CMP Recommendations: Washington's My Health My Data Act and Nevada's SB370

Three affirmative actions required:

• Consent to collect consumer health data

• Consent to share consumer health data

• Authorization workflow for selling of consumer health data (electronic signature).

These requests must be distinct and separate from each other and from the authorization workflow. Consent to share is dependent upon consent to collect being provided.

For instructions on how to add a new category, see Managing and Categorizing Cookies and SDKs.

1. Add new cookie categories for the following:

   • Consent to Collect

     • Configure the Category ID as CCHD.

     • Description: We [the requesting party] collect the following categories of consumer health data, for the following purposes and uses:

       Please note that you may withdraw your consent to collection at any time by [clicking link/other method].

   • Consent to Share

     • Configure the Category ID as CSHD.

     • Description: We [the requesting party] share consumer health data with the following categories of partners, for the following purposes and uses:

       Please note that you may withdraw your consent to sharing at any time by [clicking link/ other method].

   • Electronic Signature

     • Configure the Category ID as esign.

     • Description: By switching the e-signature toggle to “on,” you confirm your intent to agree to the use of e-signatures for the purposes of authorization under the Washington My Health My Data Act and Nevada SB370. You also agree that your electronic signature will have the same legal effect as a signed physical document. Click [here] to view consumer E-sign Act Disclosures.

   • Targeted Advertising / Authorization to Sell

     Note:

     You can leverage your existing Targeting category.

     Description

     : Like many websites and apps, we use cookies and similar tracking technologies to enable certain functionality, collect information about your visit and show relevant advertising about products and services. The use of third-party trackers may be considered “sharing” or “selling” of personal information under certain privacy laws where third parties may collect information from your browser and device. In particular, under the Washington My Health My Data Act, and Nevada SB370, the disclosure of consumer health information with third parties who are not acting as our affiliates or service providers is considered a “sale”. The law broadly defines ‘consumer health data’ as personal information that is linked or can be reasonably linked to a consumer and that identifies past, present or future physical or mental health status. For example, this may include non-medical information, such as information based on the pages you visit or products you view or purchase or that could indicate your interest or attempt to acquire or receive health services or supplies.

     As a result, we [the seller’s name] must request your authorization to ‘sell’ your consumer health information to enable us to perform targeted advertising. Providing your authorization will allow us to use the data we collect to recommend products and advertisements that would be important and relevant to you. If you decline to authorize the ‘sale’ of your consumer health data, you may continue to see advertising but the ads you see may not be as relevant to you. Giving your authorization may mean that the information we are authorized to ‘sell’ will be redisclosed by the purchaser and may no longer be protected under RWC 19.373.070 (2) and NV SB370 §30. Please note that the provision of this service is not conditioned on your authorization. You may withdraw your consent to sharing at any time by [clicking link/ other method]. 

     We [insert Seller’s Name/Contact information] ‘sell’ consumer health data to the following parties, for the following purposes and uses:

     If given, your authorization expires one year from the data of signature. The date of expiration of that authorization will be [insert date].

The following configurations are suggested for your CMP Banner. For instructions on how to set up or edit your Banner, see Customizing the Banner Template.

The following configurations are suggested for your CMP Preference Center. For instructions on how to set up or edit your Preference Center, see Customizing the Preference Center Template.

The following configurations are suggested for your CMP Geolocation Rule. For instructions on how to set up or edit your Geolocation Rules, see Configuring Geolocation Rules.

This solution uses custom JavaScript to display additional categories only after Consent to Collect is enabled. The additional categories—Consent to Share, E-signature, and Authorization to Sell/Targeting Cookies—will then appear. Authorization to Sell/Targeting Cookies will only be configurable after the E-signature is consented to. This JavaScript also hides the Allow All button, which is not permitted under these state laws.

