Washington’s First Data Privacy Report: Every Finding and All 8 Recommendations From the Attorney General

Washington built some of the most aggressive single-issue privacy laws in the country. The My Health My Data Act reshaped how national brands handle anything that hints at a consumer’s health, and the state’s biometric statute has been on the books since 2017. Yet Washington still has no general consumer privacy law. In August 2026, Attorney General Nick Brown’s office published its first Data Privacy Report, a 35-page document that explains why that gap matters and what the office wants the Legislature to do about it.

The report is not a bill and it does not create obligations on its own. It is a policy roadmap from the official who enforces the state’s Consumer Protection Act, which makes it a strong signal of what Washington businesses, and any company that collects data from Washington residents, should expect in the next legislative sessions. This guide walks through every section of the report: how it describes the data economy, the four practices it treats as the core problem, the harms it documents, the results of the office’s 2025 resident survey, its inventory of existing Washington laws, and all eight recommendations. Where the report leans on other states as models, we explain what those models actually require, because those are the provisions most likely to show up in a Washington bill.

We covered the report’s headline call for broader rules when it first appeared in our piece on the Washington Attorney General’s call for broader privacy laws, stronger consent and data broker regulation. This is the long version, built for privacy, legal and product teams who need to plan.

The Report at a Glance

Brown’s opening letter frames the problem in economic terms. Personal information “has become one of the most valuable assets in the modern economy,” and that value pushes institutions to collect, keep and share more than they need. The letter positions the report as the third piece of the office’s privacy work, alongside its annual Data Breach Report and a 2025 statewide Data Privacy Survey.

The executive summary reduces the findings to a handful of numbers that every privacy team operating in the state should know:

• 209 data breaches were reported to the Attorney General’s Office in 2025, affecting just over 8 million Washingtonians.
• More than 80% of those breaches exposed Social Security numbers.
• The 2025 survey drew more than 700 responses from residents in 26 of the state’s 39 counties.
• 83% of respondents said they had little or no control over who can access their personal information.
• 95% said there is no circumstance in which they would be comfortable having personal information collected, shared or sold without informed consent.
• 62% found it difficult or very difficult to opt out of targeted advertising, and 65% said the same about requesting deletion from an app or service.

From there the report makes its central legal claim. Washington has targeted laws for consumer health data, student data, breaches, biometric identifiers and government use of automated license plate readers, but “these protections apply unevenly.” The same type of information can be tightly controlled in one setting and essentially unregulated in another, and the state lacks a common framework for consent, data minimization, transparency, retention and secondary use.

How the Report Describes the Data Economy

The background section defines its terms carefully, and those definitions are worth noting because they hint at the scope of future legislation. The “data economy” is described as an ecosystem in which personal information is collected, organized, analyzed, shared or sold by a network of public and private institutions. “Institution” is used broadly to mean businesses, government agencies, nonprofits, universities and other entities, and any institution that collects personal information is a “data collector.”

That breadth is deliberate. Several comprehensive state laws exempt nonprofits, and almost all of them exclude government agencies. The Washington report repeatedly treats public agencies as part of the same problem, and two of its recommendations are aimed at agencies directly. A future Washington framework may not carve out the public sector as cleanly as the laws in California, Colorado or Connecticut.

The report then explains why the market rewards collection. Personal information is valuable because it supports inferences about a person’s interests, routines, income range, health concerns or likely behavior. Those inferences feed consumer profiles and audience segments sold to advertisers. Data brokers add to the pile by combining information from data collectors, public records, social media and other sources. As data is copied and combined, it “can become far removed from the original interaction that generated it,” which makes it hard for anyone to know who holds it, whether it is accurate or how to regain control.

The diagram above is the report’s most useful teaching tool. It shows consumers providing data directly to data collectors (step 1A) while brokers gather it indirectly from public records and social media (step 1B). Data collectors pass information to third parties for processing and new inferences (step 2) and may share or sell it to brokers (step 3). Advertisers buy broker profiles and segments (step 4) and use them to target the same consumers (step 5). The report adds a caveat that the real path “varies by service, business model, contract, and applicable law.”

For compliance teams, the diagram doubles as a checklist. Every arrow is a disclosure your privacy notice should describe, a contract term your vendor agreements should cover, and a flow your data map should capture. If you cannot draw this picture for your own company, you will struggle with every recommendation that follows.

