Washington

A person commits the crime of disclosing fabricated intimate images by knowingly disclosing a fabricated intimate image, one created or altered by digitization, including through artificial intelligence, to depict intimate body parts or sexual activity that did not actually occur, of another identifiable person, knowing or having reason to know the depicted person has not consented and that disclosure would cause harm.

It is not a defense that the discloser lacked knowledge the image had been digitized or that the depicted person consented to the image's creation or alteration. The offense is a gross misdemeanor on a first offense and a class C felony on a repeat offense, and the statute carves out public-interest disclosures and ordinary interactive-service-provider conduct.

Washington's sexual exploitation of children chapter defines a 'fabricated depiction' as visual or printed matter created or altered by digitization, expressly including the use of artificial intelligence, to depict a minor engaging in sexually explicit conduct, and treats a fabricated depiction the same as an authentic one for dealing, possession, and exploitation offenses, most of which are felonies under chapter 9A.20 RCW.

The state need not prove the depicted minor's identity or that the minor actually exists, and it is not a defense that the person lacked knowledge of whether the image was fabricated. A 2026 amendment expanded the fabricated-depiction definition to reach a depiction even where the minor is not identifiable, effective June 11, 2026, closing a gap the legislature found was allowing AI-generated material to evade the original identifiable-minor requirement.

Washington's Personality Rights Law gives every individual or personality a property right in their name, voice, signature, photograph, or likeness, and a 2026 amendment extended that right to a 'forged digital likeness': a persistent or real-time visual or audio representation of an actual, identifiable individual that has been digitally created, adapted, altered, or modified to be indistinguishable from an authentic depiction.

Using or authorizing use of a person's forged digital likeness without written or oral consent, in commerce, advertising, merchandise, or solicitation, infringes the right.

An infringer is subject to a $3,000 civil penalty and liable for actual damages, attributable profits, and, where the infringement involves a forged digital likeness specifically, noneconomic damages regardless of whether the infringement produced any profit; the superior courts may also grant injunctive relief and order impoundment of infringing materials.

This law is enacted but does not take effect until January 1, 2027; what follows applies from that date. An operator of an AI companion chatbot, an AI system a reasonable person could mistake for a human conversational partner, must clearly and conspicuously disclose at the start of an interaction, at least every three hours during continued interaction, and at the start of every new session that the user is talking with an artificial system.

Where the operator knows the user is a minor, it must additionally disclose proactively, implement reasonable measures against sexually explicit or suggestive content, and prohibit manipulative engagement techniques designed to prolong an emotional attachment. An operator must also maintain protocols to detect and respond to expressions of self-harm or suicidal ideation, including crisis-resource referrals, and publicly report on those protocols annually.

A violation is enforced as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, rather than through a standalone penalty.

This law is enacted but does not take effect until February 1, 2027; what follows applies from that date.

A 'covered provider,' a person that creates, codes, or otherwise produces a generative AI system with over 1,000,000 monthly visitors or users publicly accessible in Washington, must offer users an optional, difficult-to-remove manifest disclosure identifying AI-generated image, video, or audio content as such, and must separately embed a latent (system-readable) disclosure in AI-generated image, video, or audio content conveying the provider's name, the generating system and version, and the content's creation date, detectable by the provider's own free public AI-detection tool.

A covered provider that licenses its generative AI system must require by contract that the licensee preserve this disclosure capability. A violation is enforced as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW. The bill's introduced text also proposed a disclosure duty for a government agency using AI to interact with consumers; that duty is not confirmed against the final chaptered text and is not described further here.

A candidate whose appearance, action, or speech is altered through synthetic media, an image, audio recording, or video recording intentionally manipulated with generative adversarial network techniques or other digital technology to create a realistic but false depiction, in an electioneering communication may seek injunctive relief and may bring a civil action for general or special damages against the sponsor.

It is an affirmative defense that the communication carries a conspicuous disclosure stating the media has been manipulated, in a form and duration the statute specifies for visual and audio media respectively. A medium disseminating the communication is generally not liable, except where it strips the required disclosure or itself alters content into synthetic media.

Requires a person to provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling an individual's biometric identifier in a database for a commercial purpose.

