Washington State Privacy Law 2026: MHMDA, Biometric Rules, and Business Checklist

Washington privacy law in one sentence: As of July 23, 2026, Washington has no enacted comprehensive consumer privacy act; the two main cross-industry sectoral statutes for businesses are the My Health My Data Act, Chapter 19.373 RCW, for consumer health data and the biometric identifiers law, Chapter 19.375 RCW, for commercial biometric enrollment.

That distinction matters for compliance planning. If you search for "Washington state privacy law," you will find several different obligations: consumer health data rules, biometric consent rules, data breach notification, AI and employee-privacy bills, and recurring attempts to pass a broader consumer data privacy act. The checklist below separates what is law today from what is still pending.

Does Washington State Have a Comprehensive Privacy Law in 2026?

No enacted comprehensive consumer data privacy act is in force in Washington as of July 23, 2026. HB 1671, titled "Protecting personal data privacy," was introduced in the 2025-26 biennium, moved to House Appropriations in 2025, and was reintroduced in the same status for the 2026 session. The Legislature's bill page, rechecked July 23, still lists the current status as HApprops (page status timestamp: July 7, 2026), not passed legislature or session law.

Practical result: do not map Washington into the same comprehensive-law workflow as California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Oregon OCPA, or Maryland MODPA. Instead, check whether your product touches Washington consumers through one of the narrower privacy regimes below.

Washington State Privacy Law Stack: 2026 Compliance Map

Privacy area	Current Washington status	What businesses should do
Comprehensive consumer privacy	Not enacted. HB 1671 remains in House Appropriations.	Monitor the bill, but do not grant broad Washington consumer rights unless another law or contract requires them.
Consumer health data	Active under the My Health My Data Act, Chapter 19.373 RCW.	Publish a consumer health data privacy policy, collect/share only with required consent or as necessary for requested services, support access/deletion workflows, and use a separate valid authorization before selling consumer health data.
Health-care geofencing	Restricted under RCW 19.373.080.	Do not set a geofence around in-person health care facilities to identify or track consumers, collect consumer health data, or send health-data-related ads/messages.
Biometric identifiers	Active under Chapter 19.375 RCW.	Before commercial enrollment, provide notice, obtain consent, or provide a mechanism preventing later commercial use; protect enrolled identifiers and retain them only as long as reasonably necessary.
Multi-state privacy compliance	Washington may still matter if the same business also triggers other state laws.	Run a separate applicability check for California, Virginia, Colorado, Oregon, Maryland, Texas, and other comprehensive-law states.

Washington Privacy Law Decision Matrix: Health Data vs. Biometric Identifiers

This side-by-side matrix separates duties that are often collapsed into one generic "Washington privacy law" checklist. It is based on the current text of Chapters 19.373 and 19.375 RCW, verified July 23, 2026.

Decision point	My Health My Data Act (RCW 19.373)	Biometric identifiers law (RCW 19.375)
What triggers the law?	Collecting, processing, sharing, or selling consumer health data as a regulated entity or small business.	Enrolling a biometric identifier in a database for a commercial purpose.
Notice and consent	Separate, specific consent for collection and sharing unless necessary for a requested product or service; a separate signed authorization is required for sale.	Before commercial enrollment, provide notice, obtain consent, or provide a mechanism preventing later commercial use. The exact notice and consent are context-dependent; materially inconsistent new use requires consent.
Consumer request deadline	Respond within 45 days, with one 45-day extension when reasonably necessary. Deletion from restored archives or backups may take up to six months.	No access or deletion request workflow is specified in Chapter 19.375.
Retention rule	Deletion reaches affiliates, processors, contractors, and third parties; signed sale authorizations must be retained for six years.	Retain enrolled identifiers only as long as reasonably necessary for law, fraud/security/liability protection, or the service for which they were enrolled.
Enforcement	A violation is a Washington Consumer Protection Act violation, enforceable by the Attorney General and through private action.	Enforcement is solely by the Washington Attorney General under the Consumer Protection Act.

My Health My Data Act: The Washington Privacy Law Most Businesses Miss

The My Health My Data Act is broader than a traditional medical-records rule. It applies to regulated entities and small businesses that conduct business in Washington, or target products or services to Washington consumers, and determine the purpose and means of collecting, processing, sharing, or selling consumer health data.

Key duties from Chapter 19.373 RCW include:

• Consumer health data privacy policy — regulated entities and small businesses must maintain a policy disclosing categories collected, purposes, sources, sharing categories, third parties/affiliates, and how consumers exercise rights. The policy link must be prominent on the homepage.
• Collection and sharing limits — consumer health data may be collected or shared only with consent for a specified purpose or as necessary to provide a requested product or service.
• Consumer rights — consumers can confirm collection, access consumer health data, withdraw consent, and request deletion. Responses are generally due within 45 days, with one 45-day extension when reasonably necessary.
• Security and processor duties — access must be restricted to personnel and processors with a need tied to consent or the requested service, and processors need binding instructions.
• Sale authorization — selling consumer health data requires a separate valid authorization that identifies the data, seller, purchaser, purpose, expiration, revocation right, and consumer signature.
• Geofence ban — health-care geofences cannot be used to identify or track consumers seeking in-person health care services, collect consumer health data, or send health-data-related ads/messages.

