SHB 1671
In CommitteeHouse
Personal data privacy
Protecting personal data privacy.
This status may be delayed. See Action History below for the latest updates.
How does a bill become law?
- Introduced: The bill is filed and assigned a number.
- Committee: A subject-matter committee holds hearings, takes public testimony, and decides whether to advance the bill.
- Floor Vote: The full chamber (House or Senate) debates and votes on the bill.
- Opposite Chamber: The bill repeats the committee and floor vote process in the other chamber.
- Governor: The Governor reviews the bill and decides whether to sign or veto it.
- Signed: The bill has been signed into law.
AI Analysis
This bill establishes comprehensive personal data privacy rights for Washington residents, requiring businesses to obtain clear consent before collecting or using sensitive data—including health and location data—and giving consumers new rights to access, correct, delete, or opt out of data use. It bans deceptive practices like dark patterns and requires businesses to conduct risk assessments for high-data-activity operations.
- Requires affirmative consent—not inferred from inaction—for collecting or using sensitive data (e.g., health, biometric, precise geolocation, financial, government ID), especially for targeted advertising, profiling, or sale.
- Grants Washington consumers the right to access, correct, delete, and port their personal data, and to opt out of targeted advertising, sale of data, or automated decisions with legal or significant effects.
- Prohibits dark patterns—deceptive user interfaces—and bans conditioning access to goods/services on consent to unnecessary data collection.
- Mandates data protection assessments for high-risk processing (e.g., health data, targeted ads, profiling), including balancing benefits and privacy risks, and requires reporting to the Attorney General upon request.
- Adds strong protections for consumer health data, including reproductive, gender-affirming, mental health, and precise location data—defining them broadly to include inferred or derived data (e.g., from algorithms).
Who is affected
- Washington consumers — Washington residents who interact with businesses online or in person and whose personal or health-related data is collected or processed—especially those who use health apps, wearables, or online services that track behavior or location.
- Businesses operating in Washington — Businesses that collect or process personal data of Washington residents—including apps, websites, health tech companies, advertisers, and data brokers—must now obtain consent, provide transparency, and implement new security and compliance measures.
- Health tech and digital health providers — Health app developers, telehealth services, fitness trackers, and other digital health providers must ensure consent and security for sensitive health data, especially around reproductive, gender-affirming, and mental health information.
- Minors and their families — Minors under 18 and children under 13, along with their parents or guardians, gain new protections against unauthorized data collection, profiling, and targeted advertising.
- Advocates and support organizations for vulnerable populations — Advocates and service providers for marginalized communities (e.g., LGBTQ+, racial/ethnic minorities, people with disabilities) gain stronger protections against discriminatory use of data and dark patterns.
Pro/Con Analysis
Stronger case for benefits
Potential Benefits (5)
Grants Washington residents the explicit right to opt out of targeted advertising, sale of personal data, and profiling that produces legal or significant effects—empowering individuals to control how their data is used and reducing surveillance-based manipulation.
Rights & LibertiesPeopleRef: Sec. 3(1)(f)(i)-(iii)Extends robust protections to consumer health data—including reproductive, gender-affirming, mental health, and precise location data—and explicitly includes inferred/derived data, shielding vulnerable populations (e.g., LGBTQ+ individuals, survivors of domestic violence) from discriminatory use or law enforcement access.
HealthcarePeopleRef: Sec. 2(3)(b)Bars processing or sale of personal data for targeted advertising when a controller has actual knowledge a consumer is a minor, protecting children from exploitative data practices and algorithmic profiling.
Rights & LibertiesPeopleRef: Sec. 6(6)Prohibiting dark patterns and conditioning access to goods/services on unnecessary data consent prevents coercive user interfaces and ensures meaningful autonomy in digital interactions.
Rights & LibertiesPeopleRef: Sec. 6(7)(a)Requires risk-benefit assessments for high-risk data processing (e.g., health data, profiling), which can prevent harmful algorithmic decisions (e.g., in insurance, employment, or lending) that disproportionately affect marginalized groups.
Public SafetyPeopleRef: Sec. 8(2)
Potential Concerns (5)
Businesses must limit data collection to what is 'strictly necessary' to provide a specific product or service requested by the consumer, which may require operational redesign, increased documentation, and potential loss of revenue from data-driven business models (e.g., ad-supported platforms, data brokering).
Business & EmploymentPeopleRef: Sec. 6(1)(a)Prohibiting discrimination or retaliation against consumers who exercise privacy rights (e.g., refusing to provide services, charging higher prices) may reduce business flexibility in pricing and service design, especially for small businesses that rely on personalized offerings or loyalty programs.
Business & EmploymentPeopleRef: Sec. 6(7)(a)Mandating data protection assessments for all sensitive data processing—including inferred or derived data—imposes significant compliance costs, especially for startups and small firms lacking legal or privacy engineering resources.
Business & EmploymentLean peopleRef: Sec. 8(1)(d)Requiring a 'clear and conspicuous' privacy notice with detailed data categories, purposes, retention periods, and third-party lists increases legal and technical overhead for small businesses and may create confusion or distrust among consumers unfamiliar with data practices.
Business & EmploymentLean peopleRef: Sec. 6(9)(viii)Allowing first-party advertising but banning targeted advertising for consumers who opt out may reduce ad revenue for content creators and digital platforms, especially smaller ones that lack diversified revenue streams.
Business & EmploymentLean peopleRef: Sec. 6(1)(c)
Who Is Most Affected
Washington residents—especially low-income, LGBTQ+, racial/ethnic minority, and rural individuals—gain stronger control over sensitive data (e.g., health, location), reducing risks of discrimination, stalking, or identity-based harm. However, those without digital literacy or access may struggle to exercise opt-out rights effectively.
Large tech platforms, ad tech firms, and data brokers face significant compliance costs and potential revenue loss from restrictions on data collection and targeted advertising. Small businesses may struggle with implementation but benefit from clearer, standardized rules that reduce legal ambiguity.
Digital health providers (e.g., telehealth apps, fitness trackers) must implement strict consent mechanisms and risk assessments for health data—including gender-affirming and reproductive data—raising liability concerns but also building trust and reducing legal exposure under state health laws.
Minors and families gain robust protections against exploitative data collection and profiling, especially for children under 18. However, parental consent requirements may conflict with teens’ desire for digital autonomy, and enforcement may lag in fast-changing app ecosystems.
Advocates for marginalized groups gain stronger legal tools to challenge discriminatory data practices and algorithmic bias. However, enforcement depends on state resources, and corporations may respond by limiting services rather than changing practices.