Health Data Monetization: Navigating New State Privacy Laws

The digital health field is undergoing a deep transformation, not solely driven by technological innovation, but increasingly by a complex web of state-level privacy legislation. This new regulatory frontier, particularly concerning non-HIPAA-covered health data, is redefining the economics of consumer-facing health applications and forcing a re-evaluation of established revenue models. For compliance officers and growth investors, understanding these shifts is paramount to working through the evolving market and identifying resilient investment opportunities.

The Rise of Non-HIPAA Health Privacy Laws: A New Regulatory Frontier

Historically, the Health Insurance Portability and Accountability Act (HIPAA) has served as the bedrock of health data privacy in the United States. However, HIPAA’s scope is deliberately narrow, primarily covering “covered entities” like health plans, healthcare providers, and healthcare clearinghouses, as well as their “business associates.” This leaves a vast and growing ecosystem of consumer-facing health apps, wellness platforms, and wearable devices operating largely outside HIPAA’s direct purview. These apps often collect highly sensitive health-related information, from mental health symptoms to fertility tracking data, without the same federal privacy protections. This regulatory gap has spurred individual states to act, introducing a new generation of privacy laws designed to protect consumer health data where HIPAA does not. The most impactful of these, and a bellwether for future legislation, is Washington’s My Health My Data Act (MHMD). Unlike broad consumer privacy laws such as the California Privacy Rights Act (CPRA), MHMD specifically targets consumer health data, imposing stringent requirements on its collection, sharing, and sale, even by non-HIPAA entities. This legislative trend shows a critical shift: the monetization of health data, once a relatively unrestricted avenue for many digital health companies, is now subject to increasing regulatory scrutiny and potential restriction. The number of states passing consumer health privacy laws is steadily increasing, creating a fragmented and complex compliance environment for national digital health providers. list of states with consumer health privacy laws

Compliance Challenges for Consumer Health Platforms: Lessons from Talkspace and BetterHelp

The implications of these new state laws are not theoretical. They directly impact the operational and revenue models of prominent virtual care platforms. Companies like Talkspace and BetterHelp, leading providers in the virtual mental health space, have built their businesses on direct-to-consumer models that often involve collecting and processing extensive personal health information. While these platforms may adhere to HIPAA where applicable (e.g., when acting as a business associate to a covered entity), a significant portion of their data collection and processing activities falls outside traditional HIPAA definitions. The Federal Trade Commission (FTC) has been actively monitoring and, in some cases, penalizing consumer health platforms for alleged data misuse. The FTC monitors consumer health platforms like BetterHelp for data sharing practices, reflecting a broader governmental concern about the transparency and consent surrounding sensitive user data. FTC enforcement actions against health apps For instance, the FTC has issued fines against companies for sharing sensitive health data with third parties for advertising purposes without explicit user consent. The FTC, along with state attorneys general, recently filed a complaint against telehealth company Hims & Hers in July 2026, alleging misrepresentation of how it handled consumers’ health information and engaged in deceptive practices, including sharing sensitive health data with third-party advertising platforms without proper consent. These enforcement actions highlight the risks associated with data-sharing partnerships that were previously common practice. Washington’s My Health My Data Act, for example, directly restricts Talkspace’s data collection and sharing practices, particularly concerning the sale of consumer health data and the use of geofencing around healthcare facilities. MHMD’s broad definition of “consumer health data” and its requirement for affirmative opt-in consent for data sharing represent a significant compliance hurdle. For companies operating across state lines, the need to adapt to a patchwork of differing regulations means increased compliance spending estimates for virtual care platforms. This not only adds to operational costs but also necessitates a fundamental re-evaluation of data acquisition strategies and partnership agreements.

Assessing Data Compliance Risk in Consumer Health

For growth investors and compliance officers, the evolving regulatory field demands a rigorous approach to risk assessment. The traditional due diligence checklist, heavily focused on HIPAA compliance, is no longer sufficient. Instead, a more granular analysis is required, considering the implications of each state’s privacy laws on a company’s specific data flows and monetization strategies. Key considerations include:

• Geographic Footprint vs. Data Strategy: How does a company’s user base distribution align with the most stringent state privacy laws? A large presence in states like Washington or California (with its California Privacy Rights Act) necessitates a more conservative data strategy.
• Definition of “Consumer Health Data”: Understanding how each state defines this term is important. MHMD’s definition is particularly expansive, covering a wide range of data points that might not be considered protected health information (PHI) under HIPAA.
• Consent Mechanisms: Are consent mechanisms strong enough to meet the explicit, affirmative consent requirements of new state laws? Generic privacy policies and bundled consent are increasingly insufficient.
• Third-Party Data Sharing: Scrutinize all data-sharing agreements with advertisers, analytics providers, and other partners. The “sale” of data, broadly defined by some state laws, is a high-risk activity.
• Data Minimization: Companies that collect only the data strictly necessary for their core service will face fewer compliance hurdles. A data moat built on proprietary, ethically sourced data is increasingly valuable.
• Customer Acquisition Costs (CAC): Restrictions on targeted advertising, a direct consequence of limited data sharing, can significantly increase CAC. Investors must assess how these localized regulations affect customer acquisition costs and data-sharing partnerships.

The shift towards stricter state-level privacy laws is not merely a legal headache. It’s a market-shaping force. Companies that proactively build privacy-by-design into their products and business models, prioritizing transparency and user control, will gain a significant competitive advantage. Conversely, those relying on opaque data monetization practices face increased regulatory risk, potential fines issued by the FTC, and erosion of user trust. This trend shows the importance of resilient, compliant data strategies as a core component of long-term value creation in digital health.

Methodology and Source Note

This analysis is based on a review of legislative texts, including the Washington My Health My Data Act and the California Privacy Rights Act, as well as publicly available information regarding FTC enforcement trends. Specific data points, such as fines issued by the FTC and compliance spending estimates for virtual care, are derived from verified industry reports and regulatory disclosures. The insights presented are intended to inform compliance officers and growth investors on the impact of evolving privacy regulations on the digital health market.