Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that health information subject to the Washington My Health My Data Act and Nevada Senate Bill 370 is processed by Google with user consent, which users may withdraw, or as otherwise permitted by those statutes.
This analysis describes what YouTube Ads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a consent-based processing framework for health information under two state health privacy statutes and acknowledges a user right to withdraw consent; organizations and individuals using Google services that process health data, including Fitbit, Google Health Studies, and Pixel devices, should be aware of this consent mechanism and the withdrawal right it describes.
The updated policy makes several material clarifications about how Google links your activity across websites and apps. It shifts from describing analytics tools in isolation to framing them as part of a broader 'ad and analytics services' ecosystem, and broadens the scope of data linking to explicitly include 'cookies and other technologies'. The policy also clarifies that data sharing occurs even in private browsing modes. Review your Google Account activity controls to understand what data is being collected and linked across services you use.
View change record →⚠ Health information will be processed with the consent provided at the time of collection until consent is withdrawn by the user
Cross-platform context
See how other platforms handle Health Data Processing Under State Health Privacy Laws and similar clauses.
Compare across platforms →Monitoring
YouTube Ads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The Washington My Health My Data Act and Nevada Senate Bill 370 provide specific rights in addition to those rights above, that apply to health information. When you provide health information subject to these laws, Google processes it with your consent, which you may withdraw, or as otherwise permitted by these laws.Excerpt from YouTube Ads's Google Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages the Washington My Health My Data Act and Nevada Senate Bill 370, both of which impose consent and data minimization requirements on entities that collect consumer health data outside of HIPAA-covered contexts. The Washington Attorney General and Nevada Attorney General are primary enforcement authorities. These statutes apply to a broader category of health data than HIPAA and may cover consumer health information collected through wearable devices and wellness apps. HHS OCR is not directly implicated unless a HIPAA-covered entity is involved. 2. GOVERNANCE EXPOSURE: High for organizations or individuals using Google health-related services in Washington state or Nevada. The consent and withdrawal mechanism described in the policy must be operationally implemented; failure to provide a functional withdrawal mechanism or to honor withdrawal requests within statutory timelines creates enforcement exposure under both statutes. The breadth of health data categories collected, including sleep patterns, heart rate, skin temperature, and blood glucose levels from Fitbit and Pixel devices, increases the surface area of this provision. 3. JURISDICTION FLAGS: Washington state and Nevada create the most immediate heightened exposure under this provision. Other states with pending or enacted health data privacy legislation should be monitored as they may extend similar requirements. For EU and EEA users, health data is classified as a special category under GDPR Article 9, requiring explicit consent and additional safeguards; this provision's applicability to EU users is addressed through separate GDPR mechanisms not fully described in this policy section. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations integrating Google health services or wellness APIs into their own products should evaluate whether downstream health data flows trigger their own obligations under the Washington My Health My Data Act or Nevada SB 370. Service agreements with Google should be reviewed to confirm alignment on data processing roles and consent management for health data. The Google Cloud Privacy Notice should be reviewed separately for cloud-based health data processing. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that consent mechanisms for health data processing are operationally implemented and auditable in Washington and Nevada, and that withdrawal of consent triggers appropriate data processing cessation. Data mapping should distinguish health data categories collected through Fitbit, Pixel devices, and Google Health Studies from other user data categories. Monitoring of additional state health privacy legislation is warranted given the rapidly expanding state legislative landscape described in the policy.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a consent-based processing framework for health information under two state health privacy statutes and acknowledges a user right to withdraw consent; organizations and individuals using Google services that process health data, including Fitbit, Google Health Studies, and Pixel devices, should be aware of this consent mechanism and the withdrawal right it describes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by YouTube Ads.