Washington State Attorney General releases first Data Privacy Report

For the first time, in August 2026, the Washington State Attorney General’s Office released a Data Privacy Report. Taking a slightly different approach from reports released by other U.S. state attorneys general offices, the Report does not catalog the office’s recent enforcement actions or index the breach notices it has received. Instead, it identifies four data practices that it believes are “recurring concerns” and create harm, and it argues that financial incentives in the economy lead businesses to engage in these practices. Next, it describes the results of a survey about privacy that the office conducted in 2025 of more than 700 Washingtonians. After articulating how it views Washington’s privacy laws as inadequate, the Report concludes with recommendations for additional laws, enhancements to enforcement abilities, and consumer education.

Setting the stage: Four data practices the Report describes as harmful

The Report begins by describing four data practices that it believes businesses are incentivized to engage in by the “data economy” (i.e., the fact that data and inferences from it can be sold for advertising and data broker activity). The data practices the Report describes are:

1. Overcollection and secondary use: Overcollection is collecting more data than is reasonably necessary to deliver a requested product or service. Secondary use is repurposing information for uses unrelated to the interaction that generated it.

2. Weak consent requirements and deceptive design for consent choices: Information regarding how personal information will be collected, used, or shared may be confusing, bundled, or “buried in privacy policies that people are unlikely to read or fully understand.” The user interface may “steer” the user of a service to accept practices that are unwanted, such as by making “accept all” choices easy and refusal difficult.

3. Collection and sale of sensitive data: Biometric identifiers have heightened sensitivity because they cannot be changed (in comparison to a password) once exposed. Precise geolocation can reveal movements around homes, workplaces, medical providers, places of worship, and other sensitive locations.

4. Limited consumer visibility into data brokers: Data brokers are entities that hold and sell information about people outside of a direct first-party relationship, leaving consumers unable to identify who holds their data, unaware that it is being sold and shared, and unaware of where to direct requests to learn more or opt out.

The Report argues that these practices cause consumer harm, citing three bases: (1) the fact that data breaches occur (citing several metrics regarding data breach notifications in Washington State); (2) the possibility of personal information being used for stalking, threats, and impersonation, with disproportionate effects on older adults, youth, and people whose safety depends on keeping their location or associations private (citing the Federal Trade Commission’s (FTC) actions against data brokers Kochava and Mobilewalla); and (3) the possibility of personal information being used by businesses to set individualized or personalized prices and discounts, or to determine which opportunities are shown to consumers (citing the FTC’s 2025 surveillance pricing 6(b) staff report and a 2022 settlement between the U.S. Department of Justice and an online advertising platform regarding advertisements for housing).

Even though the Report critiques the four data practices above for resulting, in the office's view, in data being handled in ways of which consumers are not affirmatively aware, the Report’s harm discussion focuses on tangible, real-world harms that can result from data exposure, rather than intangible so-called privacy harm arising simply from data being collected, used, or shared in a way that the consumer did not understand or control.

Consumers’ views: Survey of Washingtonians about privacy

Next, the Report describes the results of a survey the Attorney General’s Office conducted in 2025 about Washingtonians’ views on privacy. 83% of survey respondents said they felt they had little or no control over access to their information, 62% and 65% said that opting out of targeted advertising and requesting deletion were difficult, and 55% said they trust “none” of the listed institutions (businesses, state and federal government agencies, academic and financial institutions, healthcare, and non-profit organizations) to keep information secure. 95% said there was no circumstance in which they would be comfortable having personal information collected, shared, or sold without informed consent.

The survey was made available to all Washington state residents and had more than 700 responses. Although the Report notes that the survey respondents were from 26 of Washington’s 39 counties, it does not appear that the respondents were selected to be statistically representative of Washingtonians at large. The respondents thus could be weighted overall toward those that had more critical opinions about the state of privacy protections because those residents self-selected into responding to the survey in order to share those critical opinions.

