Geofencing ads near clinics: state laws

Location targeting is one of the oldest tools in local advertising: show the ad to people near the office. Ad vendors also sell a narrower version, called geofencing, that draws a tight virtual line around a building and reaches phones that cross it. Pointed at a competitor’s clinic, a hospital or an urgent care, it promises ads in front of people who are already seeking care. Four states have written laws that limit exactly that: Washington, Nevada, Connecticut and New York.

This guide is for owners and managers of independent practices, dental offices, med spas, chiropractic and integrative clinics who run local ads or are being pitched location-based campaigns. It sets out what each of the four laws says, how far each reaches, where HIPAA covered practices stand, how Google’s own location settings compare, and which kinds of local targeting a practice can still use. For the wider state health data laws behind these rules, see our guides to the Washington My Health My Data Act and consumer health data laws in Nevada and Connecticut. For in-navigation placements, see our guide to Waze ads for medical practices. For ads that follow people after they visit your site, see our guide to healthcare remarketing ads.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: the Washington My Health My Data Act at RCW 19.373.010 and 19.373.080, Nevada Senate Bill 370 (2023), sections 20, 31 and 36, codified at NRS 603A.400 to 603A.550, Connecticut General Statutes sections 42-515 and 42-526, New York General Business Law section 394-g, and the Google Ads Help pages on location targeting and health in personalized advertising. State rules on geofencing and health data differ and change, so check yours, and have a health care attorney review any location-based campaign near health care facilities before it runs.

The short version

Four states, four different lines. Washington’s ban reaches geofences 2,000 feet or less from the perimeter of any in-person health care provider. Nevada’s reaches 1,750 feet around medical facilities and other in-person providers. Connecticut’s reaches 1,750 feet around mental health facilities and reproductive or sexual health facilities. New York’s reaches a radius of 1,850 feet or less around any health care facility.
The purpose matters. Each law bans geofences used for listed purposes: tracking people seeking care, collecting health data, building profiles, inferring health status, or sending ads or messages. A geofence for something else, such as a delivery app, is outside the wording.
Your own office is treated differently in New York only. New York’s law expressly excludes a business’s own health care facility. The Washington, Nevada and Connecticut texts have no such words.
HIPAA covered practices are exempt in two of the four. Nevada’s law does not apply to persons subject to HIPAA, and Connecticut exempts covered entities and business associates. Washington and New York apply to any person.
Google’s minimum radius is larger than all four lines. Google Ads does not allow radius targeting under 1 km, about 3,280 feet. Other ad vendors sell far smaller fences, and those are the ones these laws were written for.

What geofencing is, and how it differs from ordinary location targeting

Location targeting in an ad platform picks an area, such as a city, a ZIP code or a radius around an address, and shows ads to people the platform believes are in or interested in that area. Google describes its location targeting as based on signals including users’ settings, devices and behavior on its platform, and as a best effort rather than an exact border.

Geofencing, as these laws define it, is narrower and more precise. Washington’s definition in RCW 19.373.010 covers technology that uses GPS coordinates, cell tower connectivity, cellular data, radio frequency identification, Wi-Fi data or any other form of location detection to set a virtual boundary around a specific physical location, or to locate a consumer within one. New York’s definition in section 394-g adds a description of the advertising use: a boundary that lets a digital advertiser track a person’s location and deliver targeted ads to their mobile device when they enter the area.

In practice, vendors offer this under names such as geofencing, geo-conquesting, mobile location targeting or audiences built from visits to a place. The pitch for a practice is to reach phones seen at a competitor’s office, a hospital emergency department or a pharmacy, and then show those people ads for days afterward. That pitch is the core of what these four laws restrict.

Washington: 2,000 feet around any in-person health care provider

RCW 19.373.080 makes it unlawful for any person to implement a geofence around an entity that provides in-person health care services where the geofence is used to identify or track consumers seeking health care services, to collect consumer health data, or to send notifications, messages or advertisements to consumers related to their consumer health data or health care services.

The definition of geofence in RCW 19.373.010 sets the distance: a virtual boundary that is 2,000 feet or less from the perimeter of the physical location. The measurement runs from the edge of the property, not from a center point, so a large hospital campus produces a large restricted area.

Three features matter for practices. First, the section applies to “any person”, and the act defines person to include natural persons, corporations, trusts, unincorporated associations and partnerships. Second, the protected locations are any entity that provides in-person health care services, which reaches dental offices, med spas, chiropractic and integrative clinics as well as hospitals. Third, the text contains no exception for a business’s own location. Whether a practice may geofence its own office for ads is a question to put to your attorney before doing it in Washington.

Washington also treats location itself as health data. The act’s definition of consumer health data includes precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies, and it defines precise location information as data that identifies a person’s location within a radius of 1,750 feet. A campaign that collects that kind of data raises the act’s consent rules even if no geofence is involved. Our Washington guide covers those consent and privacy policy duties.

