AG’s first-ever Data Privacy Report identifies policy priorities and recommendations

Attorney General Nick Brown today released the first-ever Washington State Attorney General's Data Privacy Report. The report examines how the data economy incentivizes the collection and retention of personal information, the potential harms that result from these incentives - such as data breaches, surveillance, and harassment - and makes recommendations to address these harms by strengthening privacy protections, enforcement, and public education.

"Personal information has become one of the most valuable assets in the modern economy. Yet many Washingtonians report having little control over who holds their data or how it is used," Brown said. "I encourage everyone to use this report to help build a more transparent, accountable, secure, and consumer-centered approach to handling personal information across Washington."

The report identifies four recurring concerns in the modern data economy:

• Overcollection and secondary use of personal information
• Weak consent requirements and deceptive design
• The collection and sale of sensitive data
• A lack of transparency in the data-broker industry

Those practices can create significant risks for Washingtonians. In 2025, the Attorney General's Office (AGO) received reports of 209 data breaches affecting more than