Washington My Health My Data Act (RCW 19.373)

Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.

AI-adjacent law General privacy or biometric law, included only where AI data flows trigger it; reported apart from AI-specific law.

Official text: app.leg.wa.gov.

Binding law — in force AI-adjacent law

Obtain consent before collecting biometric data from face or voice features (Washington My Health My Data Act)

RCW 19.373.030(1)(a) · official text · In force: applies since 31 Mar 2024 · Washington (US-WA)

Washington treats biometric data, including face and voice imagery from which an identifier template can be extracted, as consumer health data. Since 2024-03-31 a regulated entity (small businesses since 2024-06-30) may collect it only with the consumer's prior, opt-in consent for a specified purpose or to the extent necessary to provide a product or service the consumer requested; the consent request must disclose the categories, purpose, recipients and how to withdraw. Health inferences derived by algorithms or machine learning are consumer health data as well. Detect face or voice template extraction with no consent gate where the processing goes beyond the feature the consumer asked for.

Who it applies to

Duty falls on: organization, controller
Regulated entities and small businesses that conduct business in Washington or target Washington consumers and collect their biometric data. From 2024-03-31 (small businesses 2024-06-30). Whether a face photo processed by a vision model is 'biometric data' and which uses are 'necessary' for a requested service are questions for counsel (review flag).
Not covered:
- Individuals acting in an employment context are not 'consumers' (RCW 19.373.010(7))
- Collection to the extent necessary to provide a product or service the consumer requested needs no separate consent (19.373.030(1)(a)(ii))
Whether it applies depends on facts outside the code; a person has to decide.

The guard to add

Check a recorded, purpose-specific biometric notice and consent before any code computes, enrolls, or matches a face or voice template.

A consent gate placed immediately before the call that turns an image, video frame, or voice sample into a template or identity match (face_encodings, DeepFace.represent, rekognition.index_faces, voice embedding). The gate reads a stored consent record for this person and purpose (what is collected, why, and how long it is kept), refuses to compute the template without it, and the template is stored with a reference to that record. The notice copy shown at enrollment lives in the capture UI.

Where it goes: 1 application source code, 2 data models, 6 API calls and integrations, 14 user-facing text.

What this provision adds:

Make consent prior, opt-in and purpose-specific, and have the request disclose the categories, purpose, recipients and how to withdraw, unless the processing is necessary for a feature the consumer requested.

Example (Python face_recognition), before:

def enroll(user_id, image):
    encoding = face_recognition.face_encodings(image)[0]
    db.templates.insert(user_id=user_id, encoding=encoding)

After:

def enroll(user_id, image):
    consent = db.biometric_consents.get(user_id=user_id, purpose='face_login')
    if consent is None or consent.withdrawn_at:
        raise ConsentRequired('biometric notice and consent needed before enrollment')
    encoding = face_recognition.face_encodings(image)[0]
    db.templates.insert(user_id=user_id, encoding=encoding, consent_id=consent.id)

Control: Face or voice biometric template computed without prior notice and consent. The same guard addresses 4 items with binding law in 4 jurisdictions. Engineering guidance, not legal advice.

Rule id wa-mhmda.biometric-data-collection-consent · review status: primary source derived