HB 1671 — Protecting personal data privacy.
Last action — By resolution, reintroduced and retained in present status.
-
✓Introduced
-
✓In Committee
-
3Passed House
-
4Passed Senate
-
5To Executive
-
6Enacted
This bill has passed the House. Introduced January 28, 2025. It now moves to the second chamber.
Next likely step: consideration and a floor vote in the Senate.
Odds of enactment
Moderate chanceBased on the sponsor, cosponsors, and committee posture, this bill has a moderate chance of becoming law.
Upgrade to see the exact probability and what's driving it.
A statistical estimate from our own model of past outcomes — an insight, not a guarantee. Policymaking is volatile.
Prognosis
-
Passed House
Current position in the legislative process.
-
9 sponsors
1 primary, 8 co-sponsors signed on.
-
Single-party support
Sponsorship is currently within one party (9 D).
Based on stage, sponsorship breadth, committee status, recorded votes, and cross-state momentum — a description of the observable signals, not a prediction.
Bill Text
What changed in the latest version
946 added · 964 removedPlain-language change summary
The key change in the revised bill HB 1671 is the removal of the expiration date that was previously included. This change means that the provisions established in the bill, including the definitions related to consumer consent, will now remain in effect indefinitely rather than having a predetermined end date. This is significant as it provides more ongoing protection for consumer rights without the worry of the law expiring.
H-1444.1H-0779.1 SUBSTITUTE HOUSE BILL 1671 State of Washington 69th Legislature 2025 Regular Session By House Technology, Economic Development, & Veterans (originally sponsored by Representatives Kloba, Fosse, Doglio, Parshley, Berry, Ramel, Scott, Taylor, and Simmons)Simmons READRead FIRSTfirst TIMEtime 02/18/25.01/28/25.
Referred to Committee on Technology, Economic Development, & Veterans.
creatingand aproviding newan section;effective date.
providing an effective date;
and providing an expiration date.
(ii) The request includes a description of the processing purpose for which the consumer's consent is sought and (A) clearly distinguishes between an act or practice that is necessary to fulfill a request of the consumer and an act or practice that is for another purpose, (B) clearly states the specific categories of personal data p.
1 SHBHB 1671 purpose, (B) clearly states the specific categories of personal data that the controller intends to collect, process, or transfer under each act or practice, and (C) is written in easy to understand language and includes a prominent heading that would enable a reasonable consumer to identify and understand each act or practice;
(7) "Consumer" means a natural personperson: who is a Washington resident and who acts only in an individual or household context, however identified, including by any unique identifier.
The(a)(i) locationWho is a Washington resident or (ii) whose personal data is collected in Washington state, and (b) who acts only in an individual or household context, p.
2 SHBHB 1671 ofhowever aidentified, personincluding inby Washingtonany stateunique createsidentifier. a presumption that the person is a Washington resident.
(c) "Consumer health data" does not include personal data that is used to engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, human subjects research ethics review board, or a similar independent oversight entity that determines that the controller or processor has implemented p.reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification.
3p. SHB 1671 reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification.
3 HB 1671 (9)(a) "Contextual advertising" means displaying or presenting an advertisement that does not vary based on the identity of the individual recipient and is based solely on the immediate content of a web page or online service within which the advertisement appears, or on a specific request of the consumer for information or feedback, if displayed in proximity to the results of such request for information.
(11) "Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making or choice.choice and includes, but is not limited to, any practice the federal trade commission refers to as a "dark pattern." (12) "Decisions that produce legal or similarly significant effects concerning the consumer" means decisions that result in access to, or the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to essential goods or services.
(12) "Decisions that produce legal or similarly significant effects concerning the consumer" means decisions that result in access to, or the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to essential goods or services.
4 SHBHB 1671 (a) Takes reasonable physical, administrative, and technical measures to ensure that the data cannot be associated with an individual, or be used to reidentify an individual or device that identifies or is linked or reasonably linkable to an individual;
5 SHBHB 1671 (20) "Marketing measurement" means measuring and reporting on marketing performance or media performance by the controller, including processing personal data for measurement and reporting of frequency, attribution, and performance.
