New York Bans Geofencing Near Health Care Facilities

New York is prohibiting advertisers from geofencing health care facilities, according to a new provision in the state budget passed in May. As a result, it’s becoming harder for advertisers, who want to use location or health care data, to maintain performance while still abiding by the law. Geofencing is a technology that lets companies track user devices within a particular geographic radius. Under the new law, corporations are prohibited from creating a geofence within 1,850 feet of hospitals in New York state to deliver an advertisement, build consumer profiles, or infer health status. “There is going to be a fundamental shift in how the pharma and the medical industry gets marketed,” said Alan Chapell, president of law firm Chapell & Associates. “The idea that you’re going to have separate campaigns, one for each state that has a privacy law and one for everyone else, that has a cost associated.” Still a Valuable Currency of Advertising, Location Data Is Under the Microscope The recent state legislation comes at a time when the federal government is also scrutinizing how businesses use healthcare data for advertising. The FTC fined health care firms GoodRx and BetterHelp for using health care data inappropriately earlier this year. In late 2022, the Department of Health and Human Services released guidance on the way digital tracking technologies can be in violation of the Health Insurance Portability and Accountability Act (HIPPA). New York follows Washington, which passed the My Heath My Data law in April, in passing legislation aimed at stopping advertisers from geofencing health care facilities. Both aim to prevent the collection of private, sensitive information, which is particularly incriminating in the wake of the Supreme Court’s overturning of federal abortion protections last year. Connecticut and Nevada passed separate bills prohibiting geofencing around health care facilities in June—both prohibit identifying, tracking, and collecting data 1,750 feet outside of a health care facility. Of note, both Connecticut and Nevada already have comprehensive user privacy legislation, while New York does not. All advertisers in the regulatory crosshairs The New York law has particularly far-ranging implications because of how densely packed New York City is. Theoretically, an advertiser could geofence around another business that is proximate to a health care facility and still fall within the law’s prohibited radius, even if the advertiser had no interest in healthcare, said Greg Sterling, co-founder of local search-focused firm Near Media. “You’re not going to be able to use location targeting for most of Manhattan,” he said. The law defines healthcare facilities as any governmental or private entity providing medical care or services, which could encompass many establishments on a New York City block. “The law is a little bit vague,” said Jeremy Berkowitz, senior privacy director at law firm Paul Hastings. “In terms of New York, there has not been much guidance as to how you define health care facility. They still need to figure out how that is going to be interpreted.” Tricky to enforce Despite these challenges, it's up to the attorney general to charge a business for breaking the geofencing prohibition. And the office of the New York attorney general still has to decide if it wants to enforce the ban. “When you think about financial crime and counterterrorism and drug reform ... it’s not clear [the geofencing ban] is on the top 10 list of priorities,” Chapell said. Berkowitz said that the government is most likely to go after advocacy groups and non-profits. Geofencing cases are fairly rare, according to two legal sources, who pointed to a case in 2017 when the Massachusetts Attorney General settled with an advertising firm that was hired to send pro-life ads to abortion seekers. It would take resources and investigations for the government to determine whether a business violated a geofencing ban, work that could be cumbersome but not impossible. For example, state officials could see whether they were served ads in health facilities or operated a tip line, said Eric Null, co-director of the privacy and data project at the Center for Democracy & Technology. “There are ways to track the advertising system,” Null said. “There are questions of where the office wants to place their resources.”