The first MHMDA private lawsuit names Amazon. The health-data-as-product model just got litigated.
Washington's My Health My Data Act, in force since March 2024, included a private right of action that the regulatory-and-business class had been watching to see when and how the first major plaintiff would deploy it. The February 2025 lawsuit naming Amazon is the first publicly visible test of the private-action provision against a major platform-tier defendant. The substantive allegations involve the company's collection-and-use practices for the health-and-wellness data flowing through its various consumer-facing offerings (the Halo wellness platform before its discontinuation, the Amazon Pharmacy data flows, the One Medical integration, the broader Amazon-Health collection of consumer-health-relevant data).
The substantive merit of the specific allegations will work its way through the courts on the timeline the courts run. The structural significance of the lawsuit is that it exists. The private-action provision in MHMDA, which was the most aggressive enforcement mechanism in the major U.S. state-level health-privacy laws, has now been deployed against a platform-tier defendant with substantial resources and substantial visible consumer-facing health-data exposure. The deployment validates the provision's enforceability and signals to the broader class of potential plaintiffs that the provision can be used.
The implications for the health-data-as-product business model are substantial. The model that wellness apps, fitness trackers, consumer health platforms, and the broader category of consumer-facing health-data companies have been operating against assumed that the health-data-collection-and-use practices would be governed primarily by HIPAA-and-equivalent regulations (which mostly do not apply to consumer-facing wellness products) and by FTC-class privacy enforcement (which has been periodic but rarely existential for the targeted companies). The MHMDA private-action provision changes the enforcement landscape because the plaintiff class is the affected consumer rather than the regulator, with the consequence that the cumulative-litigation exposure can scale faster than regulator-driven enforcement.
The category-level read is that the health-data-as-product model just got priced for litigation risk in a way it had not been before. The companies operating with aggressive data-collection-and-use practices that pre-MHMDA assumed minimal enforcement exposure now face the prospect of class-action and individual-plaintiff litigation that the underlying business model has not been priced against. The cumulative litigation cost across the category, summed across the next 24-36 months, is likely to be substantial. Several of the smaller wellness-app and fitness-tracker companies are likely to be priced out of the litigation-defense category and will either restructure their data-handling practices or wind down.
The investor-class read should adjust accordingly. Companies whose unit economics depended on aggressive health-data collection and downstream-monetization face structural risk that the 2024-pre-MHMDA modeling under-priced. Companies whose product is built around minimal-data-collection or strong-consent-and-deletion infrastructure are differentially advantaged.
For other states watching MHMDA-class legislation through 2025-2026 (California's CMIA expansions, the various proposals in Oregon, Connecticut, Nevada), the Amazon lawsuit demonstrates that the private-action mechanism can be deployed and produces enforcement consequence. The legislative trajectory in other states is likely to accelerate as the MHMDA precedent develops.
The health-data-as-product model is now litigated. The first major lawsuit names a platform-tier defendant. The broader category will absorb the consequences over the next several years, and the operating models that survive the cycle will be the ones that recalibrated for the litigation-risk environment the MHMDA provision created. The pre-MHMDA framing is over. The post-MHMDA framing will keep producing lawsuits as the consumer-class plaintiffs realize the provision is available and as the law-firm class organizes the case-development pipeline. Build for the new framing.
—TJ