(26) "Processor" means a person that collects, processes, or transfers personal data on behalf of, and at the direction of, a controller or another processor.processor, or a federal, state, tribal, or local government entity.
6 SHBHB 1671 preferences, interests, reliability, behavior, location, or movements.
7 SHBHB 1671 (c) Any reproductive or sexual health information that is derived, extrapolated, or inferred, including from nonhealth information, such as proxy, derivative, inferred, emergent, or algorithmic data.
8 SHBHB 1671 online applications, or mobile applications that do not share common branding, or data generated by profiling performed on such data.
9 SHBHB 1671 to the collecting, processing, and transfer of personal data, or with respect to otherwise limiting the collecting, processing, or transfer of personal data.
(2) This chapter does not apply to any federal, state, tribal, territorial, or local government entity, such as a body, authority, board, bureau, commission, district, or agency, of this state or of any political subdivision of this state,state. or a contracted service provider when processing personal data on behalf of a government entity.
p.(i) A quality improvement committee for purposes of RCW 43.70.510, 70.230.080, or 70.41.200;
10 SHB 1671 (i) A quality improvement committee for purposes of RCW 43.70.510, 70.230.080, or 70.41.200;
(iii)p. A quality assurance committee for purposes of RCW 74.42.640 or 18.20.390;
10 HB 1671 (iii) A quality assurance committee for purposes of RCW 74.42.640 or 18.20.390;
p.(l) Personal information that is governed by and collected, processed, sold, or disclosed pursuant to the following regulations, parts, titles, or acts:
11 SHB 1671 (l) Personal information that is governed by and collected, processed, sold, or disclosed pursuant to the following regulations, parts, titles, or acts:
(ii)p. Part C of Title XI of the social security act, 42 U.S.C.
Sec.11 HB 1671 (ii) Part C of Title XI of the social security act, 42 U.S.C.
Sec.
Sec.
Sec.
or (n) Data processed or maintained:
or (iii) That is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under (n)(i) of this subsection and used for the purposes of administering such benefits;benefits.
(o) Personal data collected and processed solely for the journalistic purposes of gathering or reporting of news or information to the public by news media as defined in RCW 5.68.010, p.
12 SHB 1671 if the controller reasonably believes that the collection and processing of such data is in the public interest and that the journalistic purpose served by the collection and processing is incompatible with this chapter;
or (p) Information collected by or disclosed to the national insurance crime bureau, the national association of insurance commissioners, or a similar organization under RCW 48.135.050.
Secs.Sec.
Show all 128 changed lines (88 more)
(a)p. Confirm whether a controller is collecting or processing personal data concerning the consumer, access such personal data, and confirm whether or not the consumer's personal data is used to profile the consumer for the purpose of automated decision making;
12 HB 1671 (a) Confirm whether a controller is collecting or processing personal data concerning the consumer, access such personal data, and confirm whether or not the consumer's personal data is used to profile the consumer for the purpose of automated decision making;
p.(2)(a) If a consumer's personal data is profiled in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer, the consumer has the right to question the result of such profiling, to be informed of the reason why the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future.
13 SHB 1671 (2)(a) If a consumer's personal data is profiled in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer, the consumer has the right to question the result of such profiling, to be informed of the reason why the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future.
NEWp. SECTION.
13 HB 1671 NEW SECTION.
The p.response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.
14 SHB 1671 response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.
If requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costsp. of complying with the request or decline to act on the request.
14 HB 1671 costs of complying with the request or decline to act on the request.
(5) A controller that has obtained personal data about a consumer from a source other than the consumer is deemed in compliance with a consumer's request to delete such data pursuant to section 3(1)(d) of this act by deleting the consumer's personal data retained by the controller and retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted from the controller's records and not p.using such retained data for any other purpose pursuant to this chapter.
15 SHB 1671 using such retained data for any other purpose pursuant to this chapter.
(7)p. A controller may not condition, effectively condition, attempt to condition, or attempt to effectively condition the exercise of a consumer right described in section 3 of this act through the use of dark patterns or any false, fictitious, fraudulent, or materially misleading statement or representation.
