United States law applies in WashingtonWashington is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Washington, described on this page below, applies here too.
Washington has 1 local jurisdictionThat local jurisdiction has law of its own, on a page of its own, listed below.
22 of 23 named instruments researched to a stage, across five of the ten areas of law we track: 20 in force and 2 not yet in force. As of .
When each starts18 of 22 carry a date, 4 do not. Earlier is before 2015.
in forcenot yet in forceblocked by a courtproposedno longer in force
AI law6 instruments, 4 in force, 2 not yet in force
Research summary (289 words)
Washington's AI-transparency and output-labeling law is concentrated in criminal and election-integrity statutes rather than a single omnibus act. Chapter 29B.35 RCW requires a disclosure on synthetic media used in electioneering communications, with a private right of action for a candidate whose appearance or speech is fabricated.
Chapter 9.68A RCW's fabricated-depiction provisions and RCW 9A.86.030 criminalize AI-generated (fabricated) sexual depictions of minors and fabricated intimate images of any person, both enacted in 2024 and the minors provision further expanded in 2026 to reach a fabricated depiction even where the minor is not identifiable.
Washington's 2026 session enacted two consumer-facing AI-transparency statutes, both signed on : a companion-chatbot disclosure and safety act (taking effect ) and an AI content-provenance and disclosure act requiring covered generative AI providers to embed detectable provenance data in synthetic media (taking effect ); both are enforced as Consumer Protection Act violations rather than through a standalone penalty scheme.
A 2026 amendment to the Personality Rights Law (RCW 63.60) extends that law's civil remedies to an unauthorized 'forged digital likeness' created or altered by AI. The 2024 act establishing an AI task force is SB 5838; House Bill 1951, a different and unrelated bill on algorithmic discrimination that did not advance past a single committee hearing, does not establish it. The task force act is government-facing only and is not described as an instrument here.
A 2025-2026 bill addressing employer use of automated decision systems and workplace electronic monitoring, HB 1672, remained in House Appropriations without a floor vote as of the date shown, rather than enacted, and is likewise not described as an instrument here. Washington's My Health My Data Act is a privacy-topic instrument and is not restated here.
RCW 9A.86.030official text, Washington State Legislature (app.leg.wa.gov)
In force since .Binds public and private bodies.
What this law does
A person commits the crime of disclosing fabricated intimate images by knowingly disclosing a fabricated intimate image, one created or altered by digitization, including through artificial intelligence, to depict intimate body parts or sexual activity that did not actually occur, of another identifiable person, knowing or having reason to know the depicted person has not consented and that disclosure would cause harm.
It is not a defense that the discloser lacked knowledge the image had been digitized or that the depicted person consented to the image's creation or alteration. The offense is a gross misdemeanor on a first offense and a class C felony on a repeat offense, and the statute carves out public-interest disclosures and ordinary interactive-service-provider conduct.
Washington's sexual exploitation of children chapter defines a 'fabricated depiction' as visual or printed matter created or altered by digitization, expressly including the use of artificial intelligence, to depict a minor engaging in sexually explicit conduct, and treats a fabricated depiction the same as an authentic one for dealing, possession, and exploitation offenses, most of which are felonies under chapter 9A.20 RCW.
The state need not prove the depicted minor's identity or that the minor actually exists, and it is not a defense that the person lacked knowledge of whether the image was fabricated. A 2026 amendment expanded the fabricated-depiction definition to reach a depiction even where the minor is not identifiable, effective , closing a gap the legislature found was allowing AI-generated material to evade the original identifiable-minor requirement.
Washington's Personality Rights Law gives every individual or personality a property right in their name, voice, signature, photograph, or likeness, and a 2026 amendment extended that right to a 'forged digital likeness': a persistent or real-time visual or audio representation of an actual, identifiable individual that has been digitally created, adapted, altered, or modified to be indistinguishable from an authentic depiction.
Using or authorizing use of a person's forged digital likeness without written or oral consent, in commerce, advertising, merchandise, or solicitation, infringes the right.