Nevada: 1,750 feet around medical facilities and in-person providers

Section 31 of Nevada Senate Bill 370 (2023), codified in the NRS 603A.400 to 603A.550 range as NRS 603A.540, says a person shall not implement a geofence within 1,750 feet of any medical facility, facility for the dependent, or any other person or entity that provides in-person health care services or products, for the purpose of identifying or tracking consumers seeking in-person health care services or products, collecting consumer health data, or sending notifications, messages or advertisements to consumers related to their consumer health data or health care services or products.

The section defines a geofence as technology that uses GPS coordinates, cellular tower connectivity, cellular data, radio frequency identification, wireless Internet data or any other form of detecting physical location to establish a virtual boundary with a radius of 1,750 feet or less around a specific physical location. The act became effective on March 31, 2024, under section 36 of the bill.

The exemption is what sets Nevada apart for practices. Section 20 of the bill says the provisions of sections 2 to 34, which include the geofencing ban, do not apply to any person or entity that is subject to HIPAA and its regulations. A HIPAA covered practice is outside the Nevada ban on its own terms. An ad vendor that is not subject to HIPAA is not, so a vendor running a geofence near Nevada clinics on a practice’s behalf can still be inside it. Ask who is implementing the geofence, and have your attorney confirm which side of the exemption each party sits on.

Connecticut: 1,750 feet around mental health and reproductive or sexual health facilities

Connecticut’s rule sits in section 42-526 of its consumer data privacy law. It says no person shall use a geofence to establish a virtual boundary that is within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, collecting data from or sending any notification to a consumer regarding the consumer’s consumer health data. The history note on the official statute page says the provision took effect on October 1, 2023.

The protected facilities are narrower than in the other three states. Section 42-515 defines a mental health facility as a health care facility where at least 70 percent of the health care services are mental health services, and a reproductive or sexual health facility as one where at least 70 percent of the services or products are reproductive or sexual health care. A general dental office or chiropractic clinic is not on that list; a behavioral health practice or a fertility clinic can be.

Connecticut’s definition of geofence has no distance in it; the 1,750 feet comes from the ban itself. Section 42-526 also reaches persons that conduct business in Connecticut and persons whose products or services are targeted to its residents. Subsection (b) exempts a list of entities, including any covered entity or business associate as defined in 45 CFR 160.103.

New York: 1,850 feet around any health care facility, except your own

New York’s General Business Law section 394-g makes it unlawful for any person, corporation, partnership or association to establish a geofence or similar virtual boundary around any health care facility, other than their own health care facility, for the purpose of delivering a digital advertisement to a user, building consumer profiles, or inferring the health status, medical condition or medical treatment of any person at or within the facility. It also makes it unlawful to deliver a digital advertisement to a user at or within any such facility, other than one’s own, through geofencing.

The definitions are broad. A geofence is a virtual boundary of 1,850 feet radius or less, and the definition also covers identifying whether a device enters, exits or is present in an area using data such as latitude and longitude, IP address, Wi-Fi information, cell tower connectivity or device identification. A health care facility is any governmental or private entity that provides medical care or related services, including the building it is in. A digital advertisement is any electronic communication intended for marketing, solicitation or dissemination of information related to goods or services of the advertiser or a third party.

Two points follow for practices. New York is the only one of the four with an express exception for a business’s own facility, so a practice may geofence its own office under this section. And the law has no HIPAA exemption, so a covered practice that geofences a competitor’s office in New York is inside it. The official New York Senate page showed the current text with a revision dated August 22, 2025, when we checked.

Side by side

Distance. Washington: 2,000 feet or less from the perimeter. Nevada: within 1,750 feet. Connecticut: within 1,750 feet. New York: radius of 1,850 feet or less.
Protected places. Washington: any entity that provides in-person health care services. Nevada: medical facilities, facilities for the dependent and any other provider of in-person health care services or products. Connecticut: mental health facilities and reproductive or sexual health facilities, each defined by a 70 percent share of services. New York: any health care facility.
Own office. Express exception in New York only.
HIPAA covered practices. Exempt in Nevada (persons subject to HIPAA) and Connecticut (covered entities and business associates). No exemption in the Washington or New York geofencing sections.
Purposes. Each lists tracking or identifying people, collecting health data or profiling, and sending ads or messages, with different wording. New York adds inferring health status.

Google’s location targeting and these laws

Google Ads Help says Google only permits targeting for locations that meet minimum privacy thresholds for area and user counts, and gives the example that it does not allow radius targeting under 1 km around any given location. One kilometer is about 3,280 feet, wider than any of the four statutory distances. A small target, Google adds, may lead to ads showing intermittently or not at all.

That does not settle the legal question on its own. The statutes describe boundaries by distance from a facility, and a 1 km circle drawn around your office can still have its edge pass close to another clinic down the road. None of the four texts says how a wide radius whose edge runs near a facility is treated, so if your target area borders other providers in these states, ask your attorney rather than assume the platform minimum answers it.

