Skip to main content
Evergreen Ledger

SHB 2483

In Committee

House

Data broker registry

Creating a data broker registry.

This status may be delayed. See Action History below for the latest updates.

How does a bill become law?
  1. Introduced: The bill is filed and assigned a number.
  2. Committee: A subject-matter committee holds hearings, takes public testimony, and decides whether to advance the bill.
  3. Floor Vote: The full chamber (House or Senate) debates and votes on the bill.
  4. Opposite Chamber: The bill repeats the committee and floor vote process in the other chamber.
  5. Governor: The Governor reviews the bill and decides whether to sign or veto it.
  6. Signed: The bill has been signed into law.
Introduced: February 3, 2026
Last Action: February 4, 2026
Status: H Approps
View Bill Text (HTML) (opens in new tab)View Bill Text (PDF) (opens in new tab)

AI Analysis

This analysis was generated by AI and may contain errors. It is not legal advice. Always refer to the official bill text for authoritative information.
People & CommunitiesPeople-leaningCorporate & Wealthy Interests

This bill creates a data broker registry requiring businesses that collect and sell or license personal data about Washington residents to register with the Department of Licensing, disclose how they use data, and provide opt-out options. It aims to increase transparency and consumer control over personal data.

  • Creates a new chapter in Title 19 RCW establishing a data broker registry administered by the Department of Licensing.
  • Requires data brokers to register annually with the Department of Licensing beginning January 1, 2027, and disclose details such as types of data collected, security practices, and opt-out procedures.
  • Exempts certain activities from registration, including businesses that only share publicly available professional data, health/safety alerts, directory services, or occasional asset sales.
  • Imposes a $1,000 per day fine for operating as an unregistered data broker in Washington.
  • Makes registration information publicly available on the Department of Licensing’s website to increase transparency.
  • Amends the Uniform Regulation of Business and Professions Act to include data brokers under the Department’s disciplinary authority.

Who is affected

  • Data brokers — Must register with the Department of Licensing and publicly disclose how they collect, use, and share personal data of Washington residents, including biometric and health data, and provide opt-out mechanisms.
  • Washington residents — Gain transparency about which businesses collect and sell their personal data, and gain the right to opt out of data sharing or designate someone to do so on their behalf.
  • Unregistered data brokers — May face fines of $1,000 per day for operating as a data broker in Washington without registering after January 1, 2027.
  • Department of Licensing — Must ensure compliance with registration requirements and may be subject to disciplinary action under the Uniform Regulation of Business and Professions Act if they fail to register or provide false information.
Effective: 2027-01-01Fiscal impact: The bill requires data brokers to pay registration fees to cover the Department of Licensing's administrative costs. Fees collected will go into the Business and Professions Account. No direct state appropriation is required.
Model: Intel/Qwen3-Coder-Next-int4-AutoRoundGenerated: Mar 19, 2026 at 8:02 PM

Pro/Con Analysis

Stronger case for benefits

Potential Benefits (5)

  • Makes registration disclosures publicly available on the Department of Licensing website, enabling Washington residents to identify which companies are collecting and selling their personal data—including biometric and health data—thereby empowering informed consent and targeted opt-out decisions.

    Rights & LibertiesPeopleRef: Sec. 5

  • Grants Washington residents the explicit right to opt out of data brokering activities and to specify which categories of their data they wish to exclude—giving individuals concrete control over sensitive information like geolocation and consumer health data.

    Rights & LibertiesPeopleRef: Sec. 4(1)(c)(vi)–(vii)(B)

  • Requires data brokers to disclose security practices and volume of data collected per month, which—while not binding them to specific safeguards—creates public accountability and enables civil society or state enforcement to identify high-risk actors.

    Public SafetyPeopleRef: Sec. 4(1)(c)(ii)–(iii)

  • Mandates disclosure of whether consumer health data (as defined in RCW 19.373.010) is brokered—helping residents understand if sensitive health information (e.g., reproductive, mental health, HIV status) is being shared without their knowledge.

    HealthcarePeopleRef: Sec. 4(1)(c)(v)

  • Applies to *any* business entity that collects and sells/licenses brokered personal data, including sole proprietors and micro-businesses—ensuring broad coverage and preventing regulatory arbitrage by small actors.

    Business & EmploymentPeopleRef: Sec. 3(1)
Potential Concerns (5)

  • Imposes a $1,000-per-day civil fine for unregistered operation as a data broker, which could penalize small operators or startups that lack legal resources to interpret compliance thresholds—though enforcement discretion and de minimis defenses may mitigate this.

    Business & EmploymentRef: Sec. 3(3)

  • Requires data brokers to disclose which specific data elements and activities individuals may opt out of, but does not mandate that opt-out mechanisms be simple, accessible, or effective—leaving room for deceptive or burdensome interfaces (e.g., requiring multiple steps, third-party logins, or paper forms).

    Rights & LibertiesRef: Sec. 4(1)(c)(vii)(A)–(B)

  • Exempts financial institutions and consumer reporting agencies regulated under federal law (GLB Act, FCRA), meaning most data brokers in Washington’s financial-technology and credit-scoring sectors are excluded—reducing the bill’s real-world coverage and effectiveness.

    Business & EmploymentRef: Sec. 2(4)(a)–(b)

  • Exempts “occasional” asset sales, but does not define “occasional”—potentially allowing large brokers to structure transactions to fall outside registration, undermining transparency goals.

    Business & EmploymentRef: Sec. 2(4)(a)–(b)

  • Requires only that opt-out methods be *described*, not that they be functional, immediate, or verified—enabling brokers to list a method (e.g., “email us”) without ensuring it actually stops data sharing.

    Rights & LibertiesRef: Sec. 4(1)(c)(viii)

Who Is Most Affected

Data brokersMixed Impact

Must register and disclose data practices; compliance costs may fall disproportionately on small operators without legal teams, but the requirement also deters exploitative data practices and builds trust for ethical operators.

Washington residentsPositive Impact

Gain transparency and opt-out rights, especially those with sensitive data (health, location, biometrics); however, the burden of monitoring and exercising opt-out remains on individuals, and exemptions limit full protection.

Unregistered data brokersNegative Impact

Face civil fines up to $1,000/day for noncompliance, but the fine structure is capped and may be mitigated by good-faith correction—more impactful for unregistered brokers who ignore the law than for compliant ones.

Department of LicensingMixed Impact

Gains regulatory authority over a new sector, but must fund operations through fees—potentially straining limited DOL resources without additional staffing or expertise in data governance.

Ad-tech and data-aggregation firmsNegative Impact

Large tech platforms and ad-tech firms that rely on data brokering (e.g., data aggregators, marketing tech firms) will face new disclosure and opt-out obligations, increasing compliance costs but also standardizing industry practices.