, and if so, whether it can be scoped to exclude health care facility types or disabled entirely.
3. Review your own feature set for any location-triggered notification, messaging, or personalization logic, even if it wasn't built with health facilities specifically in mind.
4. Document the audit as part of your compliance file — this is exactly the kind of internal record a Data Retention & Disposal Schedule (Document 4 of a complete WMHMDA pack) is meant to capture.
5. Disable or reconfigure any feature that could be read as identifying, tracking, or messaging consumers based on proximity to a health care facility.