The bill creates a new chapter in Title 19 RCW and adds new sections to chapter 19.373 RCW establishing a state personal data privacy law. It provides a detailed definitions section (including terms such as affirmative consent, controller, consumer, personal data, sensitive data, consumer health data, precise geolocation, contextual advertising, deidentified data, first‑party data, and others) and sets rules about when affirmative consent is required and what does not qualify as affirmative consent. Substantive legal changes include new consumer rights and controller/processor duties. Consumers gain rights to access, correct, delete, obtain portability, receive lists of third‑party transfers, and opt out of targeted advertising, sales of personal data, and certain profiling that produces solely automated decisions with legal or similarly significant effects. Controllers must limit collection and processing to what is strictly necessary for a requested product or service, implement reasonable security practices, provide clear privacy notices, avoid dark patterns, provide an easy revocation mechanism (processing to cease no later than 15 days after revocation), and generally may not discriminate against consumers for exercising rights. The bill requires affirmative consent for transfer of sensitive data (with specified exceptions and cross‑references to RCW 19.373.030 and 19.373.070), prohibits selling most sensitive data, sets rules for financial incentive programs, and requires controllers to accept an opt‑out web link and to honor standardized opt‑out preference signals by December 31, 2025 (with specified residency verification rules). The bill creates procedural and compliance requirements: processors must follow controller instructions in binding contracts and implement security measures; controllers must conduct and document data protection assessments before initiating processing that presents heightened risk (including targeted advertising, sale of personal data, profiling with specified risks, and sensitive data), make summaries public and provide reports to the Attorney General on request, and meet specific deidentified data safeguards. The law contains enumerated exemptions (government entities, certain health and research records, COPPA‑compliant practices for parental consent, airline data preempted by federal law, journalistic uses, and others), declares violations to be unfair or deceptive under the Consumer Protection Act, and gives the Attorney General authority to seek civil actions after a 30‑day cure notice (the right‑to‑cure provision expires August 1, 2027; sections 12 and 13 take effect August 1, 2026). Important text is missing or truncated in the extracted material: definitions and cross‑references that rely on RCW 19.373.010 are not provided here, some sections begin or end mid‑sentence, and the act’s overall effective and expiration dates (where mentioned in the header) are not specified in the provided facts.

If enacted, most businesses that do business in Washington or target Washington residents — especially online platforms, advertisers, ad tech vendors, data brokers, and any company that profiles users or handles sensitive or health-related information — will face new, specific duties that will change operations and raise costs. They will need to limit the data they collect to what is strictly necessary, get clear affirmative consent for sensitive transfers, provide prominent opt-out links and accept opt-out signals by December 31, 2025, respond to consumer access/correction/deletion/portability requests (generally within 45 days and free twice a year), stop processing within 15 days after a consent revocation, run documented data protection assessments before risky activities (like targeted ads, sales of data, profiling or handling sensitive data) with the first assessment due within one year of that section’s effective date, and put stronger security and contractual controls in place with processors and recipients. Practically this will mean up‑front and ongoing costs for legal and privacy staffing, updating notices and contracts, building technical opt-out and request-handling processes, and potential operational changes to avoid collecting or selling sensitive categories. Enforcement is brought through the Attorney General under the state consumer protection framework, with a required 30‑day notice-to-cure before suit (that notice right expires August 1, 2027) and key enforcement provisions taking effect August 1, 2026, so businesses face litigation and compliance risk if they fail to act. Important details needed to fully estimate impacts are missing from the extracted text: the specific rules governing sale and other handling of consumer health data are referenced but not included, and the exact effective date for some sections is not provided, so organizations will need to monitor the final law and guidance to determine timing and how narrow exemptions apply.