Washington Biometric Privacy Law: Consent, Retention, and Penalties

Washington’s biometric privacy law is actually three laws working together: the Biometric Identifiers Act (RCW 19.375) covers commercial use of fingerprints, voiceprints, and similar markers; the My Health My Data Act (RCW 19.373) adds stricter protections when the data relates to health; and RCW 43.386 governs how state and local government agencies use facial recognition. Each sets its own rules on notice, consent, retention, and who can sue when something goes wrong.

What Washington Treats as Biometric Data

A biometric identifier under RCW 19.375 is data produced by automatically measuring a person’s biological characteristics and used to identify that specific person. The statute names fingerprints, voiceprints, eye retinas, irises, and “other unique biological patterns or characteristics.”¹

Several things sit outside the definition. Ordinary photographs and video are not biometric identifiers unless they are stored or used for facial recognition. Handwritten signatures, demographic details like a name or date of birth, and biological samples used for legitimate scientific testing or medical treatment are also excluded. Data governed by HIPAA for treatment, payment, or health care operations is excluded regardless of format.¹

What a Business Must Do Before Collecting Your Biometric Data

Before enrolling your biometric identifier in a database for a commercial purpose, a business must give notice and obtain consent. The statute leaves the form flexible, calling adequate disclosure “context-dependent,” and requires that the business give you a way to prevent future commercial use.¹

Selling, leasing, or sharing a biometric identifier with another entity is allowed only in four situations: you consent; the disclosure completes a financial transaction you asked for; a law or legal process requires it; or a contracted third party needs the data to deliver a service tied to the original collection purpose. In that last case, the third party is contractually barred from passing the data along further.²

While a company holds the data, it must protect it from unauthorized access with safeguards at least as strong as those it applies to other confidential information.¹

When the Rules Don’t Apply

The Biometric Identifiers Act is narrower than it looks because “commercial purpose” is narrow. The term covers only the sale or disclosure of biometric data to a third party for marketing goods or services unrelated to the transaction where the data was collected. Activities carried out for security or law enforcement are explicitly excluded.¹

A separate security carve-out removes notice and consent obligations entirely when biometric data is collected to prevent shoplifting, fraud, or theft, or to protect the security of software, accounts, online services, or any person.¹ A retailer scanning faces to flag suspected shoplifters, for example, is not required to tell customers under this statute.

Three categories are also exempt from the Act altogether. Government agencies fall outside the statute’s definition of “person,” so its rules do not reach them. Financial institutions subject to Title V of the federal Gramm-Leach-Bliley Act are fully exempt, as are activities subject to HIPAA.³ The Act also preserves existing law enforcement authority to conduct searches and seizures.¹

Workplace use sits inside these exemptions. Fingerprint timekeeping and badge-less access systems are internal uses, not sales to third parties for unrelated marketing, and the security carve-out reaches collection meant to protect accounts, applications, or people.¹ If an employer later repurposes employee biometric data in a way that does meet the commercial purpose definition, the full requirements kick in. Retention and deletion rules apply either way, discussed next.

How Long Companies Can Keep It and How to Get It Deleted

Businesses cannot hold biometric identifiers indefinitely. A company must dispose of the data when the original purpose for collecting it has been fulfilled, or within three years of your last interaction with the business, whichever comes first.² For employers, that generally means purging biometric records after someone leaves.

You can also request deletion at any time. Once the business receives your request, it has 30 days to permanently remove the data. The only exception is when a federal or state law requires the business to keep the record.²

Stricter Rules for Health-Related Biometric Data

The My Health My Data Act (MHMDA), codified at RCW 19.373, covers a much broader category of information and sits alongside the Biometric Identifiers Act rather than replacing it. It protects “consumer health data,” meaning any personal information linked to a consumer that reveals past, present, or future physical or mental health status. The definition explicitly includes biometric data, genetic data, reproductive and sexual health information, gender-affirming care data, and precise location information that could suggest someone is seeking health services.⁴