Four Practices the Attorney General Treats as the Core Problem

The report identifies four recurring practices that, in its words, “separate the collection and use of personal information from the expectations and choices of the people that information describes.”

1. Overcollection and secondary use

Overcollection is gathering more personal information than is reasonably necessary to provide the product or service a person asked for. Secondary use is using data for a purpose unrelated to the interaction that produced it. The report’s example is simple: a player gives a video game company contact details to create an account, and the company later shares those details with a marketing agency for targeted ads. The more an organization collects and keeps, the more chances it has to repurpose data, and the bigger the damage when that data is breached.

2. Weak consent requirements and deceptive design

Important information about how data is used is often confusing, bundled with unrelated terms, or buried in privacy policies people will not read. The report defines informed consent as requiring clear information, plain language, a voluntary choice and a reasonable opportunity to decline, and it states plainly that consent “is not considered informed simply because a person clicked a button or agreed to a lengthy privacy policy.”

Deceptive design makes things worse. The report lists familiar patterns: a prominent “accept all” button paired with a hard-to-find reject option, bundled consent for unrelated uses, misleading button labels, and choices that are much harder to reverse than to make. These are the same patterns California regulators targeted in their 2024 enforcement advisory on symmetry in choice, which the report cites. Our guide to dark pattern examples in UX and design walks through how these show up in real interfaces.

3. Collection and sale of sensitive data

The report singles out biometric identifiers and precise geolocation. A compromised password can be changed, but a fingerprint or face template cannot. Precise location can reveal a person’s home, workplace, doctors, place of worship and other sensitive places. This data is valuable precisely because it identifies people with greater certainty or reveals detailed patterns, and without safeguards it creates “lasting risks of surveillance, physical violence, emotional distress, and other misuse.”

4. Limited consumer visibility into data broker practices

Data brokers usually have no direct relationship with the people whose data they hold. A person cannot request access, correction, deletion or an end to sale when they do not know which companies have their information. The report notes that, despite earlier legislative attempts (it cites HB 2483 from the 2025–26 session), Washington does not require brokers to register and has no central system for deletion or opt-out requests.

The Harms the Report Documents

The harms section moves from theory to evidence. It groups the damage into three categories.

Breaches, scams and identity theft

Breaches are described as “among the clearest and most measurable privacy harms” in the state. Washington’s breach law requires notice to the Attorney General when a breach affects more than 500 residents, which is how the office can count them. In 2025 it received notices for 209 separate breaches, detailed in its 2025 Data Breach Report, affecting just over 8 million people. That was the second year in a row in which breach notices outnumbered the state’s population, which suggests many residents were hit more than once.

The report draws a direct line from collection practices to breach impact. Notices help people protect themselves, but they “cannot recover information that has already been copied or prevent future misuse.” Overcollection and unnecessary retention increase the scale of every incident because there is simply more to steal. That argument is the bridge between the harms section and the data minimization recommendation later in the report, and it is the strongest business case a privacy team can make internally: data you never kept cannot be breached.

Harassment, abuse and unequal impact

Exposed details make phishing, spoofing and impersonation more convincing. The report notes that older adults are disproportionately targeted by fraud and that young people face distinct risks from cyberbullying. Home addresses, photographs, location histories and details about relationships can enable stalking and threats, and broker sales make that information easier to obtain and combine.

Two federal cases illustrate the point. In its action against Kochava, the FTC alleged the company sold location data that could identify visits to reproductive health clinics, places of worship and domestic violence shelters. In its Mobilewalla complaint, the FTC alleged the company collected or sold location data tied to political protests, tried to track union organizers, and helped clients target pregnant women, Hispanic churchgoers and LGBTQ+ people through custom audience segments. These are allegations from FTC complaints, and the report presents them that way. The report’s broader conclusion is that privacy harms “do not affect everyone equally” and fall hardest on people whose safety, health care, employment or public participation depends on keeping their identity, location or associations private.

Surveillance pricing and data discrimination

The third category is how data shapes what people pay and what opportunities they see. The report cites 2025 FTC staff research finding that retailers can use location, demographics, browsing and purchase history, and even mouse movements to tailor prices and discounts, for example by withholding a discount from customers predicted to buy anyway. It also cites the Justice Department’s 2022 settlement requiring Meta to stop using its Special Ad Audience tool for housing ads, after DOJ alleged the tool relied on characteristics protected by the Fair Housing Act. Meta agreed to redesign its ad delivery system to reduce disparities.

