The bill creates a new chapter in Title 19 RCW establishing protections for personal information of consumers who use financial services through mobile or internet applications. It requires financial institutions that offer banking services through such apps to disclose that their app may collect, store, or share personal information (including information from third-party apps on the consumer’s device), to allow consumers to opt out of collection, storage, or sharing of personal information when that activity is not necessary to provide a banking service, and to refrain from collecting, storing, or sharing personal information for consumers who have validly opted out. The bill also provides exemptions for information collection that is necessary to provide a banking service and a broader exemption if the institution ensures its app does not collect or share personal information except as necessary, does not access information from third-party apps on the consumer’s device, and does not allow third-party apps to obtain information from the institution’s app. Legally, this is a new law creating procedural privacy requirements and consumer rights, including defined terms for “banking service,” “consumer,” “financial institution,” “mobile or internet application,” “necessary to provide a banking service,” “personal information,” and “third-party application.” The bill declares violations to be unfair or deceptive acts under the Washington Consumer Protection Act (chapter 19.86 RCW) and creates a civil remedy: a person injured by a violation may recover the greater of statutory damages of $7,500 or actual damages under RCW 19.86.090. The attorney general may also recover statutory damages but must pay any statutory damages recovered as restitution to the injured person. The bill includes a severability provision. The extracted text does not specify the new chapter number or precise placement in Title 19, does not provide required details about the format or timing of disclosures, and does not describe any administrative enforcement procedures, notice or cure timelines, or other remedies beyond the civil damages and the consumer protection act reference. The definitions’ scope may rely on the full text of the referenced RCWs, which were not provided.

If enacted, banks, broker-dealers, and investment advisers that offer mobile or web apps will have to tell customers when their apps (or other apps on the customer’s device) may collect, store, or share personal information and must let customers opt out of any collection or sharing that isn’t necessary to provide the banking service. Institutions will have to stop collecting, storing, or sharing data for consumers who opt out, and they can avoid the disclosure and opt-out rules only if their app truly limits data handling to what’s necessary under the customer agreement and does not collect or share data from third-party apps. The groups most affected are the financial institutions, third-party app providers, and consumers. Financial firms will likely face added compliance work and costs to change app behavior, add opt-out functionality, and manage liability risks because violations can lead to at least $7,500 in statutory damages per injured person and enforcement by the attorney general (who must pay recovered damages to injured people). Consumers gain stronger control over app data and a clear path to monetary recovery. The bill leaves unclear how disclosures and opt-outs must be presented, timing requirements, and other enforcement procedures beyond damages, and it relies on definitions in other statutes.