An infringer is subject to a $3,000 civil penalty and liable for actual damages, attributable profits, and, where the infringement involves a forged digital likeness specifically, noneconomic damages regardless of whether the infringement produced any profit; the superior courts may also grant injunctive relief and order impoundment of infringing materials.
Not yet in force.from ,in 2 months It starts to bind on .
Binds private bodies.
What this law does
An operator of an AI companion chatbot, an AI system a reasonable person could mistake for a human conversational partner, must clearly and conspicuously disclose at the start of an interaction, at least every three hours during continued interaction, and at the start of every new session that the user is talking with an artificial system.
Where the operator knows the user is a minor, it must additionally disclose proactively, implement reasonable measures against sexually explicit or suggestive content, and prohibit manipulative engagement techniques designed to prolong an emotional attachment. An operator must also maintain protocols to detect and respond to expressions of self-harm or suicidal ideation, including crisis-resource referrals, and publicly report on those protocols annually.
A violation is enforced as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, rather than through a standalone penalty.
Not yet in force.from ,in 3 months It starts to bind on .
Binds private bodies.
What this law does
A 'covered provider,' a person that creates, codes, or otherwise produces a generative AI system with over 1,000,000 monthly visitors or users publicly accessible in Washington, must offer users an optional, difficult-to-remove manifest disclosure identifying AI-generated image, video, or audio content as such, and must separately embed a latent (system-readable) disclosure in AI-generated image, video, or audio content conveying the provider's name, the generating system and version, and the content's creation date, detectable by the provider's own free public AI-detection tool.
A covered provider that licenses its generative AI system must require by contract that the licensee preserve this disclosure capability. A violation is enforced as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW. The bill's introduced text also proposed a disclosure duty for a government agency using AI to interact with consumers; that duty is not confirmed against the final chaptered text and is not described further here.
A candidate whose appearance, action, or speech is altered through synthetic media, an image, audio recording, or video recording intentionally manipulated with generative adversarial network techniques or other digital technology to create a realistic but false depiction, in an electioneering communication may seek injunctive relief and may bring a civil action for general or special damages against the sponsor.
It is an affirmative defense that the communication carries a conspicuous disclosure stating the media has been manipulated, in a form and duration the statute specifies for visual and audio media respectively. A medium disseminating the communication is generally not liable, except where it strips the required disclosure or itself alters content into synthetic media.
Washington has no general-purpose comprehensive consumer privacy statute. A proposed omnibus bill, HB 1671, died in House Appropriations without a hearing in the 2025 session and was administratively reintroduced, not advanced, for 2026. Private-sector personal data is instead governed by two sectoral statutes: the My Health My Data Act (RCW 19.373), covering consumer health data including biometric identifiers, and the Biometric Privacy Law (RCW 19.375), covering biometric identifiers directly.
The two statutes diverge sharply on an identifier extracted from a photo, video, or audio recording. RCW 19.375 excludes such an identifier from its definition of biometric identifier, so a faceprint or voiceprint pulled from an existing recording falls outside it, while MHMDA's biometric data definition carries no such exclusion and reaches that same identifier as consumer health data.
MHMDA and the breach notification statute (RCW 19.255) both arm consumers with a private right of action; RCW 19.375 is enforceable solely by the Attorney General. MHMDA's private right of action is now under active litigation, including a pending 2025 suit against Amazon over location data collection and a 2025 class action against a Seattle area cannabis retailer.
Requires a person to provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling an individual's biometric identifier in a database for a commercial purpose.
Biometric identifier is defined as data from automatic measurement of biological characteristics such as fingerprint, voiceprint, retina, or iris, but the definition excludes any identifier generated from a photo, video, or audio recording and any Health Insurance Portability and Accountability Act (HIPAA) covered information, so a faceprint or voiceprint pulled from an existing recording falls outside this statute even though the same identifier is covered as consumer health data under the My Health My Data Act.
An enrolled identifier may be retained no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention, and the chapter separately exempts Gramm-Leach-Bliley financial institutions and law enforcement.
Requires a person or business conducting business in Washington and owning or licensing data that includes personal information to notify affected residents of a breach of unsecured personal information in the most expedient time possible and no more than 30 calendar days after discovery, and to notify the Attorney General where a breach affects more than 500 Washington residents.