Gaps in current law: Critiques of Washington state’s privacy laws

The Report notes that the European Union’s General Data Protection Regulation (GDPR) has no counterpart in U.S. federal law. The Report remarks that the GDPR “continues to serve as a model for privacy laws and practice around the world” and that states such as California, Colorado, Oregon, and Connecticut have enacted omnibus privacy laws as well.

The Report makes pointed critiques of how, in the view of the Attorney General’s Office, Washington’s fragmented privacy laws (and lack of an omnibus privacy law) result in gaps in the protection of consumers:

Recommendations: What the Attorney General’s Office would like to see happen

The Report makes eight recommendations, grouped into policy, enforcement, and public education.

Policy recommendations

The Report asks the legislature to enact legal protections that would:

1. Require meaningful and informed consumer consent, including not allowing disclosures to be “buried” in legal documents, prohibiting deceptive design (such as by requiring privacy choices to be as easy to exercise as to decline), and considering centralized and universal opt-out mechanisms.

2. Establish data minimization requirements and limit secondary uses, including through data minimization practices, retention limits, and consent requirements, before information is used for purposes unrelated to the interaction that generated it.

3. Strengthen protections for biometric and precise geolocation data, including “clear informed consent” before collection, clear retention limits, and strict limits or a prohibition on the sale and unnecessary commercial use of biometric and precise geolocation data.

4. Require data brokers to register with the state annually, publicly disclose categories of personal information handled, maintain security safeguards, honor deletion and opt-out requests, and respond to opt-out requests through a centralized request mechanism; also limit or prohibit data brokers from selling sensitive personal information.

Enforcement recommendations

The Report also asks the legislature to:

1. Evaluate existing and new privacy laws against the principles of clarity, practicality, and accountability. The Report suggests the legislature should revisit statutes if the remedies provided have proved insufficient to deter noncompliance. It cites Colorado’s rulemaking authority and data protection assessments and California’s Privacy Protection Agency and cybersecurity audit requirements. It also notes the importance of sufficient funding for its office’s enforcement activities, citing California’s earmarking of significant percentages of penalties recovered to fund privacy enforcement. Regarding who enforces, the Report says authority may rest with regulators, consumers, or both and notably makes no mention of whether or not it supports a private right of action.

2. Enhance governmental agencies’ abilities to protect privacy through funding dedicated privacy roles scaled to agency need and size and supporting privacy impact assessments, data inventories, staff training, and vendor-agreement review, in partnership with WaTech’s Office of Privacy and Data Protection. In its only mention of AI, the Report specifically ties these needs to agencies’ growing adoption of artificial intelligence.

Public education recommendations

Finally, the Report states that Attorney General’s Office’s own Tech Policy Team should create and publicly share resources to:

1. Explain in plain language with clear examples for consumers how personal data is collected, shared, and sold in common and everyday settings and apps, including how to secure personal devices, recognize deceptive design practices, understand tracking cookies, identify risks associated with data sharing, and manage privacy settings.

2. In partnership with business associations, assist small businesses in understanding data security and compliance obligations and approaches to fulfilling the same.

Takeaways

The Report does not discuss or seek new laws regarding children or teens’ use of digital technologies, nor does it seek laws regarding AI. This choice most likely reflects merely prioritization and a desire to keep the Report focused on privacy issues.

The Report functions as both a map of the Attorney General’s Office’s legislative asks and its enforcement priorities. The clearest legislative asks are a data broker registry, stronger protections for biometric and precise geolocation data, and broader adoption of consent, minimization, retention, and purpose-limitation requirements. The Report’s sustained focus on inadequate consent, dark patterns, retention, overcollection, and sensitive data suggests those issues may draw increased scrutiny under existing authorities well before any new legislation is enacted.

The Report’s commitment to creating practical public education resources, particularly for small businesses, is notable. A robust, well-done library of resources, particularly if kept up to date, could as a practical matter be of real assistance to members of the public.