Are Website Tracking Pixels Legal in Washington and Oregon?

Are website tracking pixels legal in Washington and Oregon?

Yes, using tracking pixels is legal in both states. What creates legal risk is how the pixels behave: whether they fire before a visitor agrees, whether your privacy policy actually names them, and what kind of data they send and to whom. A pixel that loads Google Analytics on a plain marketing page is a very different risk than one that sends appointment or purchase details to an ad platform without consent. The tool is not the problem. The undisclosed, unconsented use of it is.

What turns a normal tracking pixel into a legal problem?

Three things move a pixel from routine to risky: consent, disclosure, and the sensitivity of the data. If a tracker fires before the visitor has agreed to it, that undercuts any claim that they consented. If your privacy policy does not name the trackers and vendors you actually run, you have a disclosure gap. And if the data traveling out could be considered sensitive, such as anything tied to health, appointments, or precise location, the stakes climb sharply. Most small-business sites stumble on the first two without realizing it, because the trackers were installed by a plugin or a tag manager and never revisited.

What is Washington's My Health My Data Act, and could it apply to my site?

The My Health My Data Act (MHMDA) is a Washington privacy law with something most privacy laws lack: a private right of action, meaning individuals can sue you directly rather than waiting on a regulator. It is enforced through Washington's Consumer Protection Act, and its definition of "consumer health data" is written broadly enough to catch businesses that would never think of themselves as health related. If your site touches wellness, appointments, symptoms, or anything a court could read as health adjacent, this is the law to understand first. We go deep on who it covers in a companion post: Does the My Health My Data Act apply to my website?. Primary source: RCW 19.373 and the enforcement mechanism at RCW 19.86.

What are Oregon's tracking rules right now?

Oregon runs on the Oregon Consumer Privacy Act (OCPA), and two things changed the picture at the start of 2026. First, the grace period that let businesses fix violations before enforcement ended on January 1, 2026, so the Attorney General can now move straight to enforcement. Second, Oregon sites must honor universal opt-out signals, specifically the Global Privacy Control, a browser setting that tells a site "do not sell or share my data," and they cannot sell precise geolocation. Oregon does not give individuals a private right to sue, so enforcement runs through the Attorney General, with civil penalties reaching up to $7,500 per violation. If you want to test one thing today, check whether your site respects the Global Privacy Control.

Can a business get sued directly, or only fined by the state?

It depends on the state, and this is the single most important practical difference between the two. In Washington, individuals can sue you directly under the My Health My Data Act, and damages under the Consumer Protection Act can be trebled up to $25,000 plus attorney fees, which is what makes it attractive to plaintiff lawyers. In Oregon, there is no private right of action, so the risk is state enforcement rather than a private lawsuit. In plain terms: Washington is where a random visitor can become a plaintiff, and Oregon is where the Attorney General is the one to watch.

Is this really happening to small businesses, or just big companies?

It is happening to small businesses, and California is the clearest warning. There, a decades-old wiretapping law called the California Invasion of Privacy Act is being aimed at ordinary website trackers, with statutory damages commonly cited at $5,000 per website visit and no requirement to prove anyone was harmed. A reform coalition estimates around 3,000 businesses have been targeted. The people getting hit are not just brands. Reporting has documented an HVAC company, Folsom Lake Heating and Air, sued over standard website analytics, and an electrician who then discovered the same plaintiff had sued three other local businesses with identical complaints. Washington already has real cases too, including a Seattle retailer sued under the My Health My Data Act for pixels sending purchase and appointment data to Google, following the first MHMDA suit filed against Amazon in early 2025.

Why isn't my cookie banner enough?

Because on a lot of small-business sites the banner is mostly for show. The tracking pixels are often hardcoded to load the moment the page opens, so the analytics, the ad pixels, and any session recorder fire whether the visitor clicks Accept, clicks Reject, or never touches the banner at all. When that happens, the Reject button changes nothing, and the data still travels out to ad platforms and data brokers like LiveRamp and Acxiom. A banner that promises a choice the site does not actually honor can be worse than no banner, because now there is a written promise the behavior contradicts. We break this down in a companion post: Why your cookie consent banner probably isn't compliant.

What should a Washington or Oregon business do about it?

Start by finding out what your website actually loads, because most owners have never seen the list. Then make three things true: your trackers do not fire before a visitor consents, your privacy policy names the trackers and vendors you really use, and your site honors the opt-out choices it offers, including the Global Privacy Control in Oregon. None of that requires panic, and none of it requires a lawsuit to be hanging over you first. If you want to see what your own site is running without digging through code, that is exactly what our free Exposure Scan shows you: every tracker on the page, how many keep firing after a visitor clicks Reject, and whether your privacy policy actually names them. Use it or don't. Either way, knowing is the cheap part.

FAQ

Do I legally need a cookie banner in Washington or Oregon?

Neither state requires a banner by name, but both effectively require that you disclose your data practices and honor opt-out choices, and Oregon requires honoring the Global Privacy Control. A banner is one way to do that, but only if it actually controls what loads.

Is Google Analytics illegal to use?

No. Google Analytics is legal to use. The risk comes from running it without disclosure or consent, or configuring it in ways that share more than visitors expect.

Does this apply if my business is small or local?

Yes. The California lawsuit wave has targeted small local businesses, and Washington's law does not exempt small businesses. Size is not the shield people assume it is.

I am not in California. Why does California matter?

California is the leading indicator. The legal theories being tested there tend to spread, and Washington and Oregon already have their own laws on the books with real teeth.

Sources and disclaimer

Sources are linked inline. This piece reflects the state of these laws as of mid 2026 and is not legal advice. Privacy law is moving quickly, so confirm the current rules, and how they apply to you, with a qualified attorney.