Washington
Washington Biometric Privacy Laws: Collection, Consent & Penalties (2026)
This page is being updated. Please check back shortly.
Affected by a data breach or biometric privacy violation?
If your personal data was exposed in a breach, or your fingerprint or face scan was collected without your consent, you may be eligible to join a claim for compensation. Find out for free, with no obligation.
Updates
Corrected which biometric data types trigger the RCW 40.26 chief-privacy-officer notice requirement for limited authority law enforcement agencies: fingerprints and DNA are excluded from the statute's notice/consent requirements entirely, while the written-notice obligation applies only to OTHER biometric identifiers those agencies collect.
Governing law re-checked for recent changes
The Law Behind This Article
This article rests on 6 statutory provisions held in our own legal record, each retrieved from the official source. Tap a section to read the operative text.
Revised Code of Washington
§ 19.375.010Definitions.In forcecited in 4 of our articles
The definitions in this section apply throughout this chapter , unless the context clearly requires otherwise. (1) "Biometric identifier" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual. "Biometric identifier" does not include a physical or digital photograph, video or audio recording or data generated therefrom, or information collected, used, or stored for health care treatment, payment, or operations under the federal health insurance portability and accountability act of 1996. (2) "Biometric system" means an automated identification system capable of capturing, processing, and storing a biometric identifier, comparing the biometric identifier to one or more references, and matching the biometric identifier to a specific individual. (3) "Capture" means the process of collecting a biometric identifier from an individual.
Official text (excerpt) · as of 2026-07-29 · Read the full section at app.leg.wa.gov
Also relied on in: Washington Smart Glasses Recording Laws (2026), Washington Employee Monitoring Laws: Biometric Privacy, Social Media, and Surveillance (2026), Washington Data Privacy Laws: My Health My Data Act & More (2026)
§ 19.375.020Enrollment, disclosure, and retention of biometric identifiers.In forcecited in 7 of our articles
(1) A person may not enroll a biometric identifier in a database for a commercial purpose, without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose. (2) Notice is a disclosure, that is not considered affirmative consent, that is given through a procedure reasonably designed to be readily available to affected individuals. The exact notice and type of consent required to achieve compliance with subsection (1) of this section is context-dependent.
Official text (excerpt) · as of 2026-07-29 · Read the full section at app.leg.wa.gov
Also relied on in: Alabama Smart Glasses Recording Laws, Indiana Smart Glasses Recording Laws 2025, Oklahoma Smart Glasses Recording Laws 2026
§ 19.375.030Application of consumer protection act.In forcecited in 2 of our articles
(1) The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW. (2) This chapter may be enforced solely by the attorney general under the consumer protection act, chapter 19.86 RCW.
Official text (excerpt) · as of 2026-07-29 · Read the full section at app.leg.wa.gov
§ 19.375.040Exclusions.In forcecited in 2 of our articles
(1) Nothing in this chapter applies in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley act of 1999 and the rules promulgated thereunder. (2) Nothing in this chapter applies to activities subject to Title V of the federal health insurance privacy and portability act of 1996 and the rules promulgated thereunder. (3) Nothing in this chapter expands or limits the authority of a law enforcement officer acting within the scope of his or her authority including, but not limited to, the authority of a state law enforcement officer in executing lawful searches and seizures.
Official text (excerpt) · as of 2026-07-29 · Read the full section at app.leg.wa.gov
§ 19.86.140Civil penalties.In force
Every person who shall violate the terms of any injunction issued as in this chapter provided, shall forfeit and pay a civil penalty of not more than $125,000. Every person who violates RCW 19.86.030 or 19.86.040 shall pay a civil penalty of up to three times the unlawful gains or loss avoided as a result of each violation. Every person who violates RCW 19.86.020 shall forfeit and pay a civil penalty of not more than $7,500 for each violation: PROVIDED, That nothing in this paragraph shall apply to any radio or television broadcasting station which broadcasts, or to any publisher, printer or distributor of any newspaper, magazine, billboard or other advertising medium who publishes, prints or distributes, advertising in good faith without knowledge of its false, deceptive or misleading character.
Official text (excerpt) · as of 2026-07-29 · Read the full section at app.leg.wa.gov
§ 40.26.020Biometric identifiers—Notice and consent—Agencies—Use, storage, retention—Review—Definitions—Exceptions.In force
(1) Unless authorized by law, an agency may not collect, capture, purchase, or otherwise obtain a biometric identifier without first providing notice and obtaining the individual's consent, as follows: (a) The notice provided must clearly specify the purpose and use of the biometric identifier; and (b) The consent obtained must be specific to the terms of the notice, and must be recorded and maintained by the agency for the duration of the retention of the biometric identifier. (2) Any biometric identifier obtained by an agency: (a) May not be sold; (b) May only be used consistent with the terms of the notice and consent obtained under subsection (1) of this section, or as authorized by law; and (c) May be shared, including with other state agencies or local governments, only: (i) As needed to execute the purposes of the collection, consistent with the notice and consent obtained under subsection (1) of this section, or as authorized by law; or (ii) If such sharing is specified within the original consent.
Official text (excerpt) · as of 2026-07-29 · Read the full section at app.leg.wa.gov
Search our full record of US law — 1.79 million sections, every state + federal →
Sources and References
- RCW 19.375 - Biometric Identifiers Chapter(app.leg.wa.gov).gov
- RCW 19.375.010 - Biometric Identifier Definitions(app.leg.wa.gov).gov
- RCW 19.375.020 - Enrollment, Disclosure, and Retention(app.leg.wa.gov).gov
- RCW 19.375.030 - Consumer Protection Act Application(app.leg.wa.gov).gov
- RCW 19.375.040 - Exclusions(app.leg.wa.gov).gov
- RCW 40.26 - Government Biometric Identifiers(app.leg.wa.gov).gov
- RCW 40.26.020 - Agency Notice, Consent, Storage, Retention(app.leg.wa.gov).gov
- RCW 43.386 - Facial Recognition (SB 6280)(app.leg.wa.gov).gov
- RCW 19.373 - Washington My Health My Data Act(app.leg.wa.gov).gov
- RCW 19.86 - Consumer Protection Act(app.leg.wa.gov).gov
- RCW 19.86.140 - Civil Penalties(app.leg.wa.gov).gov
- Washington AG - Consumer Protection Division(atg.wa.gov).gov
- SB 6280 - Facial Recognition Bill Summary(app.leg.wa.gov).gov
- HB 1493 House Bill Report(lawfilesext.leg.wa.gov).gov