Bill > HB1671

This bill establishes comprehensive personal data privacy protections for Washington state residents, introducing detailed regulations for how businesses (called "controllers") collect, process, and transfer personal data. The legislation defines personal data broadly, including any information that can identify or be linked to an individual, and creates extensive consumer rights such as the ability to confirm what data is being collected, access and correct that data, delete personal information, and opt out of targeted advertising or data sales. Companies must obtain affirmative consent before collecting sensitive data, which includes health information, racial or ethnic origin, sexual orientation, and precise location data. The bill requires businesses to provide clear privacy notices, implement robust data security practices, and conduct data protection assessments for high-risk processing activities. Notably, the law prohibits discriminatory data processing and prevents companies from retaliating against consumers who exercise their privacy rights. The attorney general will be responsible for enforcement, with a 30-day cure period for businesses before potential legal action. The law applies to businesses conducting business in Washington or targeting Washington residents, with specific exemptions for government entities, certain types of research, and some healthcare-related data processing. The bill aims to give consumers more control over their personal information and hold businesses accountable for responsible data handling practices.

Budget and Finance, Business and Industry

https://app.leg.wa.gov/billsummary?BillNumber=1671&Year=2025&Initiative=false