Does Washington have a comprehensive privacy law? No. As of November 4, 2026, Washington has no comprehensive consumer privacy law. The “In Effect” status on this page refers to the Washington My Health My Data Act, a consumer health data law that has applied since March 31, 2024.
- Status: In Effect
- Law: No comprehensive law. The status refers to the Washington My Health My Data Act (HB 1155, 2023; chapter 191, Laws of 2023; chapter 19.373 RCW)
- Signed: April 27, 2023 (My Health My Data Act) · Effective: March 31, 2024 (small businesses: June 30, 2024)
- Applies to: My Health My Data Act: any legal entity that conducts business in Washington or targets products or services to consumers in Washington and, alone or jointly, determines the purpose and means of collecting, processing, sharing or selling consumer health data; there is no revenue or volume threshold
- Cure period: No
- Enforcement: My Health My Data Act: violations are unfair or deceptive acts under the Washington Consumer Protection Act (chapter 19.86 RCW), enforced by the Attorney General (civil penalty of up to $7,500 per violation) and by consumers through private lawsuits
- Last verified: November 4, 2026 · Official source: Washington Legislature, chapter 19.373 RCW
- Related: Washington My Health My Data Act (MHMDA) guide
To date, there is no general comprehensive Washington state privacy law. Washington does have a biometric identifiers law (chapter 19.375 RCW, enacted in 2017), and in 2023 it passed a prominent comprehensive health-sector-specific privacy law.
My Health My Data
On April 27, 2023, Washington My Health My Data Act (the MHMD Act) was ratified into law, imposing new limitations on the gathering and distribution of “consumer health data” by businesses based in Washington or connected to people of Washington. The MHMD Act, a Washington state privacy act, defines “consumer health data” (also known as “Health Data”) broadly to govern a variety of businesses that will be subject to rules comparable to those in the California Consumer Privacy Act (CCPA), despite being touted as a law focusing on a specific sort of potentially highly personal information. The MHMD Act’s standards may in some cases be stricter than those of any other state privacy statute now in effect.
The Washington privacy act also gives individual customers a private right of action to file a lawsuit against a company directly to seek compensation for any genuine losses incurred, including reasonable legal costs. The court may increase the damages award up to three times the actual damages, but the increase may not exceed $25,000 (RCW 19.86.090).
Overview of the Law
Any organization that conducts business in Washington, markets goods or services to residents of Washington or makes choices regarding the processing of health data must comply with the MHMD Act. The scope encompasses small enterprises and nonprofit organizations; there is no minimum number of consumers whose data is handled or any revenue criteria that trigger applicability. The term “consumer” refers to anyone with health data obtained in Washington, including residents of Washington but excluding those operating in an employment capacity.
The MHMD Act focuses on information not covered under the Health Insurance Portability and Accountability Act (HIPAA). Health Data under the MHMD Act means personal information that is “linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.” The MHMD Act specifies that this definition includes:
- “Biometric data,” which itself is defined broadly and includes voice recordings if an identifier template could be extracted
- “Social, psychological, behavioral, and medical interventions”
- “Reproductive or sexual health information”
- “Bodily functions, vital signs, symptoms, or measurements of” Health Data
Though the MHMD Act is thought to have been enacted to protect data related to reproductive health, the far-reaching applicability combined with broad definitions means that the MHMD Act could apply in ways with little nexus to the law’s intent. Some examples of businesses potentially covered by the MHMD Act include:
- a retailer that sells products such as over-the-counter medications, first aid items, feminine products, or birth control – even if these sales are a small part of their business
- a fitness studio that collects information about injuries experienced by participants in a class or tracks individuals’ fitness progress
- a business that collects any Health Data on its website and allows adtech companies to embed pixels that track engagement for the ads
- a mobile app business that facilitates tasking third parties to shop for and deliver products from the above-mentioned retailer
- a business that sells a wearable fitness product (e.g., a watch or ring)
The law took effect on March 31, 2024, and small businesses had to comply by June 30, 2024.