Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that health information provided by users subject to the Washington My Health My Data Act and Nevada SB 370 is processed by Google with user consent, which users may withdraw, or as otherwise permitted by those statutes.
This analysis describes what YouTube Ads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a consent-based processing framework for health data for users covered by the Washington My Health My Data Act and Nevada SB 370, creating a specific withdrawal right that operates separately from general privacy controls. The Washington My Health My Data Act applies broadly to health data and carries a private right of action, creating heightened legal exposure.
Interpretive note: The policy does not specify the exact mechanism for withdrawing consent for health data processing under these statutes, and the adequacy of Google's general privacy controls as a consent withdrawal mechanism under the Washington My Health My Data Act's specific requirements is not fully determinable from the policy text alone.
The updated policy makes several material clarifications about how Google links your activity across websites and apps. It shifts from describing analytics tools in isolation to framing them as part of a broader 'ad and analytics services' ecosystem, and broadens the scope of data linking to explicitly include 'cookies and other technologies'. The policy also clarifies that data sharing occurs even in private browsing modes. Review your Google Account activity controls to understand what data is being collected and linked across services you use.
View change record →Under this clause, users in Washington state and Nevada who provide health information through Google services (including Fitbit, Pixel devices, Google Health Studies app, and similar services) may withdraw consent for Google's processing of that health data. The policy does not specify the exact mechanism for consent withdrawal in this context, directing users to general privacy controls.
Cross-platform context
See how other platforms handle Health Data Processing Under Washington My Health My Data Act and Nevada SB 370 and similar clauses.
Compare across platforms →Monitoring
YouTube Ads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The Washington My Health My Data Act and Nevada Senate Bill 370 provide specific rights in addition to those rights above, that apply to health information. When you provide health information subject to these laws, Google processes it with your consent, which you may withdraw, or as otherwise permitted by these laws.Excerpt from YouTube Ads's Google Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly implicates the Washington My Health My Data Act, enforced by the Washington State Attorney General and carrying a private right of action, and Nevada SB 370, enforced by the Nevada Attorney General. These laws apply to health data beyond HIPAA's scope and include geolocation data that could reveal health-related behavior. Google's acknowledgment of consent-based processing under these laws is a material compliance representation. 2. GOVERNANCE EXPOSURE: High. The Washington My Health My Data Act's private right of action creates litigation exposure if consent mechanisms are found inadequate or if withdrawal requests are not honored in a manner consistent with the statute. The breadth of health data collected across Google services (Fitbit metrics, Pixel Watch data, Google Health Studies, and health information inferred from activity) creates a large data surface subject to these requirements. 3. JURISDICTION FLAGS: Washington state and Nevada users are the primary affected populations under this provision. However, organizations with employees or customers in these states who use Google services handling health data should assess their own exposure. The Washington My Health My Data Act's broad definition of health data may encompass geolocation and activity data beyond what users would traditionally classify as health information. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Google Workspace or Google Cloud services that process employee or customer health data should assess whether their data processing agreements with Google adequately address obligations under the Washington My Health My Data Act and Nevada SB 370, including consent management and withdrawal procedures. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should map which Google services in their environment collect data that qualifies as health data under the Washington My Health My Data Act, assess whether the consent mechanisms described in the policy satisfy the statute's requirements, and document procedures for handling consent withdrawal requests. The policy's reference to processing as 'otherwise permitted by these laws' should be reviewed for alignment with the statutes' specific authorized processing purposes.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a consent-based processing framework for health data for users covered by the Washington My Health My Data Act and Nevada SB 370, creating a specific withdrawal right that operates separately from general privacy controls. The Washington My Health My Data Act applies broadly to health data and carries a private right of action, creating heightened legal exposure.
Under this clause, users in Washington state and Nevada who provide health information through Google services (including Fitbit, Pixel devices, Google Health Studies app, and similar services) may withdraw consent for Google's processing of that health data. The policy does not specify the exact mechanism for consent withdrawal in this context, directing users to general privacy controls.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by YouTube Ads.