15 HB 1671 (7) A controller may not condition, effectively condition, attempt to condition, or attempt to effectively condition the exercise of a consumer right described in section 3 of this act through the use of dark patterns or any false, fictitious, fraudulent, or materially misleading statement or representation.
and (b) Not later than December 31, 2025, allowing a consumer to opt out of any collection or processing of the consumer's personal data for the purposes of targeted advertising, or any sale of the consumer's personal data, through an opt-out preference signal that p.is sent, with the consumer's consent, by a platform, technology, or mechanism to the controller and that indicates the consumer's intent to opt out of any processing or sale.
16 SHB 1671 is sent, with the consumer's consent, by a platform, technology, or mechanism to the controller and that indicates the consumer's intent to opt out of any processing or sale.
and (ii) Enable the controller to reasonably determine that the consumer is a Washington resident or a resident of a different state whose data is collected in Washington state, and whether the consumer has made a legitimate request to opt out of any sale of such consumer's personal data or targeted advertising.
(10)p. If a consumer's decision to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of the consumer's personal data, through an opt-out preference signal sent in accordance with subsection (9) of this section conflicts with the consumer's existing controller specific privacy setting or voluntary participation in a controller's financial incentive program, the controller shall comply with the consumer's opt-out preference signal, but may notify the consumer of the conflict and provide to the consumer the choice to confirm the controller specific privacy setting or participation in the program.
(11)16 HB 1671 (10) If a controllerconsumer's respondsdecision to opt out of any processing of the consumerconsumer's personal data for the purposes of targeted advertising, or any sale of the consumer's personal data, through an opt-out requestspreference receivedsignal pursuantsent toin accordance with subsection (9) of this section byconflicts informingwith the consumerconsumer's ofexisting acontroller changespecific inprivacy thesetting price,or rate,voluntary level,participation quality,in ora selectioncontroller's offinancial goodsincentive orprogram, services, the controller shall presentcomply with the termsconsumer's ofopt-out anypreference financialsignal, incentivebut offeredmay pursuantnotify the consumer of the conflict and provide to sectionthe 6(7)consumer ofthe thischoice actto forconfirm the retention,controller use,specific sale,privacy setting or sharingparticipation ofin the consumer'sprogram. personal data.
(11) If a controller responds to the consumer opt-out requests received pursuant to subsection (9) of this section by informing the consumer of a change in the price, rate, level, quality, or selection of goods or services, the controller shall present the terms of any financial incentive offered pursuant to section 6 (7) of this act for the retention, use, sale, or sharing of the consumer's personal data.
or p.(ii) A communication, that is not an advertisement, by the controller to the consumer reasonably anticipated within the context of the relationship between the controller and the consumer.
17 SHB 1671 (ii) A communication, that is not an advertisement, by the controller to the consumer reasonably anticipated within the context of the relationship between the controller and the consumer.
(2) Except as specified in RCW 19.373.030, a controller may not transfer sensitive data concerning a consumer without obtaining the consumer'sp. affirmative consent, or, in the case of the collection or processing of sensitive data of a known child, without collecting or processing such data in accordance with the children's online privacy protection act, 15 U.S.C.
17 HB 1671 consumer's affirmative consent, or, in the case of the collection or processing of sensitive data of a known child, without collecting or processing such data in accordance with the children's online privacy protection act, 15 U.S.C.
p.(6) A controller may not process the personal data of a consumer for purposes of targeted advertising or sell the consumer's personal data under the circumstances where a controller has actual knowledge, or willfully disregards, that the consumer is a minor.
18 SHB 1671 (6) A controller may not process the personal data of a consumer for purposes of targeted advertising or sell the consumer's personal data under the circumstances where a controller has actual knowledge, or willfully disregards, that the consumer is a minor.
