Washington Built the Cloud. It Still Doesn't Have a Privacy Law.

Here is a sentence that should make every Washingtonian put their cup down: the state that built the modern cloud does not have a comprehensive law protecting your personal data.

California has one. Colorado has one. Connecticut has one, and it keeps getting stronger. Washington, home to the companies that store a huge share of the world's data, still runs on a patchwork.

And this isn't just me saying it. In October, Attorney General Nick Brown told a room full of privacy professionals that it was "disappointing to me that we don't yet have a comprehensive privacy framework," and that the state is "behind where we should be," according to IAPP's coverage of his keynote.

So let's sip on this one slowly. What happened, what you're protected by right now, and what you can actually do.

How we got here

Brown was candid about it. Washington "came very close to passing comprehensive privacy legislation several years ago," he said, but "there were difficult negotiations involving major technology companies, privacy advocates, and other stakeholders. Ultimately, consensus wasn't reached" (IAPP).

Translation: the people with the most data and the people who want to protect it couldn't agree on the rules, so we got no rules. Instead, the state has passed narrower laws, one topic at a time.

What the Attorney General's report actually found

In August 2026, the AG's office released its first-ever Data Privacy Report. The legal team at Ashurst Perkins Coie published a clear summary of it, and a few findings jumped off the page for me.

The office surveyed more than 700 residents from 26 of Washington's 39 counties. Of those who responded:

• 83% said they felt they had little or no control over who accesses their information.
• 62% said opting out of targeted advertising was difficult.
• 65% said asking a company to delete their data was difficult.
• 55% said they trusted none of the listed institutions to keep their data secure, including businesses, government, healthcare and nonprofits.
• 95% said there was no circumstance where they'd be comfortable with their data being collected, shared or sold without informed consent.

One honest caveat, because I care about how we use numbers: people chose to take this survey, so it isn't a perfect sample of all Washingtonians. But 95% is not a rounding error. That's a message.

The report also named four practices that keep causing harm:

1. Overcollection and secondary use. Collecting more than a service needs, then using it for something else.
2. Weak consent and deceptive design. "Accept all" is one big button. "Reject" is buried three screens deep.
3. Selling sensitive data. Like biometrics (you can't change your face like a password) and precise location (which can reveal your doctor, your church, your kid's school).
4. Invisible data brokers. Companies you've never heard of, buying and selling your information.

What protects you right now

The patchwork isn't nothing. The same report lists the laws Washington does have, and where each one stops (Ashurst Perkins Coie):

The standout is the My Health My Data Act. It's one of the strongest health-data laws in the country, it covers data that HIPAA never touched (think period-tracking apps, fitness apps, and location data that could show you went to a clinic), and it lets individuals sue. The first class action under it was filed against Amazon in February 2025, alleging that its advertising software inside other apps collected location data without consent. Amazon denied the allegations, as Washington State Standard reported. I'll do a full breakdown of this law soon, because most people don't know they have it.

What the AG wants the legislature to do

The report made eight recommendations. The big ones: require meaningful consent and ban deceptive design, set data minimization rules, protect biometrics and precise location, and create data broker registration (IAPP).

If that list sounds familiar, it's because other states are already doing it. Connecticut banned the sale of precise geolocation data starting October 1, 2026, and is requiring data brokers to register by January 1, 2027, according to the Connecticut Attorney General. California built a single site where residents can tell 600+ data brokers to delete their data at once (California Privacy Protection Agency).

We can do this. We just have to decide we want to.

Why this hits different in my neighborhood

I serve as Vice-Chair of Seattle's Community Technology Advisory Board, and I teach digital literacy and AI classes for people who are often the last to be asked how technology should work. Here's what I see:

When privacy protections are weak, the people who pay first are the people with the least room for error. The single mom whose location data reveals her shelter. The elder who gets targeted by a scam because a broker sold a list of "seniors with home equity." The small business owner who doesn't know her free CRM is selling her customer list.

Privacy isn't a luxury feature. It's a safety feature.

What you can do this week

1. Use the rights you have. If an app handles anything health-related, look for its "Consumer Health Data Privacy Policy." Under My Health My Data, companies need one, and you can ask what they've collected and request deletion.
2. Turn off precise location for every app that doesn't truly need it. On iPhone: Settings → Privacy & Security → Location Services. On Android: Settings → Location → App permissions.
3. Check your ad settings. Reset your phone's advertising ID, or turn off ad personalization in your Google and Apple accounts.
4. Tell your legislators. Find yours at leg.wa.gov. One sentence is enough: "I want a comprehensive privacy law with real consent, data minimization and limits on data brokers."
5. If you run a business, don't wait for the law. Collect less. Delete what you don't need. Write down who has access. That's good security and good trust.

Pour me another: If Washington passed one privacy protection tomorrow, which should it be? Tell me through the contact form.

Sip slow, stay curious.D