Health Privacy Laws Are All Over the Map. Literally.

21 states. 21 different privacy laws. Each with its own rules for how data can be used in advertising — especially health data.

If you're running media campaigns in 2025, that's chaos.

And it's forcing a hard reset on how health audiences are built and used.

A lot of marketers still operate under one assumption: If it's not HIPAA data, we're in the clear.

That's no longer true.

New state laws have filled the gaps HIPAA never covered — and many of them directly regulate:

• Health-related inferences (not just facts)
• The intent behind data use (e.g., using inferences to reveal someone's condition)
• Consumer rights like opt-outs, deletion, and private lawsuits

And unlike HIPAA, these laws don't just apply to providers and payers. They apply to brands, agencies, publishers, platforms — anyone using data in a way that touches sensitive health traits.

A few examples:

• Nevada bans health inferences without consent
• Washington allows any resident to bring legal action
• Connecticut treats data as sensitive based on your intent to understand someone's health
• Maryland has an outright ban on the sale of sensitive data
• Texas is known to aggressively enforce its privacy law
• California has stricter opt-out requirements than most other states

So what's allowed in Texas might be banned in Connecticut. What works in New Jersey could get you sued in Washington.

If you're running a national campaign, that's a compliance nightmare.

Here's the core issue:

Most audience segments were built before California passed the first state privacy law.
They weren't built for:

• Legal scrutiny
• Privacy laws that regulate intent and inferences
• 21 different opt-out requirements

And now? That's catching up to everyone.

The only way forward is to simplify.

To build audiences with:

• ❌ No inferences
• ❌ No modeling
• ❌ No predictions

That's why we're building Blueprint Audiences — to meet the moment with a better foundation.

If you work in health advertising, it's time to re-examine how your audiences are built.

Not just from a performance lens — but from a legal one too.