Washington biometric law at work: what RCW 19.375 covers, and why its commercial purpose test matters for employers

Washington regulates biometric identifiers through chapter 19.375 of the Revised Code of Washington, passed in 2017 (RCW 19.375). It is often grouped with Illinois's BIPA and the Texas biometric law, but its main duties are tied to a narrowly defined "commercial purpose", and it has a broad exception for security uses. This page explains what the text says and what that means for employers and workers.

The short answer: a person, which includes a business, may not enroll a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent later commercial use (RCW 19.375.020(1)). "Commercial purpose" means selling or disclosing the identifier to a third party to market goods or services unrelated to the original transaction, and it excludes security and law enforcement purposes (RCW 19.375.010(4)). Only the Attorney General can enforce the chapter, under the Consumer Protection Act (RCW 19.375.030(2)).

What is covered

• Biometric identifier: "data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual." It does not include a physical or digital photograph, a video or audio recording, or data generated from them, or health care information covered by HIPAA (RCW 19.375.010(1)).
• Enroll: to capture an identifier, convert it into a reference template that cannot be reconstructed into the original image, and store it in a database that matches it to a specific individual (RCW 19.375.010(5)).
• Commercial purpose: a purpose in furtherance of the sale or disclosure of the identifier to a third party for marketing goods or services unrelated to the transaction in which it was first obtained. It does not include a security or law enforcement purpose (RCW 19.375.010(4)).
• Security purpose: preventing shoplifting, fraud or other theft, and protecting the security or integrity of software, accounts, applications, online services or any person (RCW 19.375.010(8)).
• Who is bound: a "person" covers individuals, companies and other organizations, but not government agencies (RCW 19.375.010(7)). Financial institutions subject to the Gramm-Leach-Bliley Act are excluded (RCW 19.375.040).

The duties

• Notice, consent or an opt-out before enrolling for a commercial purpose: notice must be given through a procedure reasonably designed to be readily available to affected individuals, and notice alone is not affirmative consent. The exact notice and type of consent required is "context-dependent" (RCW 19.375.020(1)-(2)).
• Limits on sale and disclosure: without consent, an enrolled identifier may not be sold, leased or disclosed to another person for a commercial purpose except in listed cases, such as providing a service the individual requested, completing a financial transaction, a statute or court order, litigation, or a third party that contractually promises not to disclose it further (RCW 19.375.020(3)).
• Care and retention: anyone who knowingly holds an identifier enrolled for a commercial purpose must take reasonable care against unauthorized access, and may keep it no longer than reasonably necessary to meet legal retention duties, prevent fraud, crime or liability, and provide the service it was enrolled for (RCW 19.375.020(4)).
• No change of use without new consent: an identifier enrolled or obtained for a commercial purpose may not be used or disclosed in a way materially inconsistent with the original terms without consent to the new terms (RCW 19.375.020(5)).
• The security exception: nothing in the section requires notice and consent to collect, capture or enroll an identifier "in furtherance of a security purpose" (RCW 19.375.020(7)).

What it means at work

The chapter does not mention employers or employees. Read on its own terms, a fingerprint time clock or a face scan at the door, used only to identify staff and not sold or passed on for marketing, may not meet the statutory definition of a commercial purpose, and access control or fraud prevention can fall under the security purpose. That is our reading of the definitions, not a court ruling, and employers should take advice on their own setup. The duties are more likely to matter where a vendor or the employer shares workers' biometric data with third parties, or reuses it beyond what workers were told.

Photographs and video are outside the definition of a biometric identifier, but data generated from automatic measurements of a face that is used to identify someone is a separate question the text does not spell out, so treat face matching with care.

Enforcement

The legislature declared that a violation is an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, and that the chapter "may be enforced solely by the attorney general" (RCW 19.375.030). Unlike Illinois's BIPA, it gives workers no private right to sue under this chapter.

What to do

• Employers: list every biometric clock, reader and app, check in the vendor contract whether templates are shared with or used by third parties, keep a written notice and consent anyway, and set a retention limit. If you also have staff in Illinois or Texas, their stricter rules apply there.
• Workers: ask what is captured, who receives it and how long it is kept. Complaints go to the Washington Attorney General.

Compare Illinois BIPA at work, the Texas biometric law at work and Colorado biometric data at work, which has rules written for employers, Washington's ban on demanding social media logins (the Washington social media password law), and for workplace surveillance more widely, US employee monitoring laws. For all four state biometric laws side by side, see biometric privacy laws at work compared.

This page covers Washington and is general information based on the statute text published by the Washington State Legislature when checked on 3 November 2026, not legal advice.