Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

The opening weeks of Washington’s 2026 legislative session have yielded a flurry of technology-focused bills spanning privacy, cybersecurity, artificial intelligence, online safety and data governance. While not all of these proposals are likely to advance this year, taken together they reflect a clear policy trajectory: Washington lawmakers are increasingly comfortable regulating digital platforms, algorithmic decision-making and AI systems – often borrowing from frameworks emerging in New York, California, Colorado and the EU, but with distinctive Washington twists.

core/paragraph

Companies deploying AI, collecting consumer data, offering online services or operating in the technology sector in Washington should pay close attention to this session.

Below, we summarize the most consequential bills introduced in or carried over to the 2026 regular session.

core/heading

Washington has long tussled over comprehensive privacy legislation. From 2019 to 2021, successive iterations of the Washington Privacy Act (WPA) passed the Senate before stalling in the House, largely due to unresolved disputes over enforcement – particularly whether consumers should have a private right of action. Even so, those early WPA drafts became influential templates for other states’ privacy laws. In 2021, the more protective People’s Privacy Act (PPA) emerged in the House, based on a model bill developed by prominent privacy advocacy groups. The PPA did not advance, but it became the principal counterweight to the more business-friendly WPA. In 2022, the House attempted a middle path with the Foundational Data Privacy Act, but it failed to gain full traction. In place of comprehensive privacy legislation, the Legislature’s privacy advocates found enough support to <a href="https://www.bakerdatacounsel.com/blogs/an-introduction-to-washingtons-my-health-my-data-act/" target="_blank" rel="noreferrer noopener">enact the My Health My Data Act (MHMD Act)</a>, a sweeping law governing “consumer health data.” Support for the MHMD Act came in 2023, when the Legislature enacted a suite of laws protecting health data and access to healthcare in response to the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.

<a href="https://app.leg.wa.gov/billsummary?BillNumber=1671&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 1671</a> fits within this history and is currently the only comprehensive privacy proposal before the Legislature. Styled as the PPA, it has a broad scope, robust individual rights, strict limits on data use and retention, and heightened protections for sensitive data. <a href="https://www.bakerdatacounsel.com/blogs/examining-the-private-right-of-action-in-washingtons-my-health-my-data-act/" target="_blank" rel="noreferrer noopener">Like the MHMD Act</a>, HB 1671 would allow for a private right of action by making violations of HB 1671 per se violations of the Washington Consumer Protection Act. Unlike the original PPA, however, it lacks an express private right of action with liquidated damages.

If enacted, HB 1671 would establish a statewide privacy framework broadly aligned with other U.S. state privacy laws, imposing obligations on businesses that collect or process the personal data of Washington consumers. Key features would include:

Core compliance obligations for controllers, including strict data minimization and purpose limitation (processing only as “strictly necessary”), security safeguards and data protection assessments (with publicly available summaries).

core/list-item

Consumer rights, including rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale of personal data, and certain profiling activities, including by opt-out preference signal.

Heightened protections for sensitive data, requiring affirmative consent for processing categories such as precise geolocation, biometric data, health data, financial information, and children’s data, and sales of sensitive data flatly prohibited and other transfers requiring affirmative consent.

Automated decision-making safeguards, including transparency and contestability where profiling produces legal or similarly significant effects.

Prohibition on processing in a manner that discriminates on certain protected characteristics, independent of existing anti-discrimination statutes.

core/list

HB 1671 was first introduced in 2025 but has been reintroduced and retained in 2026. It failed to advance in the 2025 session, and without significant changes or a focusing event like Dobbs that rallies the Legislature to a robust comprehensive privacy law, it is likely to stall again. This is especially true because the 2026 legislative session is a short one, lasting only 60 days (Washington’s sessions alternate between long and short each year). Like they did with the MHMD Act, sponsors may have an easier time advancing some of the more narrowly tailored privacy and AI laws proposed this year. We recap these proposed laws below.

Children’s Online Safety and Privacy (HB 1834/SB 5708)

Among the most politically salient proposals this session are companion bills <a href="https://app.leg.wa.gov/billsummary?Year=2025&amp;BillNumber=1834" target="_blank" rel="noreferrer noopener">HB 1834</a> and <a href="https://app.leg.wa.gov/billsummary?BillNumber=5708&amp;Year=2025&amp;Chamber=Senate" target="_blank" rel="noreferrer noopener">SB 5708</a>, introduced at the Washington Attorney General’s request. These bills go well beyond traditional privacy regulation. They impose design and operational obligations on online services that minors are likely to access to protect not only their personal information but also their mental health and general well-being. The obligations build on prior legislative efforts to curb addictive feed designs like algorithmic infinite scrolling and engagement nudging. If enacted, these bills would require many consumer-facing technology companies to reassess their UI/UX, recommendation systems, and age-estimation practices.

Requirements to opt minors in to high-privacy settings choices by default, and provide visible and easy-to-use tools to exercise their privacy rights.

Restrictions on use of minors’ personal data in ways that are reasonably foreseeable to be materially detrimental to physical or mental health or well-being.

