State Guide
Washington Privacy & Data Security Laws
Every statute below can apply to a business handling Washington residents' data, depending on your revenue, the number of Washington consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Data Security & Breach Notification · 1
Requires notifying affected residents (and often the state AG/regulator) after a breach of unencrypted personal information such as SSNs, driver's license/state ID numbers, or financial account numbers. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
Biometric Privacy · 1
Requires notice and consent before enrolling biometric identifiers in a database for a commercial purpose. AG-enforced.
Consumer Health Data · 1
Broadly defines "consumer health data" (far beyond HIPAA) and requires opt-in consent for collection/sharing and a strict prohibition on sale without authorization. Enforceable via Washington's Consumer Protection Act, which includes a private right of action.