Primary Research · State Profile · WA
Washington State's AI regulatory posture in 2026 is shaped less by a single comprehensive law and more by the My Health My Data Act (the country's strongest state health privacy law), the Washington Privacy Act overlays under consideration, and aggressive enforcement of existing consumer protection authority against AI-driven harms. Washington Attorney General Bob Ferguson has been notably active on AI-related consumer protection matters, and the Washington Legislature has introduced multiple AI bills in recent sessions covering algorithmic accountability, generative AI deepfake intimate imagery, and AI in employment. The 2024 My Health My Data Act (effective March 2024) extends well beyond HIPAA's scope and covers most AI deployments processing health-related data of Washington consumers.
Washington's regulatory posture in 2026 emphasizes consumer privacy as the operational lever for AI accountability. My Health My Data Act applies to a broad category of 'consumer health data' — including data inferred from non-medical sources that could be used to predict health status — which captures the majority of consumer-facing AI applications doing health-related inference. The Act includes a private right of action with statutory damages, making Washington one of the highest-exposure jurisdictions for AI vendors processing any health-adjacent data of Washington consumers. The state has also been an early adopter of legislation criminalizing AI-generated deepfake intimate imagery and is actively considering legislation modeled on Colorado's deployer-developer framework, though no comprehensive Washington AI Act has yet been enacted.
Key provisions
Consent required for collection, sharing, or sale of consumer health data; broad definition of 'consumer health data' including inferences; private right of action with statutory damages; geofencing restrictions around healthcare facilities; AG enforcement.
Key provisions
Criminal liability for disclosing AI-generated intimate images of an identifiable person without consent; civil cause of action; addresses deepfake content.
Would establish a developer-deployer framework similar to Colorado for high-risk AI systems. Multiple iterations have been introduced; advocacy groups continue pushing for enactment.
Sector-specific frameworks layer on top of state AI laws and frequently impose stricter or earlier-binding obligations. These are the sectors most exposed in Washington.
Healthcare and consumer health
My Health My Data is the binding constraint and reaches far beyond HIPAA — AI inferring health status from non-medical data triggers the Act.
Consumer technology
Apps and wearables doing health-related inference need My Health My Data consent and disclosure flows.
Platforms
AI-generated deepfake content of Washington residents creates criminal and civil exposure under SB 5152.
Employment
Washington Equal Pay Opportunity Act and Fair Chance Act overlay employment AI use; AG has signaled enforcement interest.
Practical operational checklist for organizations subject to Washington AI laws. Items are ordered by typical sequence of implementation, not by importance — most steps depend on the inventory work in the first item.
Includes inferences. AI predicting menstrual cycles, mental health, fitness conditions from non-medical inputs is in scope.
Required by the Act; consent must be specific, not bundled.
Required as part of the Act's reasonable security requirements.
Washington is one of the highest plaintiff-side jurisdictions for AI-adjacent health data claims.
My Health My Data restricts location data collection within 2,000 feet of in-person healthcare facilities.
SB 5152 creates both criminal and civil exposure for AI-generated intimate imagery.
Multiple iterations; structure may follow Colorado.
EFROS operates Washington AI compliance with My Health My Data as the binding constraint for any consumer-health-adjacent AI deployment — consent UX, data minimization workflows, geofencing controls, and private-right-of-action exposure assessments. We also monitor Washington Algorithmic Accountability Act drafts for clients with Colorado-scale exposure.
Disclaimer: this profile is a research dataset, not legal advice. Compliance determinations for Washington businesses require analysis of specific facts and should be made in consultation with qualified legal counsel licensed in Washington.
Reference this resource with attribution under CC-BY-4.0. Copy any of the formats below for academic papers, blog posts, AI citations, or vendor evidence packages.
Efros, S. (2026, May). Washington AI Law Tracker — 2026. EFROS. https://efros.com/research/state-ai-law-tracker/washington/
Efros, Stefan. "Washington AI Law Tracker — 2026." EFROS, May 2026, https://efros.com/research/state-ai-law-tracker/washington/.
Efros, Stefan. 2026. "Washington AI Law Tracker — 2026." EFROS. https://efros.com/research/state-ai-law-tracker/washington/.
S. Efros, "Washington AI Law Tracker — 2026," EFROS, May 2026. [Online]. Available: https://efros.com/research/state-ai-law-tracker/washington/
@misc{efros2026washingtonailawt,
author = {Stefan Efros},
title = {Washington AI Law Tracker — 2026},
year = {2026},
month = {May},
publisher = {EFROS},
url = {https://efros.com/research/state-ai-law-tracker/washington/},
note = {Accessed: May 2026}
}https://efros.com/research/state-ai-law-tracker/washington/
Site-wide citation metadata is also published as a CITATION.cff file at /CITATION.cff for citation-management tools and academic indexers.
All tracked US state AI laws in a single citation-ready dataset.
Open20 AI vendors scored on 12 US AI governance axes — including state-law overlays.
OpenFederal framework that anchors most state AI law deployer obligations.
OpenOperating program that implements multi-state AI law compliance.
Open5-minute classification across Colorado AI Act, NYC LL144, CA AB 2013, and NIST AI RMF.
Open