Washington Attorney General Nick Brown says one of the country’s largest technology hubs still has significant work to do on consumer privacy, despite the state’s growing collection of sector-specific privacy laws and enforcement tools.
Speaking at the IAPP Privacy. Security. Risk. + AI Governance Global 2026 conference in Seattle, Brown said Washington is “behind where we should be” when it comes to comprehensive privacy legislation. The state has repeatedly considered broad consumer privacy proposals but has never joined states such as California, Colorado, Connecticut and Virginia in adopting a generally applicable comprehensive privacy statute.
“It’s disappointing to me that we don’t yet have a comprehensive privacy framework,” Brown said.
The comments come roughly two months after Brown’s office released Washington’s first Data Privacy Report, which called for stronger privacy protections, enforcement and consumer education. The August report identified concerns including excessive data collection, secondary uses of personal information, data breaches, surveillance and harassment.
Among the policy priorities discussed by Brown’s office are stronger consent requirements, additional protections for biometric and precise geolocation data, and registration requirements for data brokers.
“For those who follow state politics, you’ll know that Washington came very close to passing comprehensive privacy legislation several years ago,” Brown said. “There were difficult negotiations involving major technology companies, privacy advocates, and other stakeholders. Ultimately, consensus wasn’t reached.”
That history is notable because Washington was once expected to become one of the earliest states to adopt a comprehensive privacy law. Multiple versions of the Washington Privacy Act advanced through the Legislature but repeatedly failed after lawmakers disagreed over issues including enforcement and private rights of action.
Brown said he hopes lawmakers revisit the issue, but his office is not waiting for a comprehensive statute before using the privacy laws already available.
“We’re advancing privacy protections in specific areas where we can make progress.”
“A key part of Washington’s culture and legal tradition is a strong commitment to individual privacy,” he added. “That’s reflected in our Consumer Protection Act, which remains one of our primary enforcement tools.”
That is particularly relevant for businesses because Washington already has several privacy laws that can create substantial compliance obligations even without a CCPA-style omnibus statute.
The most prominent example is the state’s My Health My Data Act.
My Health My Data remains Washington’s privacy wildcard
Washington enacted the My Health My Data Act in 2023 amid growing concern over health information collected outside traditional healthcare environments.
The law applies broadly to “consumer health data” and regulates collection, sharing and sale while imposing significant consent and disclosure requirements. It was particularly notable because violations can be enforced through Washington’s Consumer Protection Act, which provides a private enforcement mechanism in addition to attorney general authority.
Those provisions initially caused widespread concern that Washington could become a major venue for consumer health privacy litigation.
That wave has not yet materialized.
During the IAPP discussion, Brown addressed why his office has also been relatively restrained in publicly enforcing the law.
“We’ve been thoughtful about enforcement because the law is still relatively new,” Brown said.
He emphasized that enforcement is only one part of the attorney general’s role and that his office also wants companies to understand how to comply before disputes escalate.
“Our role isn’t simply to file lawsuits,” he said. “Our goal is to help Washington residents. Sometimes that requires litigation, but whenever possible, we want to resolve problems without going to court.”
That should not be interpreted as a signal that My Health My Data will remain lightly enforced indefinitely.
“As awareness grows and the law matures, we may see more cases. But if compliance can be achieved without lengthy and costly litigation, that’s often a better outcome for everyone involved.”
For companies collecting information involving health conditions, reproductive health, location, searches for health services, fitness activity or other information capable of revealing health status, My Health My Data remains one of the most important state privacy statutes to evaluate.
Washington is balancing privacy against its technology economy
Washington also occupies an unusual position in the national privacy debate because it is home to some of the world’s largest technology companies, including Microsoft and Amazon.
Brown described the state as having a “tremendous amount of innovation” and acknowledged that policymakers have to consider both innovation and privacy when developing rules for modern technology.
“Our approach emphasizes accountability and enforcement while recognizing the realities of modern technology and data use.”
That balancing act helps explain why Washington’s comprehensive privacy debate has historically been difficult. Technology companies, privacy advocates, legislators and other stakeholders have disagreed not necessarily over whether privacy protections should exist, but over how they should be enforced and what rights consumers should receive.
Brown also discussed the practical limits on his office. Washington’s attorney general employs approximately 850 attorneys and staff, but privacy is only one part of a much broader enforcement mandate.
That makes prioritization unavoidable.
Brown described the office as “one of the largest public law offices on the West Coast. Of course, we’d always welcome additional resources, investigators and subject matter experts.”
He also noted that Washington’s attorney general does not possess the same broad criminal authority available to attorneys general in certain other states.
“We can pursue criminal matters under specific circumstances, but our authority differs from states where the attorney general directly manages statewide prosecutions,” he said.
Businesses should not mistake the absence of a comprehensive law for the absence of privacy risk
Washington’s current framework illustrates a broader trend in U.S. privacy law.
A state does not necessarily need one comprehensive privacy statute to create substantial obligations.
Washington already regulates health data and biometrics, while its Consumer Protection Act gives the attorney general a flexible enforcement mechanism. Brown’s August privacy report indicates that his office would like the Legislature to go further.
The immediate message from Brown’s IAPP appearance was therefore somewhat unusual: Washington’s attorney general openly believes the state’s privacy framework is incomplete, while simultaneously signaling that his office intends to continue using the laws already on the books.
Businesses operating in Washington should be watching both sides of that equation.
Comprehensive legislation could return.
In the meantime, My Health My Data and existing consumer-protection authority are very much alive.