We recommend adding the below JavaScript to your OptanonWrapper.

function OptanonWrapper() {
    (function (param) {
        let consentToShareEle, myHealthDataMainCatEle, targetedAdvertisingCatEle, electronicSignatureCatEle;

        const { ConsentToCollect, ConsentToShare, TargetedAdvertisingAuthorizationToSell, ElectronicSignature } = param;

        initVariables();
        // Hide Allow All button
        hideAllowAllButton();
        // Main logic to hide or show my Health my data categories
        myHealthMyDataAddListener();

        function initVariables(params) {
            consentToShareEle = document.getElementById(`ot-group-id-${ConsentToShare}`);
            myHealthDataMainCatEle = document.getElementById(`ot-group-id-${ConsentToCollect}`);
            electronicSignatureCatEle = document.getElementById(`ot-group-id-${ElectronicSignature}`);
            targetedAdvertisingCatEle = document.getElementById(`ot-group-id-${TargetedAdvertisingAuthorizationToSell}`);
        }

        function myHealthMyDataAddListener() {
            if (!myHealthDataMainCatEle) {
                return;
            }
            myHealthDataMainCatEle.addEventListener('click', toggleMyHealthMainCategory$);
            displayMyHealthCategories(myHealthDataMainCatEle.checked, [ConsentToShare, ElectronicSignature, TargetedAdvertisingAuthorizationToSell]);

            // Listener for Electronic Signature
            if (electronicSignatureCatEle) {
                electronicSignatureCatEle.addEventListener('click', electronicSignatureCategory$);
                disableMyHealthCategories(!electronicSignatureCatEle.checked, [TargetedAdvertisingAuthorizationToSell]);
            }
        }

        function hideAllowAllButton() {
            const allowAllBtn = document.getElementById("accept-recommended-btn-handler");
            if (allowAllBtn) {
                allowAllBtn.classList.add("ot-hide");
            }
        }

        function toggleMyHealthMainCategory$(event) {
            if (!event.currentTarget.checked) {
                resetValues();
            }else{
                setTimeout(()=>{
                    const element = document.querySelector("[data-optanongroupid='esign']");
                      element.scrollIntoView();    
                }, 250);
            }
            displayMyHealthCategories(event.currentTarget.checked, [ConsentToShare, ElectronicSignature, TargetedAdvertisingAuthorizationToSell]);
        }

        function electronicSignatureCategory$(event) {
            const checked = event.currentTarget.checked;
            if (!checked && targetedAdvertisingCatEle.checked) {
                targetedAdvertisingCatEle.checked = false;
                dispatchEventToMyHealthDataCategory(targetedAdvertisingCatEle);
            }
            disableMyHealthCategories(!checked, [TargetedAdvertisingAuthorizationToSell]);
        }

        function dispatchEventToMyHealthDataCategory(catEle) {
            const clickEvent = new Event('click');
            catEle.dispatchEvent(clickEvent);
        }

        function displayMyHealthCategories(show, myHealthCategories) {
            for (const myHealtDataCat of myHealthCategories) {
                const myHealtDataCatEle = document.querySelector(`[data-optanongroupid="${myHealtDataCat}"]`);
                if (!myHealtDataCatEle) {
                    continue;
                }
                if (show) {
                    myHealtDataCatEle.classList.remove("ot-hide");
                } else {
                    myHealtDataCatEle.classList.add("ot-hide");
                }
            }
        }

        function disableMyHealthCategories(disabledHtml, myHealthCategories) {
            for (const myHealtDataCat of myHealthCategories) {
                const myHealtDataCatEle = document.getElementById(`ot-group-id-${myHealtDataCat}`);
                if (!myHealtDataCatEle) {
                    continue;
                }
                myHealtDataCatEle.disabled = disabledHtml;
            }
        }

        function resetValues() {
            consentToShareEle.checked = false;
            dispatchEventToMyHealthDataCategory(consentToShareEle);

            electronicSignatureCatEle.checked = false;
            dispatchEventToMyHealthDataCategory(electronicSignatureCatEle);

            targetedAdvertisingCatEle.checked = false;
            dispatchEventToMyHealthDataCategory(targetedAdvertisingCatEle);

        }

    })({ ConsentToCollect: "CCHD", ConsentToShare: "CSHD", TargetedAdvertisingAuthorizationToSell: "ASHD", ElectronicSignature: "esign" });
}