Amazon is being sued in class action lawsuit for violating health data privacy laws in Washington State

A legal battle is brewing for Amazon in Washington state, with a class action lawsuit under the “My Health My Data” law accusing the tech giant of unauthorized health data tracking through its mobile software development kits (SDKs). This latest lawsuit comes hot on the heels of a federal lawsuit against Amazon in 2023, where the company faced allegations of location tracking concerns amounting to $5 billion in damages.

Washington’s MHMD law, effective since March 31, 2024, mandates that companies adhere to strict consumer health data privacy policies, requiring explicit consent for collecting or sharing consumer health information. Notably, this law permits individuals to sue companies directly for privacy violations, setting Washington apart as one of the few jurisdictions where individuals don’t have to rely on regulatory action for recourse.

At the heart of the lawsuit lies Amazon’s Ads SDK embedded in various mobile applications, allegedly harvesting personal data including location details without the necessary user disclosure or consent. Users purportedly remain uninformed about the SDK’s background operations, lacking the ability to deny access to their data. These allegations echo past privacy concerns raised against major tech companies, including those surrounding biometric privacy.

The crux of the filed lawsuit against Amazon is centered on the accusation of collecting biometric data and precise location information linked to individuals potentially seeking health services or supplies. However, the complaint hasn’t clarified whether this collected data qualifies as consumer health information per MHMD’s criteria, nor has it demonstrated Amazon’s correlation of location data with individual identities or specific healthcare facilities. Recent data breaches, such as the Gravy Analytics incident, underscore the escalating importance of safeguarding location data privacy.

Under MHMD, violations can attract penalties of up to $7,500 for each offense. As the case undergoes review, Amazon is expected to file a motion for dismissal. This legal action signifies a significant trial for Washington’s new health privacy law and could establish crucial precedents for app developers in handling sensitive health-related data.