Google’s health policy adds a separate limit. Its page on health in personalized advertising treats health as a sensitive interest category, covering physical or mental health conditions, treatments for chronic conditions, invasive medical procedures including cosmetic surgery and injections, and disabilities. Advertisers promoting in that category cannot use advertiser-curated audiences, such as customer lists, their own data segments or custom segments, and can use predefined Google audiences, which the page lists as including location targeting. Our guide to disapproved healthcare ads covers the wider policy.

What a practice can still target

Cities, counties and ZIP codes you serve. Area targeting by place name is ordinary location targeting, not a tight fence around a facility.
A radius around your own office. Within the platform minimum, and with the cautions above for Washington, Nevada and Connecticut, where the texts have no own-office exception.
Search terms. Search ads respond to what people type, such as a service and a town, rather than where their phone has been. See our Google Ads for practices page.
Your Google Business Profile and local search. These reach people searching nearby without tracking device visits. Our local SEO work focuses here.
Out-of-home and print near your office. A billboard or a flyer does not collect location data from phones.

What to stop or question: fences drawn around other clinics, hospitals, emergency departments, pharmacies or imaging centers; audiences sold as people who visited a type of health facility; and any campaign that retargets people for days after a phone was seen at a care location.

Questions to ask before a location campaign runs

In which states will the ads run, and in which states do the people we reach live?
Does the campaign draw any boundary around a specific building, and if so, whose?
Is any health care facility within 2,000 feet of the boundary, or within 1,850 feet in New York?
Does the vendor use audiences built from phones seen at health care locations, and can they show us in writing how each audience was made?
Who implements the geofence: our practice, our agency or an ad network? Is each of them subject to HIPAA?
Does any part of the campaign collect precise location data from visitors, for example through an app or a landing page?
Has a health care attorney reviewed the setup for each state on the list?

Use and avoid

Use: “Show ads to people in [city] and nearby ZIP codes.” Avoid: “Show ads to phones seen at [competitor clinic] in the last 30 days.”
Use: “Target a radius around our office that meets the platform minimum.” Avoid: “Draw a 500 foot fence around the hospital emergency department.”
Use: Vendor reports that list targeting by area. Avoid: Vendor reports that list device visits to named care locations.
Use: Search ads matched to what people type. Avoid: Audience lists described as people who visited fertility, mental health or other care facilities.

An illustration

This example is invented. [Practice name], a physical therapy and chiropractic clinic with offices in two states, is offered a package by an ad vendor: fences around three nearby orthopedic offices and an urgent care, with ads shown to phones seen there for 30 days afterward. One office is in Washington and one in New York.

On review with their attorney, the practice declines the competitor fences in both states. Washington’s ban covers fences within 2,000 feet of any in-person provider used to send ads related to health care services, and New York’s covers fences around any facility other than the practice’s own. The campaign is rebuilt as search ads for the practice’s services and towns, area targeting by ZIP code, and a radius around each office that meets Google’s 1 km minimum. For the Washington office, the attorney is asked whether the radius raises any issue given an urgent care near its edge.

Checklist

List each state your location campaigns reach.
Ask each vendor in writing whether any campaign uses geofences or visit-based audiences near health care facilities.
Turn off fences around other providers, hospitals, pharmacies and labs.
Check radius targets around your office against nearby providers in Washington, Nevada and Connecticut.
Keep area, ZIP code and search targeting as the base of local campaigns.
Keep the vendor’s written answers and campaign settings with your advertising records.
Have a health care attorney review the setup before launch and when you enter a new state.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For local ads, we set up search and area targeting around the places you serve, do not build geofences around other health care facilities, and document campaign settings so your attorney can review them. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules on healthcare advertising, see our healthcare marketing rules guide.

Is geofencing near hospitals and clinics illegal?

In four states it is restricted by statute. Washington bans geofences within 2,000 feet of any in-person health care provider for tracking, data collection or health-related ads. Nevada bans them within 1,750 feet of medical facilities and in-person providers. Connecticut bans them within 1,750 feet of mental health and reproductive or sexual health facilities. New York bans them within 1,850 feet of any health care facility other than your own.

Can a practice geofence its own office?

New York’s section 394-g expressly allows a business to geofence its own health care facility. The Washington, Nevada and Connecticut texts contain no own-office exception, so ask your attorney before doing it in those states.

Do these laws apply to HIPAA covered practices?

Nevada’s act does not apply to persons subject to HIPAA, and Connecticut exempts covered entities and business associates. Washington’s geofencing section applies to any person, and New York’s has no HIPAA exemption.

Is Google Ads radius targeting a geofence under these laws?

Google does not allow radius targeting under 1 km, about 3,280 feet, which is wider than any of the four statutory distances. The statutes do not say how a wide radius whose edge passes near another facility is treated, so check with your attorney if your target area borders other providers.

Can we target ads to people who visited a competitor’s clinic?

In Washington and New York, using a geofence around another provider’s location to send ads related to health care services is what the laws prohibit. Nevada and Connecticut restrict it too, with the exemptions and facility types described above. Audiences built from visits to care locations raise the same questions in any state.

Geofencing ads near clinics and health facilities: state laws and what a practice can still target