A regulated entity cannot collect any consumer health data without first obtaining affirmative, voluntary consent for a specified purpose. The request must disclose the categories of data being collected, the specific purpose, and how you can later withdraw consent.⁵

Sharing the data with third parties requires a second, separate consent. Agreeing to collection does not authorize sharing. The sharing consent must independently disclose the categories of entities that will receive the data, the purpose, and how to withdraw.⁵

Deletion rights under the MHMDA reach further than those under the biometric statute. After a valid deletion request, the entity has 45 days to permanently and completely delete the data, with a possible 45-day extension if it notifies the consumer within the initial window and explains the delay. The obligation also cascades: the company must notify every third party it shared the data with, and those third parties must delete it too.⁶

The MHMDA also bans geofencing within 1,750 feet of any entity providing in-person health care services in Washington, when the geofence is used to identify or track consumers, collect their data, or send them notifications or alerts.⁷

MHMDA exemptions work by information type rather than by entity. Protected health information already governed by HIPAA, data covered by Washington’s state health care records law (RCW 70.02), patient-identifying information under federal substance abuse treatment regulations, and data used in human subjects research under applicable federal protections sit outside the MHMDA.⁴ A hospital handling HIPAA records is not subject to the MHMDA for those records, but a consumer health app collecting similar data outside the HIPAA framework likely is.

Facial Recognition by Government Agencies

Government use of facial recognition is governed separately under RCW 43.386. A “facial recognition service” is technology that analyzes facial features to identify, verify, or persistently track individuals in images or video.⁸

Before deploying one, an agency must produce an accountability report, hold at least three community consultation meetings, run a public comment period, and post the final report on its website at least 90 days before putting the system into operational use. The report must be updated every two years.⁸

An agency cannot use facial recognition for ongoing surveillance, real-time identification, or persistent tracking unless it has a warrant, faces exigent circumstances, or has a court order specifically for locating a missing person or identifying a deceased person. Law enforcement may never use facial recognition results as the sole basis for probable cause in a criminal investigation. Any decision that creates legal or similarly significant effects on a person must be subject to meaningful human review.⁸

What Happens When Companies Break These Rules

Enforcement depends on which law was broken.

Under the Biometric Identifiers Act, only the Attorney General can bring an action. A violation is treated as an unfair or deceptive act under Washington’s Consumer Protection Act (RCW 19.86), and the Attorney General can seek civil penalties of up to $7,500 per violation.⁹¹⁰ Individuals cannot sue on their own.

The MHMDA is different. Violations are per se violations of the Consumer Protection Act, and both the Attorney General and private individuals can bring actions.¹¹ A consumer suing under the CPA can recover actual damages, costs, and reasonable attorney fees, and a court has discretion to award up to three times actual damages, capped at $25,000 for CPA claims.¹² If you believe a company has mishandled your biometric data, which of these two paths is open to you depends almost entirely on whether the data counts as consumer health data under the MHMDA.

1
Washington State Legislature. Washington Code 19.375 – Biometric Identifiers
2
Washington State Legislature. Washington Code 19.375.020 – Enrollment, Disclosure, and Retention of Biometric Identifiers
3
Washington State Legislature. Washington Code 19.375.040 – Exemptions
4
Washington State Legislature. Washington Code 19.373 – Washington My Health My Data Act
5
Washington State Legislature. Washington Code 19.373.030 – Collection and Sharing of Consumer Health Data
6
Washington State Legislature. Washington Code 19.373.040 – Consumer Rights, Deletion of Health Data
7
Washington State Legislature. Washington Code 19.373.080 – Geofencing
8
Washington State Legislature. Washington Code 43.386 – Facial Recognition
9
Washington State Legislature. Washington Code 19.375.030 – Application of Consumer Protection Act
10
Washington State Legislature. Washington Code 19.86.140 – Civil Penalties
11
Washington State Office of the Attorney General. Protecting Washingtonians’ Personal Health Data and Privacy
12
Washington State Legislature. Washington Code 19.86.090 – Civil Action for Damages