Personal information expressly includes biometric data generated by automatic measurement of biological characteristics such as a fingerprint, voiceprint, retina, or iris, and unlike the state's dedicated Biometric Privacy Law, this definition carries no exclusion for an identifier extracted from a photograph, video, or audio recording.
Requires a private regulated entity to obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, a category that includes biometric data extracted from imagery or voice recordings with no exclusion for a recording-derived identifier, and a further signed authorization before selling it.
Bans geofencing within 2,000 feet of a health care facility to identify, track, or notify consumers seeking care, and grants consumers the right to confirm, access, withdraw consent to, and delete their data within 45 days, extendable once by 45 more days.
Washington's Cybercrime Act codifies a technological-access-barrier definition of without authorization that closely tracks the hiQ Labs v. LinkedIn / Van Buren gates-based reading, resolving by statute a question the Computer Fraud and Abuse Act (CFAA) leaves to case law, and it separately excludes both white-hat security research and a bare ToS or acceptable-use-policy violation from that definition.
No reported Washington decision has applied that definition to an automated-collection fact pattern; it stands as plain statutory text rather than a litigated holding.
Its My Health My Data Act (MHMDA) defines consumer health data broadly, reaching inferred data and data derived from nonhealth information, restricts geofences around entities that provide in-person health care services, and makes a violation an unfair or deceptive act under the state Consumer Protection Act, so a person injured in business or property may sue under that Act, and a private class action has been consolidated in the Western District of Washington (Maxwell v. Amazon.com, consolidated into In re Amazon Ads SDK Litigation, No. 2:25-cv-00252-BJR, effective ).
Its Biometric Identifiers chapter, by contrast, is enforceable solely by the Attorney General, with no private right of action. Washington has no general comprehensive consumer privacy act comparable to Oregon's, Tennessee's, Texas's, or Virginia's; personal-data reach here runs through these two sector-specific statutes instead. Copyright, text-and-data-mining, and database rights are federal only; Washington adds nothing there.
No Washington statute or pending bill was found that specifically governs the use of scraped data to train artificial intelligence models. ToS civil enforceability rests on ordinary contract law, and robots.txt carries no independent legal weight by name, though a robots.txt block could plausibly function as a technological access barrier under the Cybercrime Act's own definition in some readings; this is untested.
Washington recognizes the tort of trespass to chattels and states it in the Restatement's terms, as intentionally dispossessing another of a chattel or using or intermeddling with it (Kozol v. JPay, Inc., an unpublished Court of Appeals decision about software that caused inmates' music players to malfunction, citing Repin v. State, 198 Wn. App.
243 (2017)); Kozol disposed of the claim on intent and left open whether the owners were harmed, treating harm as an issue in the claim, and no Washington decision applies the tort to server load or crawling.
RCW 9A.90.040 (computer trespass, first degree) and RCW 9A.90.050 (second degree) prohibit gaining access to a computer system or electronic database without authorization.
RCW 9A.90.030(12) statutorily defines without authorization as knowingly circumventing technological access barriers to a data system to obtain information without the owner's express or implied permission, where the access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining the information, but the definition expressly excludes white hat security research and circumventing a measure that does not effectively control access to a computer, and expressly excludes a bare violation of a duty, agreement, or contractual obligation such as an acceptable use policy or terms of service agreement.
This is a codified, narrow, gates-based authorization test, functionally aligned with the Ninth Circuit's hiQ v. LinkedIn reasoning and the gates-up-or-down logic of Van Buren v. United States: a public page with no technological access barrier cannot, by the statute's own definition, be accessed without authorization no matter what a posted policy says, and a bare ToS violation with no technical circumvention does not satisfy the definition either.
RCW 19.375official text, Washington State Legislature (app.leg.wa.gov)
In force since .Binds private bodies.
What this law does
This chapter requires that a person not enroll a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of the biometric identifier for a commercial purpose.
