Crawls the web, in Washington

RCW 9A.90.030, RCW 9A.90.040, RCW 9A.90.050 · Read the law's page

• Scraping a public page with no technological access barrier is not, by this statute's own definition, access without authorization, regardless of a posted policy or terms of service.
• A bare violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, does not by itself satisfy this statute's without-authorization definition; only knowingly circumventing a technological access barrier does.
• White-hat security research, and circumventing a measure that does not effectively control access to a computer, are expressly excluded from without-authorization access under this statute.

RCW 19.375 · Read the law's page

• Before enrolling someone's biometric identifier, a fingerprint, voiceprint, retina or iris scan, or other unique biological pattern used to identify them, in a database for a commercial purpose, provide notice, obtain consent, or provide a mechanism to prevent that subsequent commercial use.
• An ordinary scraped photograph, video, or audio recording, and data generated from one, is never a biometric identifier under this chapter, with no exception for a photo or recording used to identify a specific individual.
• Only the Washington Attorney General may enforce this chapter, under the Consumer Protection Act; there is no private right of action here, unlike the My Health My Data Act's own private right of action.

RCW 19.373 · Read the law's page

• Washington's My Health My Data Act reaches consumer health data broadly: personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status, including inferences and non-health data that indicate a health status, such as location data suggesting an attempt to obtain reproductive or gender-affirming care.
• Do not implement a geofence around an entity that provides in-person health care services to identify or track consumers seeking care, collect their health data, or send them related notifications, messages, or advertisements.
• A violation of this Act is per se an unfair or deceptive act under the Washington Consumer Protection Act, which carries its own private right of action; a federal class action alleging SDK-based location and biometric data harvesting in violation of this Act is reported pending by secondary commentary, not independently confirmed against the court docket.