California’s CIPA, originally intended to prevent eavesdropping, has increasingly been used to challenge common website tools such as analytics tags, tracking pixels, session-replay software, and chatbots. Because the law allows $5,000 in statutory damages per violation without proof of actual harm, businesses and nonprofits have faced a sharp rise in website-tracking demand letters and lawsuits.

Washington’s My Health My Data Act is now in effect and significantly expands the scope of regulated information to any “consumer health data” that identifies a consumer's past, present, or future physical or mental health status. The Act has broad applicability for businesses, including non-profits, that offer goods or services to Washington residents, and there is no applicability threshold. Among the requirements is the posting of a separate consumer health privacy notice on the business’s website.