Implementing a notification curfew for minors during school hours and overnight.

Mandatory tools to empower all users to disable engagement metrics, limit screen time or view content chronologically.

These bills are part of a burgeoning movement toward creating a safer Internet for children from the ground up. In recent years, California, Connecticut, Maryland, Nebraska and Vermont have enacted youth-focused platform design laws, known as “age-appropriate design codes” (AADCs), requiring platforms to rethink how they engage with children. This movement contends that existing children’s privacy approaches are insufficient because of how particularly vulnerable children are to certain kinds of design patterns.

But this movement has faced legal pushback. Courts have enjoined enforcement of several state AADCs, finding their implementations violated the First Amendment by compelling speech or restricting expression without proper tailoring to protect children. Washington’s companion bills are narrower than these laws in some respects, likely aiming to survive the legal scrutiny that has invalidated similar laws in other states.

The Washington Legislature has seen a flurry of significant AI-related proposals this session, despite federal resistance to state-level AI regulation.

Companion bills <a href="https://app.leg.wa.gov/billsummary?BillNumber=2157&amp;Initiative=false&amp;Year=2025" target="_blank" rel="noreferrer noopener">HB 2157</a> and <a href="https://app.leg.wa.gov/billsummary/?BillNumber=6120&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">SB 6120</a> represent Washington’s most comprehensive attempt to regulate AI systems used in consequential decision-making. They would impose obligations on both developers and deployers of “high-risk” AI systems. AI systems would be considered high risk if intended to autonomously make, or be a significant factor in making, consequential decisions.

A duty for developers and deployers to use reasonable care to mitigate foreseeable risks of algorithmic discrimination.

Developer duties to (1) document and disclose information about high-risk AI systems, (2) maintain risk management programs, (3) conduct impact assessments, and (4) disclose AI interactions to consumers.

A private right of action providing injunctive relief and attorney’s fees, with several defenses, including an affirmative defense for timely curing violations and a rebuttable presumption of conformity if compliant with the ISO/IEC 42001 standard.

Generative AI Training Data Transparency (HB 2503 &amp; HB 1168)

<a href="https://app.leg.wa.gov/billsummary?Year=2025&amp;BillNumber=1168" target="_blank" rel="noreferrer noopener">HB 1168</a> and <a href="https://app.leg.wa.gov/billsummary?BillNumber=2503&amp;Year=2026&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 2503</a> each aim to improve generative AI training data transparency. HB 1168 was carried over from the 2025 session, while HB 2503 was introduced this year. HB 2503 carries language largely identical to HB 1168, with a few significant changes.

Either bill would require covered developers to publicly disclose detailed information about datasets used to train models, including data sources, basic descriptions, copyright status, and whether personal information is present. HB 1168 would empower the Attorney General to enforce its provisions, leaving violators liable for civil penalties of up to $5,000 per day of violation, with a 45-day cure period. HB 2503 would instead make violations into per se violations of the Washington Consumer Protection Act, allowing for enforcement by the Attorney General and effectively creating a private right of action.

These bills are similar to California’s recently enacted AB 2013 and could further increase compliance obligations and risk for companies developing large language models or other generative AI systems.

Several bills target AI use in sensitive youth-related contexts. First, the Legislature is considering bills aimed at AI-generated child sexual abuse material (CSAM). This includes companion bills <a href="https://app.leg.wa.gov/billsummary/?BillNumber=1169&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 1169</a> and <a href="https://app.leg.wa.gov/billsummary/?BillNumber=5105&amp;Chamber=Senate&amp;Year=2025" target="_blank" rel="noreferrer noopener">SB 5105</a> and a pared-back <a href="https://app.leg.wa.gov/billsummary?BillNumber=5094&amp;Year=2025" target="_blank" rel="noreferrer noopener">SB 5094</a>. These bills would expand Washington’s CSAM framework to treat AI-generated or otherwise fabricated sexually explicit depictions of minors as criminally actionable, even where the minor is not identifiable. These bills follow SHB 1205, passed April 2025, which <a href="https://www.bakerdatacounsel.com/blogs/washington-state-broadly-criminalizes-all-malicious-deepfakes-expanding-on-existing-deepfake-regulation/" target="_blank" rel="noreferrer noopener">amended Washington’s criminal impersonation statute</a> to prohibit the knowing distribution of forged digital likenesses of actual, identifiable individuals.

Second, <a href="https://app.leg.wa.gov/billsummary?BillNumber=5956&amp;Year=2025" target="_blank" rel="noreferrer noopener">SB 5956</a> would prohibit Washington public schools from relying solely on automated decision-making systems for student discipline. It would further restrict schools from using biometric data to generate emotional, behavioral or other insights about students.

<a href="https://app.leg.wa.gov/billsummary?BillNumber=5984&amp;Year=2025" target="_blank" rel="noreferrer noopener">SB 5984</a> would regulate “AI companion” chatbots that simulate emotional companionship, taking notes from sibling laws in California (SB 243) and New York (S-3008C Part U). Its core requirements include:

Clear and conspicuous disclosures of AI interactions.

