Washington Privacy Act: What the People's Privacy Act would change

A bill that gets introduced, rewritten, and reintroduced year after year is a lot like a restaurant that keeps announcing its grand opening. After a few date changes, it's tempting to stop paying attention. But the kitchen still has to pass inspection the day the doors finally open, and the teams that prepped early are the ones who serve their first customers without a scramble.

That's the case for keeping an eye on Washington state privacy legislation. Marketing teams rely on customer data for targeting, reporting, and vendor relationships, and a comprehensive law tends to touch all three at once. Getting ready before a deadline costs far less than rebuilding under one.

Key Takeaways

• The Washington Privacy Act never became law, and the bill people are really tracking now is HB 1671, the People's Privacy Act.
• As of late September 2026, HB 1671 is sitting in the House Appropriations Committee, so it isn't law yet.
• It would cover any business that operates in Washington or targets its residents and handles personal data, with no revenue threshold.
• Consumers could access, correct, delete, and move their data, and opt out of targeted ads, data sales, and certain automated decisions.
• Businesses would need to limit collection, get opt-in consent before sharing sensitive data, and assess higher-risk uses.
• The bill treats measurement tied to first-party advertising differently from cross-site tracking, which matters for how teams report on performance.
• Washington already has privacy rules in effect, most notably the My Health My Data Act, so waiting on this bill isn't a neutral choice.

What happened to the Washington Privacy Act?

Most people searching for the Washington Privacy Act want Washington's version of a comprehensive privacy law, but that particular bill has a long history of falling short. Versions were introduced starting in 2019, and the 2020 bill passed the Senate 46 to 1 before stalling in the House. Lawmakers kept getting stuck on whether consumers should opt in to data collection and whether they should be able to sue companies directly. None of the Washington Privacy Act bills became law.

What is the People's Privacy Act?

The live proposal has a new name and a new sponsor. Rep. Shelley Kloba introduced the People's Privacy Act (HB 1671) in January 2025, working with Consumer Reports and the Electronic Privacy Information Center (EPIC). Kloba has compared personal data to a new Western frontier, and the bill is framed as a push for digital autonomy as more of life is lived online. Here's where it stands:

• January 2025: Introduced and sent to committee.
• February 2025: Passed the House technology committee as a substitute bill (SHB 1671) and moved to Appropriations.
• January 2026: Reintroduced for the 2026 session and kept in its current status.
• September 2026: Still in House Appropriations.

Bills can move fast once they're scheduled, so it's worth watching. The dates written into the text also predate today's calendar, so expect the effective date to shift if the bill advances.

Who the bill would cover

The People's Privacy Act casts a wide net. It applies to any person or business that operates in Washington state or offers products or services aimed at its residents and collects or processes personal data. There's no revenue threshold and no minimum number of consumers, which sets it apart from laws like the CCPA. Large corporations and small shops would play by the same rules. A few exceptions apply:

• Government agencies and their contractors
• HIPAA covered entities, for protected health information
• Data already governed by federal laws like the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act
• Employment records and data used for news reporting

What rights consumers would get

The bill gives consumers a set of rights they can use with any business that holds their personal information. They could:

• Confirm whether a business is collecting their data, and see what it has
• Get a list of the third parties that received it
• Correct anything that's wrong
• Delete it
• Get a portable copy
• Opt out of targeted ads, the sale of personal data, and profiling that drives major automated decisions like loans, housing, or jobs

Businesses would have 45 days to respond, with one 45-day extension if needed. Consumers could also appeal a refusal.

What businesses would have to do

Most of the work lands on the companies that collect the data. The bill sets meaningful limits on how much data companies can gather and what they can do with it. The main obligations are:

• Limit collection: Collect and share only what's strictly necessary to provide products or services a consumer asked for. Advertising gets its own rules, covered below.
• Get opt-in consent for sensitive data: Health details, precise location, immigration status, and browsing activity tracked across unrelated websites all count as sensitive data. Sharing it requires clear consent, and selling it is off the table, except for consumer health data under the My Health My Data Act.
• Protect minors: The bill bans targeted advertising to consumers a business knows are minors.
• Publish a clear privacy notice: Explain what you collect, why, who gets it, and how long you keep it.
• Assess higher-risk uses: Targeted ads, data sales, profiling, and sensitive data all call for a documented data protection assessment.
• Avoid discrimination: Data can't be used in ways that lead to unlawful discrimination, and businesses can't retaliate against consumers who use their rights.