When the data or assumptions behind these decisions are wrong, people can be treated unfairly “without knowing why or having a practical way to correct the record.” Even accurate data can be used to spot when someone is vulnerable or likely to pay more. Companies experimenting with dynamic pricing should read this section alongside our surveillance pricing compliance guide, because this is an area where state attorneys general are actively looking for test cases.

What 700 Washingtonians Told the Attorney General

The survey section is short but pointed. The office ran its Data Privacy Survey in 2025 and received more than 700 responses from 26 counties. It is worth being precise about what this is: a voluntary public survey, not a statistically weighted poll, so the percentages describe respondents rather than the whole state. The report does not claim otherwise.

A lack of control

Eighty-three percent said they had little or no control over who can access their personal information. Many blamed confusing privacy policies, limited choices, and uncertainty about where data goes after collection. One King County respondent summed it up: “So many entities send out complicated notices about what they do with my personal info, that I wind up feeling pretty powerless about having any control in the matter.”

Low trust across every type of institution

When asked which institutions they trust to keep their information private and secure, 55% chose “none of the above.” Businesses scored worst of all.

Institution	Share of respondents who trust it
Businesses	1%
Federal agencies	4%
Nonprofit organizations	8%
Academic institutions	10%
Financial institutions	23%
State or local agencies	24%
Health care	30%
None of the above	55%

A 1% trust score for businesses is the kind of number that ends up in floor speeches. It also tells marketing and product leaders something practical: in Washington, transparency is a competitive opening, because almost nobody believes companies are doing it now.

Informed consent and the difficulty of exercising rights

Respondents were given a definition of informed consent that required clear, plain-language disclosure, a free choice and the ability to withdraw. Under that standard, only 47% said they had ever given informed consent to an institution collecting, sharing or selling their data, and another 25% were unsure. Ninety-five percent said they would never be comfortable with collection, sharing or sale without informed consent. A second respondent quote calls for data collection to be “opt-in and revocable.”

Exercising choices was hard. Sixty-two percent found it difficult or very difficult to opt out of targeted advertising, and 65% said the same about deletion requests. The report’s takeaway is that residents want transparency, consent before collection or sharing, and easy ways to use their rights.

Washington’s Existing Privacy Laws and Where They Stop

The legal section starts with context. The GDPR sets broadly applicable standards, requiring a lawful basis for processing and principles such as data minimization, purpose limitation, storage limits, security and accountability, and the report calls it a continuing model worldwide. The United States has no comparable federal law and relies on sector statutes such as HIPAA, FERPA and COPPA. States including California, Colorado, Oregon and Connecticut have filled the gap with broader laws. “Washington has not enacted a comparable, generally applicable consumer privacy law,” the report states.

The report then profiles five Washington statutes. Here they are in one place, with the coverage and limits the report assigns to each.

Law	Citation and date signed	What it covers and does	Limitation the report identifies
Data Breach Notification Law	Ch. 19.255 and RCW 42.56.590; May 10, 2005	Requires notice to affected residents and to the Attorney General when a breach affects more than 500 Washingtonians	Reacts after exposure; does not limit collection or retention
Student User Privacy in Education Rights Act	Ch. 28A.604 RCW; May 14, 2015	Student data collected through certain K–12 online services: disclosure, access and correction rights, ban on sale and targeted ads, limits on profiling, security, deletion at the school’s request	Applies only to qualifying K–12 services, not general-audience sites and apps
Biometric Privacy Protection Act	Ch. 19.375 RCW; May 16, 2017	Limits when businesses can create, share and retain biometric identifiers used for commercial purposes	Excludes government agencies and excludes photos, video, audio and data generated from them
My Health My Data Act	Ch. 19.373 RCW; April 27, 2023	Consumer health data: notices, consent for certain collection and sharing, deletion rights, authorization before sale, limits on location tracking near health care facilities	Limited to consumer health data; does not apply to government use
Driver Privacy Act	Ch. 10.130 RCW; March 30, 2026	Limits state and local agency use, sharing, retention and purchase of automated license plate reader data	Does not directly regulate private ALPR systems

The report also mentions protections for medical records, consumer reports, secure disposal of personal information, and public records exemptions. If you need the operational detail on the health law, our guide to Washington’s My Health My Data Act covers consent, authorization and the geofencing ban.

