Compliance risk · Updated 2026

WMHMDA Penalties: $7,500 Per Violation and Private Lawsuits

Two enforcement tracks under RCW 19.373 — and neither has a small-business exemption

Washington's My Health My Data Act is enforced on two tracks, and every regulated entity — from solo founders to national platforms — is exposed to both.

Track 1: The Washington Attorney General

The state AG can bring enforcement actions and seek civil penalties of up to $7,500 per violation, plus injunctive and equitable relief. Because WMHMDA violations are often treated per-consumer and per-act, a systemic failure — e.g., collecting data from thousands of consumers without consent — can translate into penalties that dwarf the cost of simply having the right documents in place.

Track 2: The private right of action

WMHMDA goes further than most state privacy laws: it creates a direct private right of action. Consumers can sue for actual damages, and law-firm analyses of RCW 19.373 describe statutory damages that can reach $25,000 per violation — with attorney fees recoverable, which is what makes the statute attractive to the plaintiffs' bar. There is no revenue or headcount threshold before this applies to you.

Enforcement has already started

This is not hypothetical. On February 10, 2025, the first WMHMDA class action was filed against Amazon (Maxwell v. Amazon), alleging health-related data collected through app location SDKs without consent, no posted privacy policy, and selling or sharing without a valid authorization. See our Amazon WMHMDA lawsuit analysis for the details — and the lesson for small businesses: plaintiffs' lawyers target big names first, but the law reaches everyone. More cases are expected as the statute matures.

The actual cost of compliance

Lawyers commonly charge $499+ for a memo explaining what WMHMDA requires — before you've drafted a single document. The five documents themselves (privacy policy, opt-in consent, sale authorization, retention schedule, rights form) are what the law actually demands, and they're what your business needs on file the day a request or a demand letter arrives.

FAQ