How the bill treats marketing measurement

The bill defines marketing measurement—reporting on things like frequency, attribution, and performance—and treats it differently depending on where the ads run. Here's the split.

Tracking individuals across sites is the practice these rules squeeze, and it's already shrinking because of ad blockers, browser changes, and platform policies. Multi-touch attribution depends on that tracking, so it'll keep getting less complete whether or not this bill passes.

Marketing mix modeling works differently. Prescient's model uses your first-party data, like spend, impressions, and revenue, and looks at statistical patterns rather than following individual people around. The bill doesn't mention marketing mix modeling by name, and using any one tool doesn't make a business compliant with anything. Still, a measurement approach that doesn't rely on user-level tracking has less to untangle if rules like these pass. This isn't legal advice, so run the specifics past counsel.

How enforcement would work

Enforcement would sit with the state rather than individual consumers. The attorney general could bring a civil action under the Consumer Protection Act, and the bill says that's the only way to enforce it, so there's no private right of action. Before suing, the state would have to give a business 30 days to fix a violation, though that cure period expires in August 2027 under the current text.

Washington privacy laws already in effect

While the bill waits, Washington law already covers some ground. These three apply today:

• My Health My Data Act: Passed in 2023, it requires consent to collect or share consumer health data outside HIPAA. It reaches many non-health companies, like a supplement brand running ad pixels, and consumers can enforce it alongside the state.
• All-party consent recording law (RCW 9.73): Everyone in a private conversation has to agree before it's recorded, with few exceptions. That matters for call recording tools.
• Voter privacy protections (Senate Bill 5892): Sensitive voter information, like driver's license and Social Security numbers, stays confidential at the county level.

Comparing the People's Privacy Act, the My Health My Data Act, and the CCPA

Side by side, these three laws show how much state privacy protections can differ, which helps if you sell in more than one state.

How to prepare while the bill waits

You don't need a final vote to get your house in order. Start with this checklist:

• Audit what customer data you collect and where it goes.
• Flag anything that could count as consumer health data, since that law already applies.
• Review ad pixels, tags, and vendor contracts.
• Set up clear consent and opt-out handling, including browser-based opt-out signals.
• Check how much of your reporting depends on individual-level tracking compared with your own first-party data.
• Build toward the strictest standard you face, which usually costs less than managing state-by-state exceptions.

FAQs

Did the Washington Privacy Act pass?

No. Several versions were introduced starting in 2019, and one passed the Senate in 2020, but none became law. The current comprehensive proposal is the People's Privacy Act (HB 1671).

What is the People's Privacy Act?

It's a bill introduced by Rep. Shelley Kloba in January 2025 that would give Washington consumers broad control over their personal data and limit how businesses collect, share, and sell it. As of late September 2026, it's in the House Appropriations Committee.

Does Washington have a data privacy law right now?

Washington doesn't have a comprehensive consumer data privacy law yet. It does have targeted rules, including the My Health My Data Act for health information and an all-party consent law for recorded conversations.

Who would the People's Privacy Act apply to?

Any business that operates in Washington or targets its residents and collects or processes personal data would be covered, regardless of size. Government agencies, HIPAA covered entities, and data already governed by certain federal laws are exempt.

Could consumers sue companies under the People's Privacy Act?

No. The bill limits enforcement to the state's attorney general, so there's no private right of action.

How would the People's Privacy Act affect marketing measurement?

Measurement tied to first-party advertising falls outside the bill's definition of targeted advertising, while measurement tied to cross-site targeted ads falls inside it. Teams that rely heavily on tracking individuals across sites have the most to review.