Lawsuit against Amazon provides first test of WA's health data privacy law

Yahoo

21-02-2025

()
Amazon faces a potential class-action lawsuit on accusations the company violated a groundbreaking Washington law meant to protect the privacy of consumer health data.
It's the first case of its kind.
The complaint, filed in U.S. District Court in Seattle, alleges Amazon's advertising network, embedded in various phone applications, harvested consumer data without consent. This data, including location information, is then used for targeted advertising, according to the lawsuit.
Passed along party lines with Democratic support in 2023, Washington's My Health My Data Act prohibits this activity. The landmark law aims to safeguard personal health data from being collected without the users' knowledge.
The impetus for the law came from the U.S. Supreme Court's decision overturning Roe v. Wade in 2022. The idea was to protect people coming to Washington from states where they could be prosecuted for seeking reproductive health care. Experts also warned the data collected from period-tracking apps could be used to penalize those seeking an abortion.
But the law is much broader in scope, protecting data the Health Insurance Portability and Accountability Act, or HIPPA, doesn't cover.
Since its passage, other states have considered matching Washington's standard.
'I think most people would want their health data to be private,' said Sen. Vandana Slatter, D-Bellevue, who sponsored the legislation while serving in the state House. She described the law as 'a good step toward protecting Washingtonians, and anyone who would come to visit Washington.'
The legislation, requested by then-Attorney General Bob Ferguson, went into effect last spring. The attorney general's office can enforce violations through the state Consumer Protection Act, or consumers can file suit.
Some critics worried this would lead to frivolous litigation, but the lawsuit filed last week is the first alleging violations of the law.
This lawsuit comes not long after another in California alleged the advertising software gave Amazon 'backdoor access' to data. And yet another, filed in federal court this month in Seattle, with over a dozen plaintiffs from across the country who alleged similar surreptitious data gathering.
'Amazon collected Plaintiff's consumer health data, including biometric data and precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies,' reads the complaint in the new case, filed last week.
A company spokesperson said 'customer privacy is a top priority for Amazon' and denied the lawsuit's allegations.
'Our agreements with publishers prohibit them from sending us any information that could be considered Consumer Health Data under WA's My Health My Data Act, and we have long prohibited publishers from sending us precise location and biometric data,' the spokesperson said. 'If they do accidentally send us this information, we immediately discard and do not use it.'
The lead plaintiff in this case, Cassaundra Maxwell, is from Lake Stevens. Maxwell used the digital marketplace OfferUp and the Weather Channel's app without knowing Amazon collected her personal data while she used them, according to the complaint.
The complaint says thousands of developers have used Amazon's ad tracking software development kits, or SDKs. The lawsuit aims to create a class of plaintiffs made up of users like Maxwell across the United States.
These consumers may consent to giving their data to the app they're using, such as for finding nearby weather updates. But they don't realize Amazon will then have access to that information as well and can monetize it, the lawsuit alleges.
On top of My Health My Data, the lawsuit also alleges Amazon violated the state's Consumer Protection Act and several federal laws, including the Federal Wiretap Act and the Computer Fraud and Abuse Act.
Maxwell's lawyers from Keller Rohrback in Seattle did not respond to requests for comment.