The Pixel Problem: Advertising Triggers Health Data Obligations For Medical Aesthetic Practices

Highlights

• Medical aesthetic practices routinely deploy digital advertising tools that collect and share consumer health data at every stage of the patient journey, from internal website visits to before-and-after photo galleries.
• Washington's My Health My Data Act, along with the Federal Trade Commission (FTC) Act and Health Breach Notification Rule and consumer health data laws in California, Connecticut, Nevada, Maryland and Texas create overlapping obligations that apply to aesthetic providers regardless of whether they are classified as HIPAA-covered entities or business associates.
• Enforcement is accelerating simultaneously from the FTC, state attorneys general and private plaintiffs.
• Washington's attorney general has identified weak consent mechanisms, deceptive cookie banners and overcollection of sensitive data as core enforcement priorities in the state's first-ever Data Privacy Report.

This Holland & Knight alert summarizes the findings and recommendations in Washington's inaugural Data Privacy Report, maps the overlapping federal and state obligations onto six stages of the typical aesthetic practice's digital marketing workflow – from website pixel firing through before-and-after photo galleries and social media engagement – and provides a prioritized compliance checklist addressing the highest-risk gaps across all applicable regimes.

This is the third installment in Holland & Knight's series providing practical compliance guidance for medical spas and practices in the medical aesthetics industry, following "Medical Spa Compliance Under the Microscope," August 5, 2026, and "Key Considerations for Acquirers Entering the Peptides and Wellness Business," August 10, 2026.

Washington AG's August 2026 Data Privacy Report

On August 14, 2026, Washington Attorney General (AG) Nick Brown released the first-ever Washington State Attorney General's Data Privacy Report. It identifies four recurring concerns in the modern data economy: 1) overcollection and secondary use, 2) weak consent requirements and deceptive design, 3) collection and sale of sensitive data, and 4) limited consumer visibility into data broker practices. It also presents policy, enforcement and education recommendations aimed at strengthening protections for Washingtonians' personal information.

Pixels, Cookies and Online Tracking

The report describes how personal information flows through the data economy via tracking technologies. A person's browsing activity may be combined with demographic and behavioral information to place them into audience segments based on age range, affluence, online activity or family status, which are then used to target advertisements across websites and apps. Data brokers profit by combining information from data collectors, public records, social media and other sources, then selling or licensing access to consumer profiles and audience segments.

The report emphasizes that 62 percent of surveyed Washingtonians said it was difficult or very difficult to opt out of targeted advertising. Among the report's education recommendations, the AG's office commits to creating plain-language public resources on topics including "understanding tracking cookies" and "recognizing deceptive design practices."

Informed Consent to Collect Information

Informed consent is a central theme of the report, which defines it as a standard requiring "clear information, plain language, a voluntary choice, and a reasonable opportunity to decline" and emphasizes that consent is not considered informed "simply because a person clicked a button or agreed to a lengthy privacy policy."

Key survey findings on consent include:

• 95 percent of respondents said there was no circumstance in which they would be comfortable having their personal information collected, shared or sold without informed consent.
• Only 47 percent of respondents said they had never given informed consent to an institution collecting, sharing or selling their personal information; another 25 percent were unsure.
• 83 percent of respondents felt they had little or no control over who has access to their personal information.

The report's first policy recommendation calls on the state legislature to require data collectors to obtain "meaningful and informed consent" for all sensitive data before collecting, using or sharing personal information beyond what is reasonably necessary. It also recommends explicitly prohibiting deceptive design practices – such as cookie banners making "accept all" prominent and easy while burying the option to reject tracking – that steer consumers toward sharing more data than they intend. The report cites California, Connecticut, Oregon and Colorado comprehensive privacy laws – not health-data-specific statutes – as models for future Washington legislation.

Sharing Health Information and the My Health My Data Act (MHMDA)

The report highlights the MHMDA (Ch. 19.373 RCW), signed into law on April 27, 2023, as one of Washington's key targeted privacy statutes while underscoring that Washington's protections for sectors outside consumer health data remain fragmented.

The MHMDA applies to businesses that operate in Washington or target Washington consumers and collect, share or sell "consumer health data." "Consumer health data" means personal information linked to a person's physical or mental health status, diagnoses, medications or health-related location data. Consumer health data excludes protected health information (PHI) regulated under HIPAA or healthcare information covered under Washington's Health Care Information Act (Chapter 70.02 RCW). Information used in digital advertising – such as treatment inquiries, intake details, patient photos, booking and scheduling metadata, browsing that shows interest in a specific treatment, loyalty and rewards program data revealing treatment history, biometric data, location showing health-service seeking, and data derived or inferred from non-health data – is covered under the MHMDA.