Biometric identifier is defined as data from automatic measurement of biological characteristics such as fingerprint, voiceprint, retina, or iris, but the definition excludes any identifier generated from a photo, video, or audio recording and any Health Insurance Portability and Accountability Act (HIPAA) covered information, so a faceprint or voiceprint pulled from an existing recording falls outside this statute even though the same identifier is covered as consumer health data under the My Health My Data Act.

An enrolled identifier may be retained no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention, and the chapter separately exempts Gramm-Leach-Bliley financial institutions and law enforcement.

Requires a person or business conducting business in Washington and owning or licensing data that includes personal information to notify affected residents of a breach of unsecured personal information in the most expedient time possible and no more than 30 calendar days after discovery, and to notify the Attorney General where a breach affects more than 500 Washington residents.

Personal information expressly includes biometric data generated by automatic measurement of biological characteristics such as a fingerprint, voiceprint, retina, or iris, and unlike the state's dedicated Biometric Privacy Law, this definition carries no exclusion for an identifier extracted from a photograph, video, or audio recording.

Requires a private regulated entity to obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, a category that includes biometric data extracted from imagery or voice recordings with no exclusion for a recording-derived identifier, and a further signed authorization before selling it.

Bans geofencing within 2,000 feet of a health care facility to identify, track, or notify consumers seeking care, and grants consumers the right to confirm, access, withdraw consent to, and delete their data within 45 days, extendable once by 45 more days.

RCW 9A.90.040 (computer trespass, first degree) and RCW 9A.90.050 (second degree) prohibit gaining access to a computer system or electronic database without authorization.

RCW 9A.90.030(12) statutorily defines without authorization as knowingly circumventing technological access barriers to a data system to obtain information without the owner's express or implied permission, where the access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining the information, but the definition expressly excludes white hat security research and circumventing a measure that does not effectively control access to a computer, and expressly excludes a bare violation of a duty, agreement, or contractual obligation such as an acceptable use policy or terms of service agreement.

This is a codified, narrow, gates-based authorization test, functionally aligned with the Ninth Circuit's hiQ v. LinkedIn reasoning and the gates-up-or-down logic of Van Buren v. United States: a public page with no technological access barrier cannot, by the statute's own definition, be accessed without authorization no matter what a posted policy says, and a bare ToS violation with no technical circumvention does not satisfy the definition either.

No Washington case law was found applying this definition to a scraping fact pattern specifically, so this is the plain statutory text rather than a litigated holding.

This chapter requires that a person not enroll a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of the biometric identifier for a commercial purpose.

"Biometric identifier" categorically excludes an ordinary physical or digital photograph, video, or audio recording, and data generated from one, with no exception for a photo or recording generated or used to identify a specific individual; the "used to identify a specific individual" language in this chapter instead qualifies the affirmative half of the definition (a measurement of a fingerprint, voiceprint, retina, iris, or other unique biological pattern), not the photograph and recording exclusion.

Unlike MHMDA, this chapter may be enforced solely by the attorney general under the consumer protection act, with no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).

MHMDA defines consumer health data as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, a definition that reaches inferences and non-health data indicating health status, such as precise location data that could indicate an attempt to obtain reproductive or gender-affirming care.

Because 'consumer health data' is itself defined as a subset of 'personal information,' and 'personal information' does not include publicly available information (RCW 19.373.010(18)(b)) or deidentified data, scraped health-indicating data that fits MHMDA's own publicly-available definition falls outside its coverage; that carve-out, however, does not extend to biometric data, which MHMDA's 'publicly available information' definition expressly excludes even when otherwise public (RCW 19.373.010(22)).

RCW 19.373.080 makes it unlawful to implement a geofence around an entity providing in-person health care services to identify or track consumers, collect their health data, or send them related notifications, messages, or advertisements. RCW 19.373.090 provides that any violation of the chapter is per se an unfair or deceptive act under the Washington Consumer Protection Act, chapter 19.86 RCW, which carries a long-standing private right of action, giving MHMDA its own enforcement mechanism.

This is now live litigation risk, not theoretical: Maxwell v. Amazon.com, Inc., No. 2:25-cv-261 (W.D. Wash., filed February 10, 2025), a putative class action alleging Amazon harvested location and biometric data via SDKs without consent in violation of MHMDA, is reported pending by contemporaneous legal commentary; the docket itself is not independently read, so treat its procedural posture as reported rather than verified.