Amazon Violated Washington State Health Data Law

A proposed federal class action lawsuit claims that Amazon’s software development kit embedded in thousands of third-party mobile applications violates Washington’s My Health My Data Act by unlawfully collecting, tracking and selling sensitive user data – including geolocation information. It’s the first such lawsuit filed since the Washington state’s data privacy law went into full effect last year.

See Also: Top 10 Technical Predictions for 2025

The lawsuit, which also alleges violations of certain federal laws – including wiretap and computer fraud and abuse laws – was filed on Feb. 20 in a Washington state federal court by plaintiff Cassaundra Maxwell on behalf of herself and potentially millions of others similarly situated.

Maxwell, a resident of Washington State, in her complaint said that she is a user of Weather Channel and OfferUp mobile apps on her phone. She claims the apps both have embedded the Amazon Ads Software Development Kit. The lawsuit alleges the SKD is collecting personal data including location data from her phone, without her knowledge or consent. “Amazon then relied on this data for its own personal gain and/or to sell her data to others,” she alleges.

The lawsuit says thousands of developers have integrated the Amazon Ads SDK into mobile apps used by millions of consumers. “On information and belief, Amazon Ads is embedded in more than 10,000 Android and iPhone mobile apps, collectively,” the complaint alleges.

Washington’s MHMD Act provides for a private right of action for violations of the law resulting in consumer harm.

The law also applies to non-residents of Washington state if their consumer data is being collected in the state.

Maxwell alleges, among other claims, that Amazon violated MHMD by collecting consumer’s health data without their consent, including biometric data and precise location information “that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies.”

The lawsuit seeks monetary and non-monetary relief including damages, injunctive relief, civil penalties and attorneys’ fees.

The MHMD Act, which went into effect for larger organizations on March 31, 2024, and smaller entities on June 30, 2024, addresses the collection, sharing and selling of consumer health data that is not covered by HIPAA regulations.

Amazon in a statement to Information Security Media Group denied the lawsuit’s allegations.

“We work hard to earn customer trust, and customer privacy is a top priority for Amazon. These claims are not accurate and we look forward to explaining this in court,” the statement said.

“Our agreements with publishers prohibit them from sending us any information that could be considered ‘consumer health data’ under WA’s My Health My Data Act, and we have long prohibited publishers from sending us precise location and biometric data. If they do accidentally send us this information, we immediately discard and do not use it in any way.”

While similar proposed class action lawsuits have been filed against Amazon and other companies – including Meta and Google – alleging that their software or codes are embedded in websites and mobile apps to track the location and other data pertaining to users without their consent, Maxwell’s lawsuit against Amazon is the first of other class action claims that will likely be filed against other companies alleging violations of the Washington state law.

“The inclusion of the MHMDA is what makes this case stand out from the other pixel/tracker cases,” said privacy attorney Kirk Nahra of the law firm WilmerHale, who is not involved in the lawsuit.

“We expected a meaningful number of lawsuits after the law passed and it is somewhat surprising we hadn’t gotten any until this point. This may be a spark for other MHMDA lawsuits in the future.”

Taking Action

Other organizations that use Amazon SDKs or other tracking type pixels should also watch how developments play out in Maxwell lawsuit against Amazon and take necessary precautions, some experts said.

“Anytime there is a ‘first’ under a law or an initiative, such as the Department of Justice Civil Cyber Fraud Initiative, it is notable,” said regulatory attorney Rachel Rose, who is not involved in the Maxwell lawsuit.

“The fundamental advice is to do a risk analysis to ensure that relevant privacy laws and security laws are being adhered to,” she said. “This means evaluating the consent needed, giving consumers the ability to opt out later once consent is given and not bury these consent issues and terms and conditions in a contract of adhesion or in a small font link at the bottom of a webpage. Ask for express consent, much like visiting a website that sells alcohol.”

Attorney John Howard of the law firm Clark Hill, also not involved in the lawsuit, said the complaint against Amazon has many implications for the healthcare industry.

“The SDK at issue here, while not required to be used to make an app available in the Amazon Appstore, it is required to take full advantage of the different Amazon features, such as in-app purchases, digital rights management, and other functions specific to the Amazon platform,” he said.

“With the very broad definition of consumer health data and personal information under the Washington MHMD Act there will potentially be a lot of other entities that could be at risk of follow-on suits,” he said.

“Additionally, other service providers that create development toolkits for app developers could also be at risk if they do not already have the necessary MHMD compliance mechanisms in place,” he said.

While the Maxwell lawsuit is the first involving MHMD allegations against Amazon, the online retail giant also faces other proposed class action lawsuits in similar cases, including one filed in January in a San Francisco federal court also accusing the company of secretly tracking consumers’ movements through their cellphones, and selling the data it collects via its SDKs.

The latest lawsuit against Amazon also aligns with enforcement cases that the Federal Trade Commission and the U.S. Department of Health and Human Services have pursued for violations of federal regulations such as the FTC Act and HIPAA involving the use of web trackers.

“Companies large and small should be aware of where they are doing business, where their customers are and where the ingress and egress of data occurs,” Rose said. “As part of its annual enterprise risk management strategy, potential liabilities and the ability to survive a lawsuit or government enforcement action should be considered.”