The MHMDA requires covered entities to:

• Ask Before Collecting or Sharing. Get separate opt-in consent for collection and for sharing; one combined cookie banner is not enough.
• Post a Separate Health-Data Privacy Policy. Link it from the homepage; a general privacy policy alone is not enough.
• Do Not Geofence Healthcare Facilities. Keep geofenced ads and messages at least 2,000 feet away; consent does not make a prohibited geofence lawful.
• Get Written Authorization Before Selling Data. The authorization must be a stand-alone document – separate from collection or sharing consent – containing all nine statutory elements: 1) the specific consumer health data to be sold, 2) the seller's name and contact information, 3) the purchaser's name and contact information, 4) the purpose of the sale and how the data will be used by the purchaser, 5) a statement that goods or services may not be conditioned on signing, 6) a statement of the consumer's right to revoke and how to do so, 7) a redisclosure warning, 8) an expiration date no later than one year from signing, and 9) the consumer's signature and date.
• Honor Access and Deletion Requests. Respond within 45 days.

Each violation of the MHMDA automatically counts as a Washington Consumer Protection Act violation. The AG and private plaintiffs can sue; remedies may include actual damages, attorneys' fees and up to $25,000 in treble damages per violation.

The report further underscores the sensitivity of health-related data by citing Federal Trade Commission (FTC) enforcement actions against data brokers Kochava and Mobilewalla. The FTC alleged that Kochava sold location data capable of identifying visits to reproductive health clinics, places of worship and domestic violence shelters. The Mobilewalla complaint alleged the company helped clients target pregnant women and other groups through custom audience segments.

Since the MHMDA's substantive requirements took effect in 2024, private plaintiffs have begun testing the law through class-action litigation. The first MHMDA private action was filed in February 2025, and additional private lawsuits asserting MHMDA claims have followed.

FTC Enforcement Over Pixels

The Washington AG report follows enforcement by the FTC for the unauthorized sharing of health information with third-party advertisers.

In July 2026, the FTC, joined by the Utah Division of Consumer Protection and People of the State of California (through Los Angeles County Counsel), filed a complaint against Hims & Hers Health Inc., alleging, among other things, that the company sent sensitive treatment data – including information about erectile dysfunction, hair loss, weight loss, anxiety and depression treatments – and named customer lists to advertising platforms through pixels and tracking technologies. The FTC's theory was that Hims & Hers' privacy policy promised not to share health information with third parties for advertising, but the company's deliberate pixel configuration contradicted that representation, making the disclosures deceptive under Section 5 of the FTC Act. California and Utah assert parallel claims under state consumer protection statutes based on the same health data sharing conduct.

The FTC previously settled with four other companies between 2023 and 2024 – with monetary penalties ranging from $100,000 to $7.8 million – for alleged violations of Section 5 of the FTC Act and, in some cases, the FTC Health Breach Notification Rule for sharing personal health information with advertising platforms through pixels, software development kits (SDKs) and other tracking technologies in a manner that contradicted the companies' privacy representations to consumers.

Multistate Consumer Health Data Laws

California, Connecticut, Nevada, Maryland and Texas also have consumer health data laws. Each may be enforced only by the AG in that state; there is no private right of action. Connecticut has been particularly active, issuing dozens of notices of violation and information requests under the Connecticut Data Privacy Act. Similarly, California has secured multiple California Consumer Privacy Act (CCPA) settlements targeting tracking-technology-based data sharing

The table below summarizes the consumer health data laws in these states.¹

The Patient Journey: Where the Risks Arise

The regulatory frameworks described above converge at each step of the typical medical aesthetic practice's digital marketing workflow, creating overlapping obligations that vary depending on the activity involved.

Step 1: Website, App and Patient Portal Activity

Tracking pixels begin collecting and transmitting browsing behavior – including the URL visited, time on page and device identifiers – to advertising platforms the moment a visitor lands on a treatment page. Under the MHMDA, browsing data that reveals interest in a specific health condition constitutes consumer health data requiring separate opt-in consent before collection. The FTC Act is implicated if a privacy policy represents that health information is not shared with third parties, but pixels transmit page-view data to ad platforms. The FTC treats this as a deceptive practice under Section 5. The FTC Health Breach Notification Rule may also apply if page-view data constitutes personal health record identifiable health information disclosed without authorization.

