Law / United States / 
Washington
Computer Spyware Act
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
As of .
What it requires
- Do not transmit, or procure the transmission of, software to a user's computer without the owner's or operator's authorization, knowing or consciously avoiding knowing that it modifies through deceptive means the browser start page, the default provider or web proxy used to access or search the internet, the bookmarks, or the toolbars or buttons.
- Do not transmit, or procure the transmission of, software to a user's computer without the owner's or operator's authorization, knowing or consciously avoiding knowing that it collects personally identifiable information through intentionally deceptive means, by keystroke logging or by extracting it from the hard drive, or that it prevents through intentionally deceptive means the user's reasonable efforts to block the installation or execution of software or to disable it.
- Do not transmit, or procure the transmission of, software to a user's computer without the owner's or operator's authorization, knowing or consciously avoiding knowing that it misrepresents that software will be uninstalled or disabled by the user's action, offers an option to decline installation while the installation proceeds anyway, or falsely represents that software has been disabled.
- Do not transmit, or procure the transmission of, software to a user's computer without the owner's or operator's authorization, knowing or consciously avoiding knowing that it removes, disables or renders inoperative security, antispyware or antivirus software through intentionally deceptive means, or disables that software's automatic updating through intentionally deceptive means.
- Do not transmit, or procure the transmission of, software to a user's computer without the owner's or operator's authorization, knowing or consciously avoiding knowing that it opens multiple, sequential, stand-alone advertisements a reasonable user cannot close without turning off the computer or closing the browser, uses the computer in a group attack such as a denial-of-service attack, or relays commercial email or a computer virus from the computer when a person other than the owner or operator initiates the transmission.
- Do not transmit, or procure the transmission of, software to a user's computer without the owner's or operator's authorization, knowing or consciously avoiding knowing that it uses the computer's modem or internet service to cause damage or unauthorized financial charges, or modifies the internet settings that protect the owner's information in order to make unauthorized use of personally identifiable information, or modifies security settings in order to cause damage to a computer.
- If you are not the owner or operator of a computer, do not induce the owner or operator to install a software component by deceptively misrepresenting that installation is necessary for maintenance, update, repair, security, privacy, the proper operation of the computer or opening content, or by a pop-up, web page or message that deceptively misrepresents its source, and do not deceptively cause a software component to execute in a way that violates RCW 19.270.040.
- Rely on the RCW 19.270.050 exemption from RCW 19.270.020(5) through (11) and RCW 19.270.040 only when you are a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service, and the monitoring or interaction is for network or computer security, diagnostics, technical support, maintenance, repair, authorized updates, authorized remote system management, or detection or prevention of unauthorized or fraudulent use.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Statutory damages
The attorney general, or a provider of computer software or owner of a website or trademark who is adversely affected, may recover actual damages or $100,000 per violation, whichever is greater; a court may increase the damages up to three times for a pattern and practice of violations, and the amount determined may not exceed $2,000,000.
- As of
- Currency
- USD
Who enforces it
Enforcement body
Attorney general, or a provider of computer software or owner of a website or trademark who is adversely affected, in a civil action under RCW 19.270.060
What this law does
RCW 19.270.020 makes it unlawful for a person, without the authorization of the owner or operator, to transmit, or procure the transmission of, software to the owner or operator's computer with actual knowledge or conscious avoidance of actual knowledge that the software does any of the things listed in its subsections (1) to (11).
RCW 19.270.040 makes it unlawful for a person who is not an owner or operator to induce the owner or operator to install a computer software component by deceptively misrepresenting that installing it is necessary for maintenance, update or repair, security or privacy, the proper operation of the computer, or opening, viewing or playing content.
RCW 19.270.050 exempts monitoring of, or interaction with, a computer by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, maintenance, repair, authorized updates, authorized remote system management, or detection or prevention of unauthorized or fraudulent use, from RCW 19.270.020(5) through (11) and RCW 19.270.040, the only provisions it names.
In this chapter, an owner or operator is the owner or lessee of a computer, or someone using it with the owner's or lessee's authorization, and does not include a person who owns a computer before its first retail sale.
Under RCW 19.270.060, the attorney general, or a provider of computer software or owner of a website or trademark who is adversely affected and whose action arises directly out of that status, may sue a violator for an injunction and for actual damages or $100,000 per violation, whichever is greater. A court may increase those damages up to three times if the defendant has engaged in a pattern and practice of violating the chapter.
The damages determined under RCW 19.270.060 may not exceed two million dollars. Chapter 66, Laws of 2008, repealed RCW 19.270.030, the 2005 section on taking control of a computer.
When LexLint raises it
When your app profile says your app tracks devices or distributes a software product.