Law / United States / 
Washington
Washington Biometric Identifiers
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Before enrolling someone's biometric identifier, a fingerprint, voiceprint, retina or iris scan, or other unique biological pattern used to identify them, in a database for a commercial purpose, provide notice, obtain consent, or provide a mechanism to prevent that subsequent commercial use.
- An ordinary scraped photograph, video, or audio recording, and data generated from one, is never a biometric identifier under this chapter, with no exception for a photo or recording used to identify a specific individual.
- Only the Washington Attorney General may enforce this chapter, under the Consumer Protection Act; there is no private right of action here, unlike the My Health My Data Act's own private right of action.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does training or running a model on scraped images meet the "commercial purpose" definition in RCW 19.375.010(4), which is limited to a purpose in furtherance of the sale or disclosure of a biometric identifier to a third party for marketing of unrelated goods or services?
- Does keeping a template that can be tied to a specific person only through a separate lookup meet "store it in a database that matches the biometric identifier to a specific individual" in RCW 19.375.010(5)?
What it makes you log
Logging duty
RCW 19.375.020 requires notice, consent or an opt-out mechanism before a biometric identifier is enrolled in a database for a commercial purpose, limits disclosure and later use, and has a person who possesses an enrolled identifier take reasonable care against unauthorized access and keep it no longer than reasonably necessary for the stated purposes. Those retention limits govern the biometric identifier itself, not a log or record of events, and the chapter states no duty to create, keep, produce or review a log, no audit, and no power to demand records. It states no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
This chapter requires that a person not enroll a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of the biometric identifier for a commercial purpose.
"Biometric identifier" categorically excludes an ordinary physical or digital photograph, video, or audio recording, and data generated from one, with no exception for a photo or recording generated or used to identify a specific individual; the "used to identify a specific individual" language in this chapter instead qualifies the affirmative half of the definition (a measurement of a fingerprint, voiceprint, retina, iris, or other unique biological pattern), not the photograph and recording exclusion.
Unlike MHMDA, this chapter may be enforced solely by the attorney general under the consumer protection act, with no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).
When LexLint raises it
When your app profile says your app crawls the web or processes biometric data.
Back to the example · Lint your app
Page updated .