The same analysis applies to SDKs and analytics tools embedded in patient-facing mobile apps and patient portals – these technologies collect the same categories of health-related browsing and interaction data as website pixels, but cookie-based consent mechanisms do not apply to native apps, requiring app-specific consent flows.

Maryland prohibits the sale of sensitive data outright – including transmitting consumer health data to an advertising platform in exchange for audience targeting or conversion optimization services, which constitutes a sale under MODPA regardless of consent – and separately requires consent to collect, process or share sensitive data. Connecticut, Nevada and Texas require consent before processing or sharing consumer health data. Texas additionally provides opt-out rights for sales and targeted advertising. California requires businesses to honor consumer requests to limit use of sensitive personal information and to comply with opt-out obligations for sharing data with ad platforms.

Step 2: Intake Forms and Photos

When a patient enters treatment goals or medical history or uploads photos, the data is unambiguously health information. The MHMDA requires separate opt-in consent for collection of this consumer health data and separate consent for any sharing. Under the FTC Act, if a practice's privacy policy promises to keep this information confidential, but tracking technology embedded on the same page (or firing across the site) transmits it to ad platforms, the FTC treats the disclosure as deceptive under Section 5. The FTC Health Breach Notification Rule covers unauthorized disclosures of identifiable health information to advertising platforms and requires notification to affected consumers and the FTC.

Connecticut, Nevada and Texas require consent before processing such data; Texas also requires data protection assessments. California requires businesses to honor requests to limit use and opt-out requests for sharing with ad platforms.

Step 3: Bookings and Consultation

When a patient books an appointment – whether through an online scheduler, a third-party booking platform or patient portal – the resulting data trail includes the type of treatment sought, appointment timing and often precise geolocation. Under the MHMDA, booking activity, geolocation data and scheduling metadata constitute consumer health data subject to consent, privacy policy and geofencing requirements – including the prohibition on geofences within 2,000 feet of healthcare facilities, regardless of consent. Nevada's broad definition extends to booking metadata that reveals health-service seeking, as it covers precise geolocation indicating health-service seeking and data derived or inferred from non-health data.

Connecticut, Maryland and Texas do not specifically classify booking metadata as sensitive data standing alone, but it may trigger consent requirements under each state's framework if combined with other data to reveal health status (e.g., a booking for "lip filler consultation" paired with the patient's name and email address). California independently classifies precise geolocation as sensitive personal information – regardless of health context – triggering the right to limit use and disclosure. Scheduling data that reveals health status may independently qualify as sensitive personal information, imposing the same obligations.

The FTC Act and Health Breach Notification Rule analysis described in Steps 1 and 2 applies equally where tracking pixels fire on booking or scheduling pages, transmitting appointment data to ad platforms.

Step 4: Pixels, Retargeting and Third-Party Data Sharing

When a practice uses patient data to build custom audiences, run retargeting campaigns or share conversion data with advertising platforms, it is sharing consumer health data with third parties. Sharing consumer health data with ad platforms for custom audiences or retargeting requires separate MHMDA sharing consent obtained independently of, and in addition to, the opt-in consent previously obtained for collection. Under the FTC Act, if a privacy policy contradicts actual pixel behavior, the FTC's Section 5 deception theory applies, and the FTC Health Breach Notification Rule requires consumer notification if retargeting involves unauthorized disclosure of identifiable health information.

Other state laws impose overlapping obligations. Maryland prohibits the sale of sensitive data outright – including transmitting consumer health data to an ad platform in exchange for advertising services – regardless of consent. Connecticut and Nevada require consent for processing or sharing consumer health data, with Nevada additionally requiring written authorization before any sale. California and Texas each provide opt-out rights for sales and targeted advertising; Texas also requires consent before processing sensitive health data and mandates data protection assessments for sensitive data processing and targeted advertising.

Loyalty and rewards programs create additional obligations. Enrollment and redemption data reveal treatment history (e.g., which injectables a patient has received, how frequently and at what intervals), constituting consumer health data under the MHMDA. Sharing this data with a manufacturer's marketing platform – which occurs automatically in most loyalty program integrations – triggers the MHMDA's separate sharing consent. Maryland's sale prohibition likely bars these arrangements where a manufacturer receives valuable consideration for patient data. California and Texas require consent or opt-out compliance for sharing loyalty program data revealing health information, and Texas requires processor contracts with loyalty program vendors governing data use, confidentiality and deletion.