Prohibition of sexual content, and other protections for minors.

Publicly disclosed suicide/self-harm detection and referral protocols.

This bill aims to safeguard consumers from harms from emerging AI chatbot uses. While consumers are familiar with and so can protect themselves from harms stemming from traditional products, sophisticated AI chatbots bring a host of unfamiliar harms. The bill exempts AI systems used for customer service, technical assistance, certain gameplay functions and virtual assistant consumer devices.

Workplace Surveillance and Management Technologies

Washington legislators are also scrutinizing how employers use technology to monitor workers:

<a href="https://app.leg.wa.gov/billsummary?BillNumber=2144&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 2144</a> would require advance notice before implementing electronic monitoring or AI-driven performance evaluation tools.

<a href="https://app.leg.wa.gov/billsummary?BillNumber=1672&amp;Initiative=False&amp;Year=2025" target="_blank" rel="noreferrer noopener">HB 1672</a> would go further, limiting permissible monitoring purposes, restricting emotion recognition and facial analysis, and imposing impact assessment and human oversight requirements for algorithmic employment decisions.

While several states have moved to regulate automated decision-making in the employment context, this bill places Washington at the forefront of regulating electronic monitoring in the workplace.

Restrictions on AI for Prior Authorizations (<a href="https://app.leg.wa.gov/billsummary/?BillNumber=1566&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 1566</a>). Would tighten rules on health‑insurance prior authorization, notably by establishing strict standards for AI tools used for prior authorization, prohibiting insurers from using AI as the sole basis for denying, delaying, or modifying care, and requiring that only licensed clinicians make medical-necessity denials.

Access to Electronic Health Data (<a href="https://app.leg.wa.gov/billsummary/?BillNumber=5254&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">SB 5254</a>/<a href="https://app.leg.wa.gov/billsummary/?BillNumber=1496&amp;Chamber=House&amp;Year=2025" target="_blank" rel="noreferrer noopener">HB 1496</a>). Would strengthen existing rights to access medical data, by capping fees for patients’ and their representatives’ access to the patients’ electronic health records at $50 in most cases, requiring cost‑based regulations for other requests, tightening response timelines and documentation duties, clarifying authorization and segregation requirements, and expanding enforcement rights.

Data Broker Registry (<a href="https://app.leg.wa.gov/billsummary?BillNumber=2483&amp;Year=2026&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 2483</a>). Would require registration of personal data brokers.

Artificial Intelligence Grant Program (Spark Act) (<a href="https://app.leg.wa.gov/billsummary/?BillNumber=1833&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">HB 1833</a>). Would allow for state-administered grants for AI innovation and ethical AI pilot projects.

Automated License Plate Reader (ALPR) Restrictions (<a href="https://app.leg.wa.gov/billsummary?BillNumber=6002&amp;Initiative=false&amp;Year=2025" target="_blank" rel="noreferrer noopener">SB 6002</a>). Would impose strict limits on government deployment, retention, and sharing of ALPRs and ALPR data.

Form I-9 Protections (<a href="https://app.leg.wa.gov/billsummary/?BillNumber=5852&amp;Chamber=Senate&amp;Year=2025" target="_blank" rel="noreferrer noopener">SB 5852</a>). Introduced at the Washington Attorney General's request, would require employers to notify workers about federal I‑9 audits, restrict voluntary sharing of worker records with immigration authorities, and impose strong anti‑retaliation rules, backed by high civil penalties.

Requirements for Autonomous Motor Vehicles (<a href="https://app.leg.wa.gov/billsummary?BillNumber=6243&amp;Year=2026&amp;Initiative=false" target="_blank" rel="noreferrer noopener">SB 6243</a>). Would impose safety, licensing, and documentation requirements for autonomous vehicles on public roadways and transparency requirements for autonomous vehicle networks, and prevent state/local prohibitions on autonomous vehicles on public roadways.

Event-Based Restrictions and Disclosures for Ride-Hailing Companies (<a href="https://app.leg.wa.gov/billsummary/?BillNumber=5600&amp;Year=2025&amp;Initiative=false" target="_blank" rel="noreferrer noopener">SB 5600</a>).Would cap fares at 120 percent of driver pay during “large‑scale events,” require more detailed passenger receipts disclosing driver compensation, and allow local governments to impose geofenced pickup/drop‑off zones for federally rated special events, among other requirements.

The volume and breadth of technology-related proposals in Washington’s 2026 regular session underscore the Legislature’s concern with regulating technology’s impact on vulnerable populations. While not all of these bills will pass – and several will likely undergo significant amendment – the direction is clear. Companies operating in Washington should prepare for expanded privacy obligations, more prescriptive rules governing online design and data use, and greater scrutiny of AI systems, especially where technology may affect a vulnerable population. And they should expect Washington to forge ahead on AI regulation despite federal moratorium efforts due to the technology’s growing social, economic and technological impacts.

We will continue to monitor these developments as Washington’s technology regulatory landscape evolves and to offer strategic guidance on legislative engagement and compliance.

Washington State’s 2026 Tech Legislative Agenda: What In-House Counsel Should Watch