Washington Privacy Act

· About Washington Privacy Act

Key Takeaways

  • Washington does not currently have a general consumer privacy law enacted under the name “Washington Privacy Act”; the name has referred to multiple bills, and the latest broad version in 2025–2026 was not the operative statewide consumer privacy regime.[1][2]
  • Washington’s operative statewide privacy law for consumer health data is the Washington My Health My Data Act, which applies to regulated entities and small businesses handling consumer health data and became effective in stages beginning in 2024.[3]
  • The My Health My Data Act requires a consumer health data privacy policy, consumer rights handling, valid authorization for certain disclosures and sales, geofencing restrictions, and data processing contracts for processors.[3]
  • Enforcement authority sits with the Washington Attorney General, and violations are treated as unfair or deceptive acts under Washington’s consumer protection framework.[3]
  • For 2026 compliance planning, teams should treat Washington as a high-enforcement privacy state for consumer health data, while monitoring pending or newly enacted 2025–2026 bills that may add overlapping obligations or delayed effective dates.[1][2][4]

What It Is

Washington’s current operative privacy statute is the My Health My Data Act, codified in chapter 19.373 RCW, which regulates the collection, processing, sharing, selling, and disclosure of consumer health data.[3] The law is enforced by the Washington Attorney General through state consumer protection remedies, not by a separate sectoral privacy regulator.[3]

The act’s core effective dates are 31 March 2024 for most covered entities and 30 June 2024 for small businesses for the principal obligations, with some separate provisions taking effect later.[3] Washington’s 2025–2026 legislative session also produced broader personal-data bills, including HB 1671, but the legislative materials available in 2026 show effective dates and expirations tied to that bill rather than a settled, enacted general privacy code; as of the materials reviewed, that broader regime should be treated as proposed or transitional unless and until a final enrolled law is confirmed.[1][2]

Who Must Comply

The My Health My Data Act applies to a regulated entity, meaning a person that conducts business in Washington or produces or provides products or services targeted to Washington residents and that determines the purpose and means of collecting, processing, sharing, or selling consumer health data, as well as to small businesses subject to the statute’s narrower timing rules.[3]

The law has extraterritorial reach because it covers entities that target Washington consumers, not just businesses physically located in the state.[3] It is especially relevant to health apps, fertility, fitness, mental health, wellness, wearables, adtech, data brokers, and any business that handles data linked or reasonably linkable to an individual’s health status, condition, or care.[3]

The statute includes exemptions for certain entities and data types, including information already regulated under federal health privacy law in some circumstances, but those exemptions are narrow and should not be assumed to cover mixed-use consumer health data environments.[3] Washington’s broader consumer privacy bills from 2025–2026 may have separate thresholds or carve-outs, but those should be reviewed bill-by-bill because the session materials show evolving provisions rather than a single settled general-law framework.[1][2]

Core Requirements

  1. Publish a consumer health data privacy policy. Covered entities must clearly and conspicuously disclose the categories of consumer health data collected, purposes of use, categories of sharing, consumer rights, and contact information for exercising those rights.[3]
  1. Honor consumer rights requests. The statute requires mechanisms for access, deletion, correction, and withdrawal of consent or authorization where applicable, together with a process that is understandable and available to Washington consumers.[3]
  1. Obtain valid authorization for certain sales and disclosures. Selling consumer health data or sharing it for certain purposes requires consumer authorization that meets statutory content and form requirements.[3]
  1. Restrict geofencing around health-care facilities. The law prohibits geofencing used to identify or track consumers seeking in-person health care, collect consumer health data, or deliver targeted messages tied to such data or services.[3]
  1. Use processor contracts. Controllers must have contracts governing processors’ handling of consumer health data, including instructions, confidentiality, security, and deletion/return obligations.[3]
  1. Maintain reasonable security. Covered entities must implement security safeguards proportionate to the sensitivity of consumer health data, which in practice should be mapped to a formal control framework such as ISO 27001 or NIST CSF 2.0.[3]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Main obligations for regulated entities | 31 March 2024 | Consumer health data privacy policy, authorization, security, geofencing, and related operational duties begin.[3] | | Main obligations for small businesses | 30 June 2024 | Small-business compliance date for key consumer health data obligations.[3] | | Later staged provisions | 1 August 2026 | Some statutory sections in later bills and amendments take effect on this date; confirm the final enrolled text before relying on them.[1][2] | | Temporary or expiring provisions in 2025–2026 bill text | 1 August 2027 | Certain sections in HB 1671 were drafted to expire on this date, indicating a transitional legislative structure.[1] |