"Biometric identifier" categorically excludes an ordinary physical or digital photograph, video, or audio recording, and data generated from one, with no exception for a photo or recording generated or used to identify a specific individual; the "used to identify a specific individual" language in this chapter instead qualifies the affirmative half of the definition (a measurement of a fingerprint, voiceprint, retina, iris, or other unique biological pattern), not the photograph and recording exclusion.
Unlike MHMDA, this chapter may be enforced solely by the attorney general under the consumer protection act, with no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).
RCW 19.373official text, Washington State Legislature (app.leg.wa.gov)
In force since .Binds private bodies.
What this law does
MHMDA defines consumer health data as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, a definition that reaches inferences and non-health data indicating health status, such as precise location data that could indicate an attempt to obtain reproductive or gender-affirming care.
Because 'consumer health data' is itself defined as a subset of 'personal information,' and 'personal information' does not include publicly available information (RCW 19.373.010(18)(b)) or deidentified data, scraped health-indicating data that fits MHMDA's own publicly-available definition falls outside its coverage; that carve-out, however, does not extend to biometric data, which MHMDA's 'publicly available information' definition expressly excludes even when otherwise public (RCW 19.373.010(22)).
RCW 19.373.080 makes it unlawful to implement a geofence around an entity providing in-person health care services to identify or track consumers, collect their health data, or send them related notifications, messages, or advertisements. RCW 19.373.090 provides that any violation of the chapter is per se an unfair or deceptive act under the Washington Consumer Protection Act, chapter 19.86 RCW, which carries a long-standing private right of action, giving MHMDA its own enforcement mechanism.
MHMDA's private right of action has already been tested: Maxwell v. Amazon.com, Inc., No. 2:25-cv-261 (W.D. Wash., filed ), a putative class action alleging Amazon harvested location and biometric data via SDKs without consent in violation of MHMDA, was consolidated by court order into In re Amazon Ads SDK Litigation, No. 2:25-cv-00252-BJR (W.D. Wash.), effective .
Washington's private-sector security duties are narrow: the Department of Financial Institutions' security program and business resumption rules for money services licensees are its one sector regime, filed as a row of its own.
There is no standalone general reasonable-security duty of the New York 899-bb, Massachusetts 201 CMR 17.00, California 1798.81.5, or Oregon 646A.622 shape: RCW 19.255, Washington's only enacted personal-information security statute, is titled "Personal Information, Notice of Security Breaches" and, read in full (sections 005, 010, 020, 030, and 040), consists entirely of breach-notification duties, processor and vendor liability tied to payment-card breaches, deemed-compliance for Health Insurance Portability and Accountability Act (HIPAA)- and Gramm-Leach-Bliley Act (GLBA)-regulated entities, and Attorney General and private-plaintiff enforcement; unlike New York's SHIELD Act or Delaware's, Indiana's, and Louisiana's statutes, it was never amended to add a separate safeguards-and-disposal section, so it is filed entirely as this jurisdiction's privacy-topic breach-notification row rather than split across the two topics.
Washington's two comprehensive sectoral data-protection acts each carry their own security-of-processing clause, and each stays with privacy under this profile's Test 2 rather than moving here: the My Health My Data Act's RCW 19.373.050 requires a regulated entity or small business to "[e]stablish, implement, and maintain administrative, technical, and physical data security practices" for consumer health data, and the Biometric Identifiers law's RCW 19.375.020(4)(a) requires a person who has enrolled a biometric identifier to "take reasonable care to guard against unauthorized access to and acquisition of" it; both are one section of a comprehensive regime rather than a standalone security statute, the same shape as General Data Protection Regulation (GDPR) Article 32 and Illinois's Biometric Information Privacy Act (BIPA).
Washington has no cybersecurity affirmative-defense safe-harbor statute comparable to Ohio's, Connecticut's, Utah's, or Iowa's; only those four states have enacted one. Washington has no enacted statute, in Title 19 RCW or elsewhere, setting security requirements a connected device or software product must meet to be placed on the market, comparable to California's or Oregon's connected-device statutes.
Washington has no insurance data security law: the Insurance Data Security Act, SB 5956 (2021-22 Regular Session, by request of the Insurance Commissioner, modeled on the NAIC Insurance Data Security Model Law and closely tracking other states' enactments), received only a first reading and referral to the Senate Committee on Business, Financial Services & Trade on , and advanced no further; the current chapter list of Title 48 RCW (Insurance), read in full, confirms no insurance data-security chapter was ever added, so Washington remains among the states that have not adopted the model act.
