Washington AG Report Signals New Push for Comprehensive Privacy Law
Washington's Attorney General has released the state's first data privacy report, calling for comprehensive legislation and signaling increased enforcement focus on data brokers and sensitive data.
On August 14, 2026, the Washington Attorney General released the state's first Data Privacy Report, renewing the call for a comprehensive privacy statute and outlining current enforcement priorities. The report highlights the irony that Washington, whose proposed Privacy Act has been a model for laws in other states, still lacks such a law itself after repeated legislative failures.
Sophisticated counsel should note the report’s specific targets: overcollection of data, deceptive design or "dark patterns," the sale of sensitive data like biometrics and geolocation, and the data-broker industry. The AG's office recommends legislation mandating data minimization, informed consent, and stronger protections for sensitive information. It also signals an intent to use existing authority for enforcement, even before a new law is passed, citing FTC actions against data brokers selling location data from sensitive places like reproductive health clinics.
Businesses with a nexus to Washington should anticipate a renewed legislative push and scrutinize their data practices, particularly around consent and sensitive data, as these are now clearly marked as enforcement priorities. The unresolved debate over a private right of action versus AG-only enforcement remains the key hurdle to watch in any future legislation.