On August 14, 2026, Washington Attorney General (AG) Nick Brown released the state’s first-ever Data Privacy Report (the “Report”). The Report examines how the modern data economy incentivizes the collection and retention of personal information, catalogs the harms that can result from these practices and recommends that state lawmakers respond by strengthening privacy protections, enforcement and public education. It also highlights that Washington—whose proposals have inspired other states to pass such laws—continues to lack a comprehensive consumer privacy statute of its own. 

For businesses, the most relevant takeaways are that Washington may soon join the list of states with a comprehensive privacy law (and possibly even a data broker–specific law) and that, despite the lack of a comprehensive privacy law, the Washington AG’s office is paying attention to privacy-related harms and may use existing tools to bring relevant enforcement actions. Washington has historically been a leader on privacy-related issues—especially given that many state comprehensive privacy laws around the country are modeled after the proposed (but not yet enacted) Washington Privacy Act—and the Report indicates that the state is intending to remain active in this space.

In this post, we summarize the Report’s key findings and recommendations for policymakers. To stay up to date on the latest developments in state privacy law, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.

Summary

The Report frames its analysis around what it calls four recurring concerns in the modern data economy:

• Overcollection and secondary use. Companies frequently collect more personal information than a requested product or service requires, then reuse it for unrelated “secondary” purposes, creating a gap between what consumers expect and how their data is actually used.
• Weak consent requirements and deceptive design. Consent is often reduced to a checkbox users click without having meaningful understanding, while “deceptive design” (or the use of dark patterns) nudges consumers toward choices that favor data collection.
• The collection and sale of sensitive data. Sensitive categories such as biometric identifiers and precise geolocation data are collected and, in many cases, sold. That this information is especially revealing and, once exposed, difficult or impossible to change creates a meaningful risk for consumers.
• A lack of transparency in the data-broker industry. Data brokers buy, aggregate and sell information about consumers they have no direct relationship with, making it hard for Washingtonians to know who holds their data or how to have it deleted.

The Report also highlights the state’s lack of a comprehensive privacy law. Though the Washington Privacy Act, a bill introduced in 2019, is considered a blueprint for other state comprehensive privacy laws, Washington has not yet passed one of its own. In fact, state lawmakers have repeatedly tried to enact a comprehensive privacy since 2019, when the Washington Privacy Act was introduced. Instead, Washington has more targeted data protection laws covering data breach notification, student data privacy, biometric privacy, consumer health data and automated license plate reading.

The Report further advocates for key policy, enforcement and education changes. First, the Report champions a legal framework requiring informed consent and data minimization, while urging both a prohibition on deceptive design and limits on secondary use. Additionally, it pushes for stronger protections for sensitive data like biometric and geolocation data, as well as a requirement for data brokers to register with the state. Notably, the Report cites California’s Delete Request and Opt-Out Platform (DROP) as a model for a centralized deletion system to remove data maintained by data brokers. 

Second, the Report calls for additional privacy staffing and tools for the state’s agencies, while advocating for the adoption of enforcement mechanisms that are clear, practical and accountable. The Report, however, does not take a position on the debate between enforcement by AG versus a private right of action, which has contributed to the state’s failure to pass a comprehensive privacy law.

Finally, the Report seeks to raise the baseline of digital literacy in the state of Washington. The AG’s office plans to partner with consumer advocates and business associations to develop public resources explaining how personal data is collected, shared and sold; how to secure devices, manage privacy settings and recognize deceptive design; and how small businesses can reduce data-security risks and meet their privacy obligations. 

Key Takeaways

For companies operating in Washington and elsewhere, the following takeaways from the Report are relevant:

• New laws may be on the way. The Report’s focus on the state’s lack of a comprehensive privacy law may renew calls for such legislation (though it specifically declines to resolve the AG-enforcement-versus-private-right-of-action debate that has repeatedly stalled such bills).
• Data minimization and consent are front and center. The Report’s recommendations track the direction of newer state comprehensive laws by advocating for the adoption of requirements for meaningful informed consent, data-minimization and secondary-use limits, as well as prohibitions on deceptive designs and other dark patterns. 
• Sensitive data and data brokers draw particular focus. Companies handling biometric identifiers or precise geolocation data and any entity that could qualify as a data broker should watch for Washington legislation modeled on annual registration and centralized deletion (e.g., California’s DROP). Additionally, the call for stronger protection of biometric identifiers and precise geolocation data builds on Washington’s existing biometric-privacy law and the My Health My Data Act (the nation’s first state consumer health-data law to protect health data falling outside HIPAA), suggesting these categories will continue to draw enforcement attention consistent with the state’s track record.
• AG signals potential enforcement triggers. The Report makes clear that the AG’s office is paying close attention to consumer harm issues, particularly those that potentially disproportionately impact particular groups. For example, the Report discusses Federal Trade Commission data broker enforcement actions challenging the sale of location data identifying visits to sensitive locations, such as reproductive health clinics and places of worship, as well as an action challenging the tracking of particular groups, such as pregnant women and union organizers. The Report also discusses a Department of Justice settlement to stop the use of an advertising tool that relied on race, sex and other protected characteristics to deliver targeted housing advertisements.
• Data breach enforcement remains a priority. The Report notes that the state of Washington had 209 reported breaches affecting more than 8 million residents in 2025 and that over 80 percent of those involved Social Security numbers. The AG’s office is continuing to focus on data breach reporting and enforcement as priorities, given that it already has specific statutory authority under the state’s breach notification law in this regard. 

For more privacy and cybersecurity news, follow the WilmerHale Privacy and Cybersecurity Law Blog.