Washington has no private-sector vulnerability or incident-reporting duty: its only cybersecurity incident-reporting statute, RCW 43.105.470 (added by 2021 c 291, within the Washington Technology Solutions chapter establishing the Office of Cybersecurity), binds only state agencies, which must report a major cybersecurity incident to the Office of Cybersecurity within 24 hours of discovery, and it is filed as a row of its own with no activity flag.
A computer-misuse offense alone is not a presence in this topic: the Washington Cybercrime Act's computer-trespass and technological-access-barrier provisions, RCW 9A.90, bind the person doing the accessing and are already filed under this jurisdiction's scraping-topic row.
RCW 43.105.470 requires state agencies, in the event of a major cybersecurity incident as defined in policy established by the office of cybersecurity, to report the incident to the office of cybersecurity within 24 hours of discovery.
WAC 208-690-240 requires each licensee under the Uniform Money Services Act to establish and maintain an information security program to ensure the availability and functionality of its electronic systems and to protect those systems and any sensitive data stored on them from unauthorized access, use, or tampering.
WAC 208-690-280 requires a licensee to have a written plan that details the company's response and recovery to any event that results in damage to or destruction of books and records or a data breach.
Each licensee must establish and maintain an information security program to ensure the availability and functionality of its electronic systems and to protect those systems and any sensitive data stored on them from unauthorized access, use, or tampering. Generally, applicants and licensees must have a written program appropriate to the company's size and complexity, the activity conducted, and the sensitivity of the information at issue.
The program must ensure the information's security and confidentiality, protect against anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information. A licensee must have a written plan that details the company's response and recovery to any event that results in damage to or destruction of books and records or a data breach. A licensee is a person licensed under chapter 19.230 RCW.
RCW 43.105.470Official statute text, Revised Code of Washington, chapter 43.105
In force since .Binds government bodies.
What this law does
In the event of a major cybersecurity incident, as defined in policy established by the office of cybersecurity, state agencies must report that incident to the office of cybersecurity within 24 hours of discovery. State agencies must provide the office of cybersecurity with contact information for any external parties who may have material information related to the cybersecurity incident.
Once a cybersecurity incident is reported, the office of cybersecurity must investigate the incident to determine the degree of severity and facilitate any necessary incident response measures that need to be taken to protect the enterprise.
Washington's central instrument in this topic is chapter 9.73 RCW, the state Privacy Act, an all-party-consent statute for recording or intercepting a private communication or conversation; consent is also established when one party announces the recording to all the others in a reasonably effective manner, provided the announcement is itself recorded, and a narrow class of calls (emergencies, threats, anonymous or repeated calls at inconvenient hours) may be recorded with one party's consent, and a violation carries both a civil action with liquidated damages of $100 a day up to $1,000 and criminal exposure as a gross misdemeanor.
The state's pen register and trap and trace statute, RCW 9.73.260, authorizes and conditions law enforcement's own use of such a device under a court order and binds only law enforcement officers and the providers who assist them; the private-actor tracking-consent instrument is the Computer Spyware Act, chapter 19.270 RCW, filed as a row of its own.
For telephone contact, RCW 80.36.390 requires a telephone solicitor to identify itself within 30 seconds, honor a stop request within 10 seconds and off its lists for a year, observe 8 a.m. to 8 p.m. calling hours, honor the federal National Do Not Call Registry, and comply with the federal Truth in Caller ID Act, backed by a private action with a $1,000-per-violation floor; RCW 80.36.400 bans the use of an automatic dialing and announcing device for commercial solicitation, an unsolicited call to encourage a purchase, and states no consent-based exception, and extends liability to anyone who substantially assists in transmitting the call; RCW 80.36.540 bars an unsolicited fax advertisement absent a prior business relationship or the recipient's consent; and chapter 19.158 RCW requires a commercial telephone solicitor to register with the Department of Licensing before doing business in the state, backed by a private action for actual damages and fees, a court-imposed civil penalty of $500 to $2,000 per violation, and misdemeanor exposure for a salesperson who solicits for an unregistered principal.