Washington’s My Health My Data Act does not create a private right of action comparable to some other consumer laws; enforcement is generally through the Attorney General and the Washington Consumer Protection Act framework.[3] Violations can expose a company to injunctions, restitution-style relief, civil penalties, and other consumer-protection remedies, with the practical risk shaped by the state’s enforcement discretion and the underlying misconduct.[3]

How to Comply

  1. Map data and use cases. Inventory consumer health data sources, downstream sharing, retention, and purpose limitations, then classify where Washington residents are in scope.[3]
  1. Build a rights workflow. Create intake, identity verification, response tracking, and deletion/correction procedures for consumer requests, with documented service-level targets.
  1. Rewrite external notices. Update privacy notices, just-in-time notices, and authorization flows so disclosures are specific, conspicuous, and aligned to actual data practices.[3]
  1. Contract with processors. Use written processor terms that address instructions, confidentiality, subprocessors, security controls, assistance, and post-termination deletion or return.[3]
  1. Adopt a control framework. Map required safeguards to ISO 27001 for baseline security governance, NIST CSF 2.0 for risk and maturity management, and ISO 42001 where AI systems infer or profile health-related attributes.
  1. Test geofencing and adtech restrictions. Review SDKs, mobile app location logic, advertising pixels, and audience-building tools to ensure no prohibited in-person health-care geofencing occurs.[3]
  1. Run assessments for high-risk processing. Where consumer health data is used for profiling, advertising, or large-scale analytics, perform documented privacy impact and security assessments before launch and on material change.
  1. Track legislative deltas. Monitor Washington’s 2025–2026 privacy bills and Attorney General guidance so compliance maps reflect enacted amendments rather than introduced text.[1][2][4]

Related Regulations

  • Washington Consumer Protection Act: Privacy violations under the My Health My Data Act can be enforced as unfair or deceptive practices, so consumer-protection litigation risk is part of the Washington analysis.[3]
  • HIPAA: HIPAA can preempt or narrow state-law obligations for certain covered entities and protected health information, but it does not generally cover consumer health data outside the HIPAA scope.[3]
  • CCPA/CPRA: California’s law is broader for general consumer privacy, while Washington’s law is narrower but more aggressive on consumer health data and geofencing.
  • Colorado Privacy Act: Colorado’s law overlaps on access, deletion, and opt-out rights, but Washington’s health-data-specific authorization model is more prescriptive.
  • Oregon Consumer Privacy Act: Oregon is relevant for multistate compliance programs because it shares core privacy governance concepts, though its trigger tests and enforcement structure differ.

FAQ

Does Washington have a general consumer privacy law?

Not as a settled, statewide general law matching the name “Washington Privacy Act.” The operative Washington statute in force is the My Health My Data Act, while 2025–2026 general privacy bills should be treated as bill-specific unless and until a final enacted text is confirmed.[1][2][3]

Does the law apply to companies outside Washington?

Yes, if they target Washington residents or otherwise conduct business in Washington and determine how consumer health data is collected, processed, shared, or sold.[3] Physical presence in the state is not required.

Does a small business have to comply?

Yes. The statute includes a later compliance date for small businesses and still imposes core consumer health data obligations on them.[3] Smaller size may affect timing, but not automatic exemption.

Does the law require a privacy policy?

Yes. Covered entities must publish a consumer health data privacy policy that clearly explains collection, use, sharing, and consumer-rights practices.[3] A generic enterprise privacy notice is usually not enough if it omits health-data-specific disclosures.

Are health-care companies exempt?

Not categorically. Some HIPAA-regulated activity may be outside the act’s scope, but mixed consumer-facing products, apps, and adtech flows can still be covered if they handle consumer health data beyond HIPAA’s protected-health-information framework.[3]

What are the biggest penalty risks?

The biggest risks are Attorney General enforcement, injunctions, monetary penalties, and consumer-protection claims tied to unlawful disclosure, invalid authorization, or prohibited geofencing.[3] Operational failures in rights handling and contracts can also escalate exposure.

Sources

Put it into practice

More compliance guides