The proposed bill introduces a new chapter to Title 19 RCW that establishes comprehensive regulations for personal data privacy in Washington state. It defines key terms such as "affirmative consent," which mandates clear authorization from consumers for data processing, and "personal data," which includes any identifiable information. The bill emphasizes consumer rights, requiring businesses to provide clear disclosures about data processing purposes and ensuring that the option to refuse consent is as prominent as the option to give it. It applies to businesses operating in Washington that collect or process consumer data, while exempting federal, state, tribal, and local government entities, as well as certain types of sensitive data.

Additionally, the bill outlines the responsibilities of data controllers and processors, mandating that they limit data collection to what is necessary and implement strong data security practices. It requires affirmative consent for the transfer of sensitive data and establishes mechanisms for consumers to revoke consent easily. The legislation also prohibits discrimination against consumers exercising their rights and mandates timely responses to consumer requests. Importantly, any contractual provisions that attempt to waive consumer rights under this chapter are deemed void and unenforceable. The enforcement of this chapter is set to begin on August 1, 2026, and includes a severability clause to maintain the effectiveness of remaining sections if any part is invalidated.