Why the report calls protection “fragmented”

The report credits the targeted laws with closing real gaps. My Health My Data reaches health data HIPAA does not, the Driver Privacy Act puts guardrails on a public safety technology, and the breach law gives residents and policymakers useful information. The problem is that protection depends on the context of collection rather than the sensitivity of the data. Two examples make the point:

• Location data is protected when it is tied to health care or collected through a public agency’s license plate reader system, but not when collected for another commercial or public safety purpose.
• Biometric data from a fingerprint may qualify as a biometric identifier, while photos, videos and audio of the same person, and data derived from them, are excluded from the biometric statute.

The result, the report says, is that residents struggle to know which rules apply to them, and Washington law “does not consistently require all institutions to obtain informed consent, minimize collection, explain how information will be used, limit how long it is retained, or restrict its use for unrelated purposes.”

The Eight Recommendations

The recommendations fall into three groups: policy, enforcement and education. Each one ends with a short “call to action.” We summarize each and add what it would likely mean for a company in scope.

Policy: strengthen baseline protections

Recommendation 1: Require meaningful and informed consent, and ban deceptive design

The Legislature should require consent before collecting, using or sharing personal information “beyond what is reasonably necessary to provide a requested product or service.” Consent mechanisms should be clear, balanced and easy to navigate, with a genuine option to decline. Practices should be disclosed in plain language, not buried in long legal documents. Choices should be easy to exercise, and where feasible policymakers should consider centralized mechanisms so people do not have to contact each company separately. Rights processes should be timely, because “lengthy delays or repeated appeals” undermine them. The Legislature should explicitly prohibit deceptive design.

The models cited are specific. California requires privacy-protective choices to be as easy as less protective ones. Connecticut and Oregon require that consent be at least as easy to withdraw as to give. Colorado requires covered companies to honor qualifying universal opt-out mechanisms. That last point matters for anyone running a consent banner: a Washington law built on these models would almost certainly require recognition of browser signals such as Global Privacy Control.

What it would mean in practice: reject options as prominent as accept options, no pre-ticked boxes, separate consent for unrelated uses, a withdrawal path as short as the opt-in path, and automated handling of opt-out signals. Remember that a banner is not proof that tracking is blocked. Regulators test what fires before and after a choice, so the scan of your live site matters more than the design file.

Recommendation 2: Data minimization and limits on secondary use

Collection, use and retention should be limited to what is reasonably necessary to provide a product or service the consumer requested, and secondary uses unrelated to the original interaction should be restricted. The report rejects keeping data “simply because it may have future commercial value,” and says consumers should not have to accept unnecessary collection as a condition of service.

California’s standard, as cited, requires collection, use, retention and sharing to be reasonably necessary and proportionate to stated purposes, with retention limits. Oregon limits collection to what is adequate, relevant and reasonably necessary, and requires consent before data is used for an incompatible secondary purpose. Note the phrase “requested by the consumer.” That is closer to the stricter Maryland-style standard than to the disclosure-based minimization in many state laws, and it would force companies to justify each data element against the service actually provided.

Recommendation 3: Stronger protections for biometric and precise geolocation data

Companies should obtain clear, informed consent before collecting biometric or precise location data, the sale and unnecessary commercial use of that data should be strictly limited or prohibited, and retention should be capped. The report’s example: a weather app may need approximate location for a forecast but should not keep or sell a detailed history of a user’s movements.

The models are Virginia and Oregon, whose comprehensive laws already require consent before processing precise geolocation, and their newer bills, Virginia’s SB 338 and Oregon’s HB 2008, which prohibit its sale. A Washington law along these lines would also close the photo and video gap in the current biometric statute, which is significant for any business using facial analysis on images.

Recommendation 4: Register data brokers and give residents deletion and opt-out rights

Brokers processing Washingtonians’ data should register annually and disclose the types of information they collect, sell or share, published in a public registry. The report pairs registration with four obligations: safeguards appropriate to the sensitivity and volume of data, limits or bans on selling sensitive data, honoring deletion and sale-or-sharing opt-outs, and a centralized mechanism to send those requests to every registered broker at once.