(c)(i)p. Nothing in this subsection may be construed to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer's voluntary participation in a financial incentive program, such as a bona fide loyalty, rewards, premium features, discounts, or club card program, provided that the controller may not transfer personal data to a third party as part of such a program unless:
18 HB 1671 (c)(i) Nothing in this subsection may be construed to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer's voluntary participation in a financial incentive program, such as a bona fide loyalty, rewards, premium features, discounts, or club card program, provided that the controller may not transfer personal data to a third party as part of such a program unless:
p.(b) This subsection does not apply to:
19 SHB 1671 (b) This subsection does not apply to:
(i) The categories of personal data collected and processed by the controller, including a separate list of categories of sensitive data collected and processed by the controller, described in a level ofp. detail that provides consumers a meaningful understanding of the type of personal data collected or processed;
19 HB 1671 of detail that provides consumers a meaningful understanding of the type of personal data collected or processed;
A controller should provide a reasonable opportunity for each consumer to p.affirmatively consent to further materially different processing or transfer of previously collected personal data under the changed policy.
20 SHB 1671 affirmatively consent to further materially different processing or transfer of previously collected personal data under the changed policy.
NEWp. SECTION.
20 HB 1671 NEW SECTION.
The processor shall adhere to the instructions of the controller and only process and transfer data it receives from the controller to the extent necessary to provide a p.service requested by the controller, as set out in the contract.
21 SHB 1671 service requested by the controller, as set out in the contract.
(e)p. Be prohibited from combining personal data that the processor receives from or on behalf of a controller with personal data that the processor receives from or on behalf of another person or collects from the interaction of the processor with an individual;
21 HB 1671 (e) Be prohibited from combining personal data that the processor receives from or on behalf of a controller with personal data that the processor receives from or on behalf of another person or collects from the interaction of the processor with an individual;
(5) Determining whether a person is acting as a controller or processor with respect to a specific processing of personal data is a fact-based determination that depends on the context in which p.personal data is to be processed.
22 SHB 1671 personal data is to be processed.
(1) A controller may not conduct processing that presents a heightened risk ofp. harm to a consumer without conducting and documenting a data protection assessment for each of the controller's processing activities that presents the heightened risk of harm to a consumer.
22 HB 1671 of harm to a consumer without conducting and documenting a data protection assessment for each of the controller's processing activities that presents the heightened risk of harm to a consumer.
Data protection assessments must also identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the p.rights of the consumer associated with such processing, as mitigated by safeguards that are employed by the controller to reduce such risks.
23 SHB 1671 rights of the consumer associated with such processing, as mitigated by safeguards that are employed by the controller to reduce such risks.
(b) The attorney general may require that a controller disclose any data protection assessment that is relevant to an investigation conductedp. by the attorney general, and the controller shall make the data protection assessment available to the attorney general upon request.
23 HB 1671 conducted by the attorney general, and the controller shall make the data protection assessment available to the attorney general upon request.
p.(a) Monitor for harm caused by the processing and adjust safeguards accordingly;
24 SHB 1671 (a) Monitor for harm caused by the processing and adjust safeguards accordingly;
and (c)p. Contractually obligate any recipients of the deidentified data to comply with all provisions of this chapter.
24 HB 1671 (c) Contractually obligate any recipients of the deidentified data to comply with all provisions of this chapter.
p.NEW SECTION.
25 SHB 1671 NEW SECTION.
(e)p. Provide a product or service specifically requested by the consumer;
25 HB 1671 (e) Provide a product or service specifically requested by the consumer;
p.(ii) The expected benefits of the research outweigh the privacy risks;
26 SHB 1671 (ii) The expected benefits of the research outweigh the privacy risks;
(m)p. Ensure the data security and integrity of personal data as required by this chapter, protect against spam, or protect and maintain networks and systems, including through diagnostics, debugging, and repairs;
26 HB 1671 (m) Ensure the data security and integrity of personal data as required by this chapter, protect against spam, or protect and maintain networks and systems, including through diagnostics, debugging, and repairs;
or p.(iii) Perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the controller, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party.
27 SHB 1671 (iii) Perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the controller, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party.
(3) A controller or processor that discloses personal data in compliance with this chapter to a third-party controller or processor isp. not in violation of this chapter if the recipient processes such personal data in violation of this chapter, provided that, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient would violate this chapter.