Step 5: Marketing Texts, Emails and Chatbot Messages

Practices frequently use patient data to trigger outbound marketing – text messages promoting services a patient browsed, emails following up on incomplete bookings or chatbot responses personalized to a patient's treatment history. Health-data-triggered marketing (e.g., retargeting a patient who browsed Botox pages with a text message or email) requires consent in Washington, Connecticut, Nevada, Maryland and Texas for the underlying data use that triggers the communication and California's opt-out compliance obligations. The MHMDA's geofencing prohibition bars geofence-triggered messages within 2,000 feet of healthcare facilities – consent does not cure this prohibition. Automated chatbots and artificial intelligence-driven messaging tools that use health-related browsing or intake data to personalize responses or recommend treatments present the same risk – the data use that shapes the message, not the message itself, is what triggers state sensitive-data obligations.

Uploading patient segments to an email or SMS marketing platform – for example, a list of patients who received Botox in the past six months – constitutes sharing consumer health data with a third party under the MHMDA, requiring separate sharing consent. The vendor relationship should also be covered by a data processing agreement limiting how the platform may use, retain or disclose the data.

Separately, the TCPA and CAN-SPAM Act impose independent requirements on marketing texts and commercial emails – including prior express written consent for automated texts and functioning opt-out mechanisms for emails – that apply regardless of whether health data triggers the communication.

Step 6: Before-and-After Photos and Social Media Engagement

Patient photos are consumer health data under the MHMDA because they are linked to a consumer and reveal physical health status, treatment or health-service seeking. The MHMDA requires separate opt-in consent for collection and sharing and written authorization containing nine required elements before any sale of this data. Pixels on photo gallery pages trigger the MHMDA's separate sharing consent requirement if they transmit viewing behavior to ad platforms, and Connecticut, Nevada, Maryland, California and Texas consumer health data laws apply to the extent photo data is processed as sensitive health data for advertising purposes.

Social media engagement creates additional exposure. When a practice likes, comments on or reshares patient-tagged posts revealing treatment information, the interaction may constitute unauthorized disclosure under the MHMDA, and platform tracking tools transmit engagement data to advertising networks, triggering sharing consent requirements. Texas requires consent before processing such data and provide targeted-advertising opt-out rights; California treats it as sensitive personal information subject to sharing opt-out obligations.

Compliance Priorities

The following action items address the compliance gaps most likely to generate enforcement exposure or private litigation for medical aesthetic practices across all applicable regulatory regimes:

1. Audit All Tracking Technologies. Identify every pixel, SDK, analytics tool and embedded third-party script firing across your website, patient-facing apps, patient portals and social media profiles. For each, determine what data it collects, where it sends that data and whether it fires before consent is obtained.
2. Publish a Stand-Alone MHMDA Privacy Policy. For MHMDA-covered businesses, create a separate Consumer Health Data Privacy Policy (distinct from your general privacy policy) that discloses the categories of consumer health data collected, the purposes for collection, categories of third parties with whom data is shared and how consumers can exercise their rights. This must be prominently linked from your homepage and any page where consumer health data is collected. California's CCPA/CPRA, Texas' TDPSA, and Maryland's MODPA each require privacy notices covering data categories, processing purposes, consumer rights and third-party sharing – and must address sensitive data processing – but none mandates a separate health data policy.
3. Block Pre-Consent Firing. Configure your consent management platform (CMP) so that no tracking pixels, analytics tags or advertising scripts execute before the user provides affirmative opt-in consent. This means implementing a tag management system that suppresses all nonessential tags until consent is recorded. For native mobile apps and patient portals where cookie-based consent mechanisms do not apply, implement app-specific consent flows that meet the same opt-in standards.
4. Condition or Remove Tracking on Sensitive Pages. Even if sitewide pre-consent blocking is implemented, specifically verify that treatment description pages, intake forms, booking pages, photo galleries and patient portal screens have no tracking technologies that bypass or predate your CMP configuration. Pages describing specific treatments (e.g., Botox, fillers, body contouring) generate browsing data that constitutes consumer health data under the MHMDA – and because tracking technologies transmit that data to third-party ad platforms, both the MHMDA's collection and sharing consent requirements may be triggered even without an intentional retargeting campaign. Connecticut, Nevada and Texas impose similar consent requirements; Maryland's sale prohibition may apply if pixel data flows to ad platforms in exchange for advertising services.
5. Implement Opt-In Consent Mechanisms. The MHMDA requires separate opt-in consent for data collection and a separate, distinct opt-in consent for data sharing. Each consent must clearly and conspicuously disclose the categories of health data involved, specific purposes for the collection or sharing, and categories of entities with whom data will be shared. Cookie banners that bundle consent for collection and sharing are insufficient under MHMDA. Several other state laws also require opt-in consent before processing sensitive data, including health information – notably Connecticut, Nevada and Texas. Even where not statutorily required, obtaining informed opt-in consent before collecting or sharing health data remains a best practice and may be necessary to avoid FTC Act unfairness or deception claims.
6. Verify Vendor Data-Processing Agreements. Every vendor with access to patient data –including ad platforms, CRM providers, scheduling software, email marketing services, analytics tools and loyalty and rewards program administrators – needs appropriate contractual data-processing safeguards. Even if your practice is not a HIPAA-covered entity, a business associate agreement or equivalent data-processing agreement is essential because it contractually limits how the vendor may use, retain and disclose health data; requires the vendor to implement administrative, technical and physical safeguards; and obligates the vendor to return or delete data upon termination. Without these agreements, the practice has no contractual mechanism to prevent a vendor from using patient health data for its own purposes – such as building advertising profiles or audience segments – which is precisely the conduct the FTC has targeted in its enforcement actions.
7. Audit Geofencing Practices. Review all location-based targeting to confirm no geofences fall within prohibited distances of healthcare facilities under the MHMDA (2,000 feet), Nevada (1,750 feet), Connecticut or Maryland (1,750 feet; limited to qualifying mental/reproductive/sexual health facilities). This audit should cover location data collected through any channel, including mobile apps – not only traditional geofenced ad campaigns.
8. Obtain Stand-Alone Photo Authorizations. Secure separate written authorization for use of patient photos – distinct from intake or treatment consent. Where photos may be sold (e.g., to a stock photo platform or manufacturer), the authorization must meet the MHMDA's nine-element sale authorization requirements under RCW 19.373.070. Authorizations should expressly cover social media posting, resharing and engagement with patient-tagged content, as interacting with such posts may constitute disclosure of health data triggering additional consent requirements.
9. Reconcile Privacy Policies with Actual Tracking Behavior. Ensure your privacy policy accurately and specifically describes what your tracking technology actually does – including which third parties receive data, what categories of data are transmitted and for what purposes. This reconciliation should be repeated at least annually and whenever tracking configurations or vendor relationships change or following any enforcement action, regulatory guidance or settlement involving comparable tracking practices.
10. Honor Global Opt-Out Preference Signals. Even where opt-in consent has been obtained for data collection, a visitor's opt-out preference signal (e.g., Global Privacy Control – GPC) separately requires suppression of the sale or sharing of that data with advertising platforms. California, Colorado, Connecticut and a growing number of other states require businesses to treat these signals as binding opt-out requests. Configure your CMP to treat GPC as a binding directive to suppress third-party data transmission – distinct from, and in addition to, your pre-consent pixel-blocking configuration.
11. Train Staff on Health Data Boundaries. Ensure that marketing teams, social media managers and front-desk staff understand which patient data constitutes consumer health data, which actions trigger consent or sharing obligations and when to escalate to legal counsel – particularly before uploading patient lists, engaging with patient-tagged social content or configuring new advertising campaigns.

The Washington AG's 2026 Data Privacy Report and FTC's action against Hims & Hers reflect converging state and federal enforcement priorities around digital advertising and health data. The regulatory landscape will continue to evolve as more states enact privacy legislation and enforcement agencies sharpen their focus.

Practices should audit their digital marketing infrastructure and work with experienced legal counsel to implement the compliance priorities outlined above. Practices that invest in compliance infrastructure now – robust consent mechanisms, transparent privacy policies, audited tracking configurations and appropriate vendor agreements – will be better positioned to adapt and to avoid the reputational and financial consequences of enforcement actions.

Footnote

1 New York's Health Information Privacy Act (S929/S9269) would define "regulated health information" as any information reasonably linkable to an individual that is collected or processed in connection with physical or mental health – including location data, payment information and inferences drawn from non-health data – and require consent or a designated necessary purpose for processing, along with individual rights to access, correct and delete that information. The original bill (S929) was vetoed by the governor; a revised version (S9269) has passed both chambers and, as of this writing, awaits gubernatorial action.