The models are registration laws in California, Oregon, Texas, Vermont and New Jersey. Vermont requires a comprehensive information security program. California’s Delete Request and Opt-Out Platform, known as DROP, lets residents send one deletion request to all registered brokers. We have explained how that system works in our article on California’s DROP system and what it means for data brokers. If Washington copies it, brokers would need repeatable, auditable processes for matching and deleting records in bulk on a fixed schedule.

Enforcement: strengthen enforcement and institutional capacity

Recommendation 5: Clear, practical and accountable enforcement

“Privacy rights are only meaningful when they can be effectively enforced,” the report says, and it proposes three principles:

1. Clarity: the law should say who enforces it (regulators, consumers or both) and what the consequences are.
2. Practicality: enforcers need legal authority, tools and resources, and obligations should be specific enough that regulated entities can comply.
3. Accountability: penalties should be large enough and timely enough to change behavior.

Options include using the existing Consumer Protection Act, creating dedicated funding, or building a new framework with investigations, penalties, rulemaking and reporting. The report highlights three features from other states. Colorado gives its Attorney General rulemaking power and gives the AG and district attorneys exclusive enforcement authority. California gives the California Privacy Protection Agency rulemaking and administrative enforcement power while keeping the Attorney General’s civil enforcement role, and directs 95% of fines and civil penalties back into funds that support that work. On accountability tools, Colorado requires data protection assessments for high-risk processing, and California’s regulations, effective January 1, 2026, require risk assessments for significant-risk processing and annual cybersecurity audits for businesses whose processing presents significant security risk.

The report deliberately avoids taking a side on a private right of action. “Regulators, consumers, or both” leaves the door open, and since My Health My Data already lets consumers sue through the Consumer Protection Act, businesses should not assume a future Washington law will be AG-only. The report also asks lawmakers to review existing privacy laws through the same lens, which could mean amendments to statutes already on the books.

Recommendation 6: Build privacy capacity in state agencies

This recommendation is aimed at government. The report cites WaTech’s 2025 State Agency Privacy Assessment, which found growing awareness and broader adoption of formal privacy policies, and says the need for privacy practices is growing as agencies adopt AI tools. It encourages agencies to work with the Office of Privacy and Data Protection (OPDP) and use its guidance, and asks the Legislature to fund dedicated privacy staff where appropriate, scaled to each agency’s size, mission, data holdings and risk.

The report describes what a privacy lead would do: inventory personal information, review projects involving personal data, coordinate privacy impact assessments, train staff, advise on data sharing and vendor agreements, maintain notices and act as OPDP’s contact. Vendors selling to Washington agencies should expect sharper privacy questions in procurement and contract terms as this capacity grows.

Education: raise digital literacy

Recommendation 7: Free public resources on privacy

Many residents do not know where their data goes and struggle to exercise choices. The report cites research on “privacy fatigue,” where people disengage because privacy decisions feel overwhelming, and on how the design of choices pushes people toward more or less protective decisions. It recommends that the AGO’s Tech Policy Team work with consumer advocates on plain-language resources covering device security, deceptive design, tracking cookies, data sharing risks and privacy settings.

Recommendation 8: Help small businesses with security and compliance

Small businesses often lack the time, staff and money for privacy and security work, and the consequences of a failure can include financial harm and lost customer trust. The Tech Policy Team should partner with business associations to build practical resources that lower the barrier to responsible data management for companies without legal or IT teams. The report calls it “a win-win for privacy.”

What Is Proposed and What Is Already Law

Because the report mixes descriptions of current law with recommendations, it is easy to blur the two. Keep them apart:

• Already law in Washington: breach notification, the student privacy act, the biometric act, My Health My Data and the Driver Privacy Act. These carry obligations today.
• Proposed by the Attorney General: a general consent requirement, a deceptive design ban, data minimization and secondary use limits, broader biometric and geolocation rules, broker registration with a central deletion mechanism, enforcement reforms, agency privacy staffing and education programs. None of this binds anyone until the Legislature acts.
• Models from other states: the California, Colorado, Connecticut, Oregon, Virginia, Texas, Vermont and New Jersey provisions the report cites are real law in those states, and if you operate nationally, many already apply to you.