27 HB 1671 is not in violation of this chapter if the recipient processes such personal data in violation of this chapter, provided that, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient would violate this chapter.
p.(5)(a) Personal data collected or processed by a controller pursuant to this section may be collected or processed to the extent that the collection or processing is:
28 SHB 1671 (5)(a) Personal data collected or processed by a controller pursuant to this section may be collected or processed to the extent that the collection or processing is:
Such data must be subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personalp. data, and to reduce reasonably foreseeable risks of harm to consumers relating to such processing of personal data.
28 HB 1671 personal data, and to reduce reasonably foreseeable risks of harm to consumers relating to such processing of personal data.
p.
29 SHB 1671 NEW SECTION.
Sec.
13.
RIGHT TO CURE.
(1) Before bringing an action under section 12 of this act, the attorney general shall notify a controller or processor of the alleged violation if the attorney general determines that a cure is possible.
If the controller or processor fails to cure the violation within 30 days after receiving notice of the violation, the attorney general may bring a civil action without further notice.
(2) This section expires August 1, 2027.
14.13.
The rights and obligations createdcovered by this chapter may only be enforced pursuant to sectionssection 12 and 13 of this act.
15.14.
16.15.
A regulated entity, small business, or processor subject to the requirements of this chapter may also be subject to data privacy requirementsp. provided in chapter 19.--- RCW (the new chapter created in section 18 of this act).
29 HB 1671 requirements provided in chapter 19.--- RCW (the new chapter created in section 17 of this act).
17.16.
18.17.
Sections 1 through 12 and 14 and 15 of this act constitute a new chapter in Title 19 RCW.
19.18.
SectionsSection 12 and 13 of this act taketakes effect August 1, 2026.
30 SHBHB 1671
Show all 128 changed rows (88 more)
View plain text versions (2)
- Bill View text Current pdf
- Substitute Substitute Bill pdf
Action History
-
By resolution, reintroduced and retained in present status.
-
Referred to Appropriations.
-
Minority; do not pass.
-
TEDV - Majority; 1st substitute bill be substituted, do pass.
-
Executive action taken in the House Committee on Technology, Economic Development, & Veterans at 10:30 AM.
-
Public hearing in the House Committee on Technology, Economic Development, & Veterans at 10:30 AM.
-
First reading, referred to Technology, Economic Development, & Veterans.
Sponsors
- Tarra Simmons · Cosponsor
- Jamila Taylor · Cosponsor
- Shaun Scott · Cosponsor
- Alex Ramel · Cosponsor
- Liz Berry · Cosponsor
- Lisa Parshley · Cosponsor
- Beth Doglio · Cosponsor
- Mary Fosse · Cosponsor
- Shelley Kloba · Primary
Sponsorship breakdown
Export CSV (upgrade) →1 sponsors · 8 co-sponsors · 142 not signed on
Sponsors (1)
- Shelley Kloba Democrat
Co-sponsors (8)
- Tarra Simmons Democrat
- Jamila Taylor Democrat
- Shaun Scott Democrat
- Alex Ramel Democrat
- Liz Berry Democrat
- Lisa Parshley Democrat
- Beth Doglio Democrat
- Mary Fosse Democrat
Not signed on (142)
142 members have not signed on to this bill.
Show all 142 →"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.
Subjects
Frequently asked questions
- Who sponsors HB 1671?
- HB 1671 is sponsored by Tarra Simmons (Democrat), Jamila Taylor (Democrat), Shaun Scott (Democrat), Alex Ramel (Democrat), Liz Berry (Democrat), Lisa Parshley (Democrat), Beth Doglio (Democrat), Mary Fosse (Democrat), and Shelley Kloba (Democrat).
- What is the current status of HB 1671?
- This bill has passed the House. Introduced January 28, 2025. It now moves to the second chamber.
- Where can I track HB 1671?
- Track HB 1671 free on One Click Politics — get push/email alerts when it moves.
Make your voice heard on HB 1671
Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.
Stay ahead of HB 1671
Last checked for changes 3 months ago · updated continuously
One Click Politics tracks every bill in Congress and all 50 states.
Track this bill →