For commercial messages, chapter 19.190 RCW, the Commercial Electronic Mail Act, prohibits only the falsity-or-deception forms of commercial email abuse (domain-name misrepresentation and a false or misleading subject line), the kind of state email rule the federal CAN-SPAM Act's preemption clause, 15 U.S.C. 7707(b)(1), leaves in force; it separately bans initiating or assisting an unsolicited commercial text message to a Washington cellular or pager number absent the carrier's own opt-out relationship or the subscriber's prior express consent, a prohibition CAN-SPAM's preemption clause does not reach because it addresses a telephone number rather than an email address.
Washington has no general comprehensive consumer-privacy statute giving a person a right to object to or opt out of direct or targeted marketing; its enacted privacy statutes are limited to health data under the My Health My Data Act, chapter 19.373 RCW, and biometric identifiers under chapter 19.375 RCW, both researched separately as privacy law.
Chapter 19.270 RCW, the Computer Spyware Act, authorizes the attorney general and an adversely affected provider of computer software or owner of a website or trademark to sue a violator.
Chapter 19.190 RCW, the Commercial Electronic Mail Act, prohibits initiating, conspiring to initiate, or assisting the transmission of a commercial electronic mail message, one sent to promote real property, goods, or services for sale or lease, from a Washington computer or to an address the sender knows or has reason to know is held by a Washington resident, where the message uses a third party's internet domain name without permission or otherwise misrepresents or obscures the point of origin or transmission path, or carries a subject line that, based on the sender's actual knowledge or knowledge fairly implied on the basis of objective circumstances, contains false or misleading information.
Unlike the federal CAN-SPAM Act, the statute does not mandate an opt-out mechanism, a physical address, or an advertisement label. Both of its prohibitions are framed as rules against falsity or deception, the kind of state email rule that CAN-SPAM's preemption clause leaves in force while superseding the rest.
A violation is a per se unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, and damages to the recipient are $100 or actual damages, whichever is greater (as amended by chapter 135, Laws of 2026, which applies to every action commenced on or after , whenever the cause of action arose), and to an interactive computer service $1,000 or actual damages, whichever is greater.
An interactive computer service may also block or filter mail it reasonably believes violates the chapter without being liable for that action. The sections this entry groups came into force on different days.
RCW 19.190.060 prohibits a person conducting business in the state from initiating or assisting in the transmission of a commercial electronic text message to a telephone number assigned to a Washington resident for cellular telephone or pager service equipped with text-messaging capability, an outright ban rather than a disclosure-and-opt-out model.
RCW 19.190.070 excepts a message a cellular or pager carrier sends at no cost to its own existing subscriber, unless that subscriber has said it does not want further commercial text messages, and any message the subscriber has clearly and affirmatively consented in advance to receive. A person offering cellular or pager service is not liable merely for serving as an intermediary between the sender and the recipient unless it is assisting in the transmission.
A violation is a per se unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, and damages to the recipient are $100 or actual damages, whichever is greater (as amended by chapter 135, Laws of 2026, for actions commenced on or after ), and to an interactive computer service $1,000 or actual damages, whichever is greater.
Chapter 19.270 RCWRevised Code of Washington, official text (app.leg.wa.gov)
In force since .Binds public and private bodies.
What this law does
RCW 19.270.020 makes it unlawful for a person, without the authorization of the owner or operator, to transmit, or procure the transmission of, software to the owner or operator's computer with actual knowledge or conscious avoidance of actual knowledge that the software does any of the things listed in its subsections (1) to (11).
RCW 19.270.040 makes it unlawful for a person who is not an owner or operator to induce the owner or operator to install a computer software component by deceptively misrepresenting that installing it is necessary for maintenance, update or repair, security or privacy, the proper operation of the computer, or opening, viewing or playing content.
RCW 19.270.050 exempts monitoring of, or interaction with, a computer by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, maintenance, repair, authorized updates, authorized remote system management, or detection or prevention of unauthorized or fraudulent use, from RCW 19.270.020(5) through (11) and RCW 19.270.040, the only provisions it names.
