We file everywhere, for everyone. But what a company is legally required to do about it still depends on where you live. That's not how it should work, and we're not going to pretend otherwise.
These states give residents the clearest, strongest legal footing for a data deletion or opt-out request. We file for every consumer regardless of state, but a company's obligation to actually respond is real and enforceable in these states in a way it often isn't elsewhere.
*Washington isn't one of the 20, but has its own health-data-specific law (My Health My Data Act) with some of the strongest deletion rights anywhere. Oklahoma and Alabama have laws arriving in 2027. If your state isn't marked covered, we still file. See below for what that means in practice.
Some companies extend the same rights to every US resident regardless of state, because it's operationally simpler than treating people differently. Others limit themselves to exactly what their state requires. When a request doesn't get the response it should, we appeal, using the strongest argument available: health data that's been "de-identified" is often still re-identifiable, which means it may qualify for protection under HIPAA regardless of whether your state has its own privacy law. That's a real legal argument, not a formality, and it's one every appeal we file makes on your behalf.
More importantly: this list of 20 states isn't fixed. New privacy laws pass somewhere in the country almost every year. Three states joined the list at the start of 2026 alone. Wherever you live today, the legal ground under this is actively shifting in your favor.
When a company simply doesn't respond, no denial, no confirmation, just silence past its legal deadline, we don't just send another reminder. Missing that deadline is itself a violation, and the next step is a real one: filing a complaint with the state's enforcement body (the California Privacy Protection Agency for CCPA, the state Attorney General's office for MHMDA). That's not a symbolic gesture. It's the actual regulatory mechanism these laws provide, and we use it.
A federal bill (the SECURE Data Act) that would create nationwide access and deletion rights had a House hearing in June 2026. Real organizations are pushing for comprehensive privacy legislation, state by state and federally, and we're glad to say so plainly: we support the direction this work is heading, independent of whether it's good or bad for our own business model.
EPIC and Consumer Reports co-authored a model state privacy bill that's been endorsed by several of these groups. Real, current work, not a symbolic gesture. As this landscape keeps moving, we intend to keep moving with it.