Unpacking the Pivotal Harvard Law Paper.
Pharmaceutical advertising is undergoing a seismic shift, and Washington State is at the epicenter. A recent paper from Harvard Law has issued a transformative interpretation of a new regulation, Washington’s My Health My Data (WMHMD) Act, which will reshape how the pharma industry applies the law to its advertising strategies. In this post, we’ll unpack the key arguments of the paper, outline its implications for advertisers, and offer actionable recommendations for staying ahead of the curve.
Why Harvard Law’s Paper Matters
Until now, the industry has relied on fragmented interpretations of the WMHMD Act. This law, not designed exclusively for advertising, governs what can and cannot be done with health data. The Harvard paper marks a turning point: for the first time, a credible third party has outlined a legal framework for understanding the WMHMD’s implications for advertising. This isn’t just theoretical; it’s a wake-up call for advertisers who may unknowingly be operating outside compliance within the state and perhaps the entire country.
Breaking Down the WMHMD for Advertising
The WMHMD Act challenges how advertisers, publishers, data providers and platforms handle health data. According to the author, the key areas of concern include:
- Buying, Selling, and Licensing Health Data
Even de-identified data is subject to strict regulation under Section 6 of the WMHMD Act due to the inherent risk of re-identification. This section explicitly outlines that data containing persistent identifiers—Read: advertising IDs—must be handled with the same level of consent and protection as identifiable health data. All stakeholders must recognize that de-identified data, if improperly licensed, bought or sold, can violate compliance standards, emphasizing the need for more robust data handling protocols.
- Processing Health Data
Stakeholders cannot process an individual’s health data without explicit patient consent under the WMHMD Act (Section 3(a)). This provision explicitly requires consent not only for direct usage of health data but also for any inferences drawn or data linked to individuals, including tokenized or pseudonymous identifiers. Without consent, such processing is deemed a violation if the data could reasonably be used to identify a patient, directly or indirectly, through linkage with other datasets. The Harvard paper underscores how advertising IDs—often believed to be anonymized—can be easily re-identified by correlating them with other datasets. This capability transforms what might appear to be de-identified data into actionable individual profiles, violating the principle of patient consent. The paper provides detailed examples of how persistent identifiers are cross-referenced with browsing behaviors, location data, or even device usage patterns, potentially exposing re-identification vulnerabilities in the data.
- Re-identification Risks
The paper highlights how even de-identified data can be re-identified in the advertising ecosystem through persistent identifiers and other techniques. For instance, it references a study where a researcher successfully re-identified the governor of Massachusetts using de-identified health records matched with publicly available data; much less than is widely available within the advertising ecosystem. And once data is re-identified, it falls under the strict controls of WMHMD. This means any processor seeking to share or further process this re-identified data would require explicit consent. This, along with many other examples within the paper illustrates the profound risks associated with de-identified health data linked to advertising IDs.
Recommendations for Advertisers
The Harvard paper outlines actionable steps for advertisers to align with WMHMD compliance, offering a clear framework to address the nuanced challenges of health data governance.
- Housing Data
Avoid storing or relying on partners who store health data for audience targeting without explicit patient consent, even if de-identified. Linking such data to advertising IDs creates significant re-identification risks. Use aggregate statistics instead, which prevent tracing back to individuals. Third-party cleanrooms offer a compliant solution for managing sensitive health data securely while enabling predictive modeling.
- Processing Data
Always obtain user consent before processing individual-level health data. Even tokenized or pseudonymized data carries re-identification risks when combined with other datasets. Focus instead on predictive modeling at the aggregate level, which complies with MHMD standards while preserving valuable insights for campaign strategies.
- Activation
Do not use individual health data linked to advertising IDs, even if de-identified or ‘watered-down’ by lookalike segments, as this violates MHMD. Instead, use aggregate data and predictive modeling to align ads with broader content themes, ensuring compliance and reducing reliance on personal identifiers while maintaining effectiveness.
Predictions For What Comes Next
Washington State’s pioneering efforts are shaping the future of data privacy and advertising regulations. Here are three key predictions for what lies ahead for our industry:
- Even More States Will Follow Washington’s Lead
There is a “Washington Effect” already evident as states like Nevada, Colorado, and Connecticut move to adopt similar measures to regulate health data in advertising. This trend is expected to accelerate as lawmakers across the country recognize that comprehensive privacy protections are a winning position for politicians, regardless of their party affiliation. Data privacy is an issue that resonates with voters across the political spectrum, as consumers universally desire greater control over their personal information. Expect more states to enact similar regulations in the coming months/years.
- Federal Oversight Will Intensify
The Federal government is poised to ramp up its involvement in data privacy, with notable figures like Robert F. Kennedy Jr. emphasizing the need for stricter national standards. Federal legislation could unify the disparate state laws under a cohesive framework, but it would also impose stringent requirements on data handling and processing. This shift could mirror Washington’s rules, making consent-based models and cleanroom technologies essential for nationwide advertisers.
- Measurement Practices Will Face Scrutiny
Starting in January 2025, companies like Meta will implement new data-sharing restrictions for sensitive categories, including health and wellness brands. This move signals a broader industry trend toward evaluating whether existing measurement practices comply with evolving privacy laws. Advertisers will need to scrutinize their analytics and attribution models to ensure compliance while maintaining effectiveness. Innovations in privacy-preserving technologies will be critical to navigating this landscape.
Embracing Innovation
While WMHMD introduces significant challenges, it also paves the way for innovation. Cleanroom technologies, advanced curation, and privacy-first predictive modeling are just a few tools that can help the industry thrive in this new landscape.
This Harvard paper is more than an academic exercise; it is a roadmap for navigating one of the most complex regulatory shifts in advertising history. At BranchLab, we are committed to helping our partners not only comply with these regulations but also harness them as opportunities for innovation and growth.
Ready to future-proof your advertising strategy? Let’s talk