Washington State AI Laws:
Facial Recognition, Health Data, and Emerging Regulation
Washington leads in AI governance with pioneering facial recognition restrictions and health data privacy. Understand current requirements and prepare for emerging obligations as the state shapes its regulatory framework.
Executive Summary
Washington State has established itself as a leader in AI governance through targeted legislation addressing specific high-risk applications. SB 6280 (2020) created the nation’s first comprehensive framework for government facial recognition use, while the My Health My Data Act (2023) established broad health data protections with significant AI implications.
The AI Task Force, established in 2024 and administered by the Attorney General’s Office, is actively developing recommendations that will shape future regulation. Its preliminary reports recommend law enforcement AI disclosure requirements, and the final report (due July 2026) is expected to inform comprehensive legislation.
HB 1168, currently moving through the legislature, would require generative AI developers to publicly disclose training data information—a significant transparency requirement that could affect any organization deploying AI in Washington.
SB 6280: Facial Recognition Regulation
Enacted in March 2020 and effective July 2021, SB 6280 was the first comprehensive state law regulating government use of facial recognition technology. It establishes accountability requirements and use limitations that serve as a model for other jurisdictions.
Key Requirements for Government Agencies
Pre-Deployment Requirements
- File notice of intent to use facial recognition
- Specify intended purpose and scope
- Produce accountability report (public)
- Post report 90+ days before operational use
Law Enforcement Restrictions
- Warrant required before facial recognition use
- Emergency exception for exigent circumstances
- Meaningful human review required
- Cannot be sole basis for establishing identity
Permitted Uses
- Locating missing persons
- Identifying deceased persons
- Amber Alert investigations
- Identifying potential crime victims
Enforcement Limitations
- No explicit penalties for violations
- No private right of action
- Relies on agency compliance
- Civil liberties groups seek strengthening
Who’s Covered?
Covered Entities
- State agencies
- Local government agencies
- Vendors/contractors for above
Not Covered
- Private businesses
- Federal agencies in WA
- Personal/non-commercial use
Key Dates
- Enacted: March 2020
- Effective: July 2021
- Status: Active law
My Health My Data Act (HB 1155)
Signed April 27, 2023, the My Health My Data Act creates comprehensive protections for consumer health data outside of HIPAA. While not AI-specific, it significantly impacts AI systems that process health information, establishing consent requirements and consumer rights.
Effective Dates
Section 10
July 23, 2023
Geofencing prohibition
Sections 4-9
March 31, 2024
Large entities
Sections 4-9
June 30, 2024
Small businesses
Key Requirements
- Consent: Required for collection and sharing of consumer health data
- Privacy policy: Must disclose health data practices
- Consumer rights: Access, withdraw consent, request deletion
- Geofencing ban: Cannot use location to identify healthcare visits
AI Implications
- Training data: Consent needed for health data used in AI training
- Inference data: Health inferences from AI may be covered
- Third-party sharing: AI vendors receiving health data must comply
- Deletion rights: Consumers can request deletion from AI systems
Enforcement
Attorney General
Can bring enforcement actions for violations of the Act
Private Right of Action
Individuals can sue for violations, unlike many state privacy laws
Washington AI Task Force (ESSB 5838)
Established in 2024 by ESSB 5838, the Washington AI Task Force is administered by the Attorney General's Office and brings together industry, civil liberties, labor, academia, and government stakeholders to develop recommendations for AI governance.
Task Force Timeline
Preliminary Report
Initial findings and stakeholder input compiled
Interim Report
Detailed recommendations being developed
Final Report
Comprehensive policy recommendations expected to inform legislation
Key Preliminary Recommendations
Law Enforcement AI Disclosure
Police must publicly disclose use of AI tools including generative AI for report writing, predictive policing, license plate readers, and facial recognition.
Comprehensive Framework
Developing recommendations for a state-wide AI governance framework that balances innovation with consumer protection.
Task Force Membership (19 members)
Pending Legislation: HB 1168
Pending Legislation
HB 1168 - AI Training Data Transparency passed the House Committee (8-5) in January 2025 and has been referred to Appropriations. If enacted, it would require generative AI developers to publicly disclose training data information.
HB 1168: Generative AI Training Data Transparency
What It Requires
- Post public documentation about training data
- Disclose whether data includes personal information
- Applies retroactively to systems since Jan 1, 2022
Who’s Covered
- Generative AI developers
- Systems available to Washington users
- Trade secrets/proprietary info protected
Status: Referred to Appropriations (January 2025). No private right of action.
Operating AI in Washington State?
GLACIS helps organizations build auditable evidence of responsible AI deployment. Our continuous attestation platform creates verifiable records that satisfy current requirements and prepare you for emerging regulation.