Washington State tech privacy rulemaking
🔹 I. Background: The Rise of Tech Privacy Concerns
Washington is home to major tech companies like Microsoft, Amazon, and others, placing the state at the center of national conversations about data privacy, surveillance, facial recognition, and AI governance.
Concerns around:
Mass data collection
Facial recognition by government and private entities
Smart device surveillance (phones, cars, homes)
Biometric data usage
… have led the state to attempt comprehensive privacy regulation.
🔹 II. Key Legislative and Administrative Developments
Washington Privacy Act (WPA):
Introduced multiple times (2019–2022) but failed to pass in final form.
Modeled loosely on GDPR and California's CCPA/CPRA.
Would have given consumers rights over data access, deletion, and correction.
Facial Recognition Law (SB 6280, 2020):
Passed into law in 2020.
Regulates governmental use of facial recognition tech.
Requires meaningful oversight, testing, human review, and public notice.
My Health My Data Act (2023):
Protects health-related data not covered by HIPAA.
One of the strictest health data privacy laws in the U.S.
Applies broadly, including to non-healthcare businesses (e.g., apps, wearables).
Attorney General Rulemaking & Enforcement:
WA Attorney General’s Office plays a key role in interpreting and enforcing privacy laws under the Consumer Protection Act (CPA).
Engages in investigations, rulemaking guidance, and litigation.
📚 III. Key Case Law — Washington State Tech Privacy
Below are six landmark cases that have shaped the development and enforcement of tech privacy in Washington:
1. State v. Jackson, 150 Wash. 2d 251 (2003)
Issue: Warrantless GPS tracking of a vehicle by police.
Ruling: The Washington Supreme Court held that GPS surveillance without a warrant violates Article I, Section 7 of the Washington Constitution.
Significance:
Washington offers stronger privacy protections than the federal Fourth Amendment.
Government surveillance with tech tools (like GPS) requires strict compliance with warrant standards.
2. State v. Athan, 160 Wash. 2d 354 (2007)
Issue: Use of genetic material (DNA) obtained from a licked envelope sent to a fake address.
Ruling: The Court upheld the use of DNA, ruling that there was no reasonable expectation of privacy.
Significance:
Opened debate on biometric privacy and consent.
Shows court tendency to weigh privacy against law enforcement needs.
3. State v. Samalia, 186 Wash. 2d 262 (2016)
Issue: Police searched an unlocked cellphone during arrest without a warrant.
Ruling: The Court held this violated Article I, Section 7.
Significance:
Reinforces that digital data on personal devices is highly protected.
Inspired further rulemaking around law enforcement data access.
4. State v. Meredith, 191 Wash. 2d 300 (2018)
Issue: Use of pole cameras to record a person’s backyard activities continuously.
Ruling: The Court found such surveillance unconstitutional under Washington law.
Significance:
Signals high court’s recognition of technology-enhanced surveillance risks.
Laid groundwork for privacy protections against persistent tech-based monitoring.
5. Brooks v. Seattle, 2017 WL 4924295 (W.D. Wash.)
Issue: Challenge to Seattle’s use of automated license plate readers (ALPRs) without clear data retention or use policies.
Ruling: Case settled, but prompted major public records and transparency reforms in tech use.
Significance:
ALPR use seen as a privacy risk when not governed by transparent rules.
Demonstrates the tension between municipal tech use and citizen privacy.
6. Washington v. Meta Platforms, Inc. (Filed 2022, King County Superior Court)
Issue: Washington AG sued Meta for allegedly violating the campaign finance and privacy laws by failing to disclose ad data and targeting metrics.
Outcome: Meta was ordered to pay nearly $25 million in penalties, the largest in state history.
Significance:
Enforcement of transparency and digital ad accountability.
Shows how AG uses CPA (Consumer Protection Act) for privacy-adjacent violations.
7. Washington v. Google LLC (Filed 2022, settlement in 2023)
Issue: Google allegedly misled consumers about location tracking, even when location services were “off.”
Outcome: Google paid $39.9 million to settle with Washington State.
Significance:
Demonstrates the AG’s aggressive enforcement stance on deceptive tech practices.
Reinforced the importance of consent, notice, and consumer data control.
🔹 IV. Enforcement Trends and Legal Strategy
🚨 Enforcement Tools:
Washington Consumer Protection Act (CPA): Main tool for tech privacy enforcement.
Biometric Data Law (for agencies): Some laws apply only to public-sector use of biometrics.
New rulemaking under My Health My Data Act (2023): Applies beyond healthcare companies.
⚖️ Judicial Themes:
Washington courts emphasize:
Individual dignity and autonomy in privacy.
Technological neutrality — new tech requires new interpretations.
Higher standard of privacy than federal constitution (Article I, Section 7).
🧠 Summary Table of Key Cases
| Case | Key Issue | Outcome | Impact on Rulemaking |
|---|---|---|---|
| State v. Jackson (2003) | GPS tracking w/o warrant | Unconstitutional | Boosted rules on surveillance tech |
| State v. Athan (2007) | DNA evidence from trick mail | Allowed | Sparked debate on biometric data |
| State v. Samalia (2016) | Cell phone search at arrest | Unconstitutional | Strengthened digital data privacy |
| State v. Meredith (2018) | Pole camera surveillance | Unconstitutional | Influenced persistent surveillance rules |
| Brooks v. Seattle (2017) | ALPR and surveillance transparency | Settled | Encouraged clearer data use policies |
| WA v. Meta (2022) | Campaign ad data & transparency | Meta fined $25M | Highlighted ad tech accountability |
| WA v. Google (2022) | Deceptive location tracking | $39.9M settlement | Elevated standards on consumer data consent |
🔹 V. Conclusion
Washington State is at the forefront of tech privacy regulation, driven by:
Strong constitutional protections
Aggressive attorney general enforcement
Judicial precedents that favor digital privacy
Despite failed attempts to pass a comprehensive privacy law (like the WPA), the state continues to shape the national landscape through:
Strategic litigation
Administrative rulemaking
Targeted laws like the Facial Recognition Law and My Health My Data Act
RELATED Blog
0 comments