Washington's attorney general reflects on state's privacy legislation and enforcement

Washington Attorney General Nick Brown said the state is "behind where we should be" on comprehensive privacy legislation despite Washington's leadership in technology and innovation.

Speaking with Hintze Law Partner Mike Hintze, CIPP/C, CIPP/E, CIPP/G, CIPP/US, CIPM, CIPT, FIP, on the IAPP Privacy. Security. Risk. + AI Governance Global 2026 keynote stage, Brown noted privacy protections have largely been enacted through sector-specific laws rather than a broad, comprehensive privacy statute, while referencing the state legislature's previous efforts to pass a comprehensive bill.

"It's disappointing to me that we don't yet have a comprehensive privacy framework," Brown said, but he remains optimistic. 

In August, the attorney general released a report outlining the office's priorities and potential future direction. Among them is a call for legislative action, including, as Hintze outlined, stronger consumer consent requirements, protections for biometric and precise geolocation data, as well as data broker registration requirements.

"For those who follow state politics, you'll know that Washington came very close to passing comprehensive privacy legislation several years ago," Brown said. "There were difficult negotiations involving major technology companies, privacy advocates, and other stakeholders. Ultimately, consensus wasn't reached."

Brown said he hopes those conversations continue, but in the meantime, "we're advancing privacy protections in specific areas where we can make progress."

"A key part of Washington's culture and legal tradition is a strong commitment to individual privacy," he added. "That's reflected in our Consumer Protection Act, which remains one of our primary enforcement tools."

With several major technology companies housed in Washington, Brown said the state is home to a "tremendous amount of innovation" and that it is constantly balancing innovation and privacy. "Our approach emphasizes accountability and enforcement while recognizing the realities of modern technology and data use."

On whether the attorney general has sufficient enforcement resources, Brown indicated his office employs roughly 850 attorneys and staff, "making us one of the largest public law offices on the West Coast. Of course, we'd always welcome additional resources, investigators and subject matter experts." But he said the office of the attorney general is handing a wide variety of responsibilities beyond privacy. 

Brown also pointed out his office does not possess broad criminal jurisdiction, unlike several other state attorneys general. "We can pursue criminal matters under specific circumstances, but our authority differs from states where the attorney general directly manages statewide prosecutions," he said.

My Health My Data Act

One of the notable targeted privacy laws on the books in Washington, the My Health My Data Act, made waves nationally upon enactment in 2023. The law carries broad definitions for consumer, covered data and health care services while applying a range of consent obligations tied to data collection, sharing and sale, respectively.

Notably, the MHMDA also contains a private right of action for any violation of the law, which left impacted businesses wary of a potential flood of litigation. However, the worries have been unwarranted given the lack of lawsuits brought in the years since passage.

Hintze questioned why there has not been much public MHMDA enforcement activity to this point either.

Brown said, "We've been thoughtful about enforcement because the law is still relatively new," also highlighting the importance of educating organizations to help them understand their obligations for complying with the law.

"Our role isn't simply to file lawsuits," he said. "Our goal is to help Washington residents. Sometimes that requires litigation, but whenever possible, we want to resolve problems without going to court."

However, Brown said enforcement is not out of the question. "As awareness grows and the law matures, we may see more cases. But if compliance can be achieved without lengthy and costly litigation, that's often a better outcome for everyone involved."