A Practical Readiness Plan for Companies That Serve Washington Residents

Waiting for a bill is a mistake, because most of what the report asks for already exists in other states, and Washington’s Attorney General can bring deceptive practice cases under the Consumer Protection Act now. Here is a sequence that prepares you without overbuilding.

1. Map the flows in the diagram. For each category of personal information, record where it comes from, the purpose, who receives it, how long you keep it and what controls apply. Mark anything that reaches a broker or ad platform.
2. Test necessity element by element. For each data element, ask whether it is needed for the service the consumer requested. Flag elements kept “just in case” and set retention limits.
3. Audit consent for symmetry. Compare accept and reject paths, check for bundled purposes, and confirm withdrawal is as easy as opt-in. Then scan the live site to confirm trackers actually stop when someone declines.
4. Honor universal opt-out signals. If you already process Global Privacy Control for Colorado or California, extend the same behavior to Washington visitors.
5. Treat biometrics and precise location as consent-only. Inventory any face, voice or fingerprint processing, including analysis of photos and video, and any precise location collection. Get opt-in consent and stop selling it.
6. Check your broker exposure. If you buy or sell data without a direct consumer relationship, compare your practices with the California, Texas, Vermont and New Jersey registration rules now.
7. Prove deletion, don’t assume it. A closed ticket is not proof that data is gone from backups, vendors and analytics tools. Build a verification step into every deletion workflow.
8. Run risk assessments for high-risk processing. Colorado and California already require them in many cases, and the report cites both as models. An assessment that is not tied to real controls will not help you, so link findings to fixes.

How Captain Compliance Helps

Captain Compliance builds software for exactly the gaps this report describes. Our consent management platform supports balanced accept and reject choices, granular purposes and recognition of opt-out signals such as Global Privacy Control. Cookie and tracker scanning shows what fires on your pages before and after a visitor decides, which is what regulators test. Data subject request workflows help teams receive, verify, route and document access, deletion and opt-out requests, and our data mapping and assessment tools help you document the flows and risks the report expects you to understand. Software does not make a company compliant on its own, but it gives your team the records to show what you did and when.

Frequently Asked Questions

Does Washington now have a comprehensive privacy law?

No. The 2026 Data Privacy Report recommends one but does not create one. Washington still relies on targeted laws covering breaches, student data, biometrics, consumer health data and government license plate readers.

Who published the Data Privacy Report and when?

The Washington State Attorney General’s Office under Attorney General Nick Brown published it in August 2026. It is the office’s first report of its kind and builds on its annual Data Breach Report and its 2025 Data Privacy Survey.

How many breaches were reported in Washington in 2025?

The office received notices for 209 breaches affecting just over 8 million Washingtonians, and more than 80% of those breaches exposed Social Security numbers. More than 47 million breach notices have gone to residents since 2017.

Does the report recommend a data broker registry?

Yes. It calls for annual broker registration, a public registry, security safeguards, limits on selling sensitive data, honoring deletion and opt-out requests, and a central mechanism similar to California’s DROP.

Would a Washington law cover government agencies?

The report treats agencies as data collectors and recommends funding privacy staff and OPDP partnerships, but it does not specify whether a general consumer law would apply to the public sector. That is a question for the Legislature.

Does the report support a private right of action?

It does not commit either way. It says laws should identify whether enforcement rests with regulators, consumers or both, and it suggests the Consumer Protection Act as one possible vehicle.

How reliable are the survey numbers?

The survey had more than 700 respondents from 26 of 39 counties. It describes the people who responded, and the report does not present it as a weighted statewide poll, so treat the percentages as strong signals rather than precise population estimates.

What should a company do before any bill passes?

Map data flows, cut unnecessary collection, fix consent symmetry, honor universal opt-out signals, get opt-in consent for biometric and precise location data, and confirm that deletion requests actually remove data. Most of these steps are already required somewhere else in the country.

The Question for Olympia

The report closes its legal analysis by saying Washington’s remaining challenge is to make its protections “more consistent and intuitive.” That is a polite way of describing a state that wrote some of the toughest privacy rules in the country for health data and almost none for everything else. Its residents have already given their verdict: one in a hundred trusts businesses with their information. The Attorney General has now put a blueprint on the table. Whether lawmakers build a full framework or keep adding single-topic statutes will decide whether Washington leads on privacy again or keeps patching gaps after each breach.