Washington
My Health My Data Act (2023) and RCW 19.375 (HB 1493, 2017)
Washington has two layers. HB 1493 (2017) was an early biometric statute: notice and consent before enrolling a biometric identifier in a database for commercial use. The bigger story is the My Health My Data Act, which defines "consumer health data" so broadly that biometric data, including face geometry that can identify a person, falls inside it. MHMDA demands separate opt-in consent before collection, a standalone right to delete, and, unusually, a private right of action under the state Consumer Protection Act.
Key Provisions
- HB 1493: no enrolling a biometric identifier in a commercial database without notice and consent
- MHMDA: biometric data treated as consumer health data requiring separate opt-in consent
- MHMDA grants an absolute right to delete, with no GDPR-style exceptions
- Selling covered data requires a signed, specific authorization from the consumer
- Private right of action through the Washington Consumer Protection Act
Penalties & Enforcement Record
MHMDA violations are per-se violations of the Consumer Protection Act: AG enforcement plus private suits with actual damages, treble damages up to $25,000, and attorney fees. HB 1493 is AG-enforced under the CPA as well.
What this means for your face
For Washington residents, the MHMDA delete right is one of the cleanest legal hooks in the country: biometric data must be deleted on request, full stop. Our removal requests for Washingtonians lead with it.
Get Protected