Washington Biometric Privacy Law: Consent, Retention, and AG Enforcement

Washington's biometric identifiers law is narrower than Illinois BIPA but still creates a real compliance obligation. Chapter 19.375 RCW covers biometric identifiers enrolled in a database for a commercial purpose. RCW 19.375.020 does not prescribe one universal written-consent form: before commercial enrollment, a person must provide notice, obtain consent, or provide a mechanism preventing the identifier's later commercial use. The statute says the exact notice and type of consent are context-dependent. Consent is required before a materially inconsistent new use or disclosure, and separate disclosure rules apply after enrollment.

The law also requires reasonable care against unauthorized access and limits retention to what is reasonably necessary for legal compliance, fraud/security/liability protection, or the service for which the biometric identifier was enrolled. The notice-and-consent requirement does not apply to biometric collection, capture, enrollment, or storage performed for a statutory "security purpose." Enforcement is solely by the Washington Attorney General under the Consumer Protection Act, unlike Illinois BIPA's private lawsuit model.

Washington State Privacy Law Checklist for Businesses

1. Classify Washington data types — identify consumer health data, biometric identifiers, precise geolocation near health-care facilities, breach-notification data, and ordinary customer account data separately.
2. Confirm MHMDA coverage — check whether you conduct business in Washington or target Washington consumers and decide the purposes/means of consumer health data processing.
3. Publish or update a consumer health data privacy policy — do not bury it inside a general privacy policy if Washington's law requires a clear consumer health data disclosure.
4. Separate collection, sharing, and sale permissions — MHMDA treats health-data collection/sharing consent and sale authorization as different artifacts.
5. Build a 45-day health-data request workflow — access, consent withdrawal, deletion, appeal, and AG complaint routing need their own intake and response process.
6. Block health-care geofence use cases — audit adtech, location SDKs, and audience tools around clinics, pharmacies, reproductive health providers, and similar facilities.
7. Audit biometric enrollment — if you use face, fingerprint, voiceprint, or similar templates, separate commercial-purpose enrollment from the statute's security-purpose exception, then document the applicable notice, consent or prevention mechanism, disclosure limits, and retention rationale.
8. Run the broader state-law check — Washington may not have a comprehensive law, but your business may still trigger CCPA/CPRA, VCDPA, CPA, OCPA, MODPA, TDPSA, or other laws for residents in other states.

How Washington Compares With California, Oregon, and Maryland

Washington is unusual because it has one of the strongest health-data privacy laws in the country but no enacted comprehensive consumer privacy act. California and Oregon provide broad consumer rights across many data categories. Maryland adds unusually strict minimization and sensitive-data limits. Washington, by contrast, is strongest when the data is health-related or biometric.

For a broader business applicability check, use the Privacy Law Calculator. For state-by-state differences in rights, thresholds, GPC, cure periods, and enforcement, use the State Privacy Law Comparison Tool. If your Washington issue involves health data deletion, the Deletion Request Generator can help draft consumer-facing requests, but business response obligations should be reviewed against MHMDA directly.

Frequently Asked Questions

Does Washington have a state privacy law?

Yes, but it is not a broad comprehensive consumer privacy act. Washington has sectoral privacy laws, especially the My Health My Data Act for consumer health data and Chapter 19.375 RCW for biometric identifiers.

Is the Washington My Health My Data Act only for hospitals?

No. It can reach non-HIPAA businesses that collect consumer health data from Washington consumers or target Washington consumers with products and services. Wellness apps, fertility apps, wearable integrations, symptom checkers, and location-based health advertising should all review it closely.

Did Washington pass HB 1671?

No. As of July 23, 2026, the Washington Legislature's bill page still listed HB 1671 in House Appropriations, not passed by the Legislature or enacted as session law.

What notice and consent does Washington's biometric identifiers law require?

For commercial-purpose enrollment, RCW 19.375.020 requires a business to provide notice, obtain consent, or provide a mechanism preventing the biometric identifier's later commercial use. The exact notice and type of consent are context-dependent. Consent is required for a materially inconsistent new use or disclosure, while the statute provides a security-purpose exception.

Does Washington biometric privacy law allow private lawsuits like Illinois BIPA?

No. Washington Chapter 19.375 says enforcement is solely by the Attorney General under the Consumer Protection Act. Illinois BIPA is the high-risk private-lawsuit model; Washington is an AG-enforcement model.

What is the top Washington privacy compliance step for health or wellness apps?

Start with a consumer health data inventory. Then map each collection, sharing, sale, deletion, and geofencing use case to Chapter 19.373 RCW before launching the feature or ad campaign.

Primary sources checked July 23, 2026: Washington Legislature HB 1671 bill summary (app.leg.wa.gov/billsummary?BillNumber=1671&Year=2026, date_retrieved: 2026-07-23); Chapter 19.373 RCW, Washington My Health My Data Act (app.leg.wa.gov/RCW/default.aspx?cite=19.373, date_retrieved: 2026-07-23); Chapter 19.375 RCW, biometric identifiers (app.leg.wa.gov/RCW/default.aspx?cite=19.375, date_retrieved: 2026-07-23); and the Washington Attorney General's My Health My Data Act guidance confirming Consumer Protection Act enforcement by the Attorney General and through private action (date_retrieved: 2026-07-23).

Published: June 8, 2026. Last verified: July 23, 2026.