In this chapter, an owner or operator is the owner or lessee of a computer, or someone using it with the owner's or lessee's authorization, and does not include a person who owns a computer before its first retail sale.
Under RCW 19.270.060, the attorney general, or a provider of computer software or owner of a website or trademark who is adversely affected and whose action arises directly out of that status, may sue a violator for an injunction and for actual damages or $100,000 per violation, whichever is greater. A court may increase those damages up to three times if the defendant has engaged in a pattern and practice of violating the chapter.
The damages determined under RCW 19.270.060 may not exceed two million dollars. Chapter 66, Laws of 2008, repealed RCW 19.270.030, the 2005 section on taking control of a computer.
Chapter 9.73 RCW, Washington's Privacy Act, makes it unlawful for any individual, partnership, corporation, association, or the state and its political subdivisions to intercept or record a private communication or a private conversation without first obtaining the consent of all the participants or persons engaged in it.
Consent is established when one party announces to all the others, in a reasonably effective manner, that the communication is about to be recorded or transmitted, provided the announcement is itself recorded. A call or conversation of an emergency nature, one conveying threats of extortion, blackmail or bodily harm, one occurring anonymously, repeatedly or at an extremely inconvenient hour, or one with a hostage holder or barricaded person may be recorded with the consent of one party.
A common carrier acting under its filed tariffs, and an officer, agent or employee of such a carrier who performs an otherwise prohibited act in the construction, maintenance, repair and operations of the carrier's communications services, facilities or equipment or incident to the use of those services, facilities or equipment, are excepted.
An employee of a news organization gathering news is deemed to have consent only if consent is expressly given or the recording or transmitting device is readily apparent or obvious to the speakers. A person injured by a violation may bring a civil action for actual damages, including mental pain and suffering, or liquidated damages of $100 a day up to $1,000, plus a reasonable attorney's fee and litigation costs, and a violation of the consent requirement is a gross misdemeanor.
The Washington Supreme Court has held that reading and responding to a text message intended for someone else, before the intended recipient has seen it, is an interception under this chapter within the ordinary meaning of a term the statute leaves undefined. The sections this entry groups came into force on different days.
RCW 80.36.400Revised Code of Washington, official text (app.leg.wa.gov)
In force.Binds public and private bodies.
What this law does
RCW 80.36.400 bans the use of an automatic dialing and announcing device, a system that automatically dials telephone numbers and transmits a recorded or artificial voice message once a connection is made, including a message that goes directly to a recipient's voicemail, for commercial solicitation, defined as the unsolicited initiation of a telephone communication to encourage a purchase or to wrongfully obtain anything of value.
It extends to a person who substantially assists in transmitting a commercial solicitation while knowing or consciously avoiding knowledge that the initiator is violating the Consumer Protection Act, subject to an affirmative defense for a telecommunications provider that complied with federal telemarketing rules and implemented a reasonably effective plan to mitigate such calls.
A violation is a per se unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, and a person injured may sue in superior court to enjoin further violations and recover actual damages or $1,000 per violation, whichever is greater. The provisions this entry describes came into force on different days.
Chapter 19.158 RCWRevised Code of Washington, official text (app.leg.wa.gov)
In force since .Binds private bodies.
What this law does
Chapter 19.158 RCW requires a commercial telephone solicitor, defined broadly to include a person who calls to encourage a purchase or investment or to wrongfully obtain anything of value, subject to exceptions including calls made in response to the called party's own inquiry, to register with the Department of Licensing before doing business in the state, whether soliciting from a Washington location or soliciting Washington purchasers from elsewhere; a solicitor must register even to maintain or defend a lawsuit here.
A violation is a per se unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW. A person injured by a violation may sue for actual damages, court costs and attorney's fees; a court must impose a civil penalty of $500 to $2,000 per violation; and a salesperson who solicits purchasers on behalf of a commercial telephone solicitor that is not currently registered is guilty of a misdemeanor. The effective date of the act, as originally enacted, was .
RCW 80.36.390Revised Code of Washington, official text (app.leg.wa.gov)
In force.Binds private bodies.
What this law does
RCW 80.36.390 requires a telephone solicitor, a commercial or nonprofit company or organization that initiates an unsolicited call to encourage a purchase, to wrongfully obtain anything of value, or to solicit a donation, to identify itself and the company or organization on whose behalf it is calling, and the purpose of the call, within the first 30 seconds.
The section does not reach a call made in response to the called party's request or inquiry, including a call about an item the called party bought from the caller within the previous 12 months, a call by a nonprofit or a membership or labor organization to its own members, a call limited to polling or soliciting opinions or votes, or a business-to-business contact.
A solicitor asking for a donation must ask whether the called party wants to continue the call, end it, or be removed from the solicitor's lists. If the called party indicates a wish to end the call, or says they do not want to be called again, the solicitor must end the call within 10 seconds; in the latter case the solicitor must also keep the number off its lists for at least one year and not sell or give the contact information to another company or organization.
A solicitor may not call before 8 a.m. or after 8 p.m. local time at the called party's location, may not call a number registered on the federal National Do Not Call Registry, and may not violate the federal Truth in Caller ID Act, 47 U.S.C. 227(e).
A violation is punishable by a fine of up to $1,000 and is enforceable by the Attorney General as a Consumer Protection Act violation, and a person aggrieved by repeated violations may sue in superior court for an injunction and damages, with the court required to award at least $1,000 for each individual violation plus reasonable attorney's fees. The provisions this entry describes came into force on different days.
RCW 80.36.540Revised Code of Washington, official text (app.leg.wa.gov)
In force since .Binds public and private bodies.
What this law does
RCW 80.36.540 bars initiating an unsolicited telefacsimile message, the transmittal of electronic signals over telephone lines for conversion into written text, that promotes goods or services for purchase, unless the recipient has a prior contractual or business relationship with the sender.
That exception does not apply where the sender knew or should have known the recipient is a government entity, and sending is unlawful regardless of any prior relationship once the recipient has sent the initiator a written or fax message clearly indicating it does not want to receive further faxes. The prohibition is a per se unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, and damages to the recipient are $500 or actual damages, whichever is greater.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Age gating law
Washington has not enacted an age-gating statute in any of the four families as of this date. A 2025-2026 bill to require age verification for adult content websites (HB 2112) was heard in a House committee on and advanced no further.
SB 5708, a companion bill on protecting Washington children online that would have required social media platforms to verify age and limit addictive features for minors, passed the Senate 36 to 12 on , but the House did not pass it, and it stood in the Senate Rules Committee "X" file in the 2026 session. Its House companion, HB 1834, stood in the House Rules Committee "X" file in the 2026 session without passing the House. Apart from SB 5708, no app store accountability or age appropriate design code bill has advanced past committee.
As of .
Reuse law
No Washington statute creates a press-publisher neighbouring right, a platform-to-publisher bargaining code, or a snippet-reproduction right distinct from federal copyright law as of the date shown.
The Consumer Protection Act's unfair and deceptive trade practices title (RCW 19.86) and Washington's Uniform Trade Secrets Act (RCW 19.108) carry no aggregation-specific duty, and no Washington bill comparable to California's Journalism Preservation Act or the federal Journalism Competition and Preservation Act was located in the Legislature's bill history.
Federal copyright law, including 17 U.S.C. Section 301 preemption of state-law equivalents to a reproduction right, governs a Washington aggregator's treatment of headlines and snippets and is recorded in the federal document rather than restated here. No Washington appellate decision recognizing a hot-news misappropriation claim distinct from the general common-law unfair-competition doctrine has been identified.
As of .
Reporting clocks that run here18 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Washington comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
In the event of a major cybersecurity incident, as defined in policy established by the office of cybersecurity, report the incident to the office of cybersecurity within 24 hours of discovery.
Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.
Notify the Washington Attorney General of any breach affecting more than 500 Washington residents within 30 days after the breach was discovered.
The law of the United States, which applies in Washington
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
Law in local jurisdictions1 with a page
Each has a page of its own; the number is how many of its instruments are researched to a stage.
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
