WA HB1671

Establishes comprehensive consumer data privacy rights for Washington residents, including the right to access, correct, delete, and obtain portable copies of personal data, as well as opt out of targeted advertising, data sales, and automated profiling decisions

Requires controllers to limit data collection to what is strictly necessary for requested products/services, obtain affirmative consent before processing sensitive data (including health, biometric, genetic, and precise geolocation data), and prohibits the sale of sensitive data

Mandates controllers conduct data protection assessments before processing that presents heightened risks to consumers, including targeted advertising, data sales, profiling, and sensitive data collection

Prohibits discriminatory data practices based on race, sex, disability, religion, and other protected characteristics, and bars controllers from using dark patterns or retaliating against consumers exercising their rights

Enforcement authority rests exclusively with the Attorney General under the Consumer Protection Act, with a 30-day right-to-cure period for violations that expires August 1, 2027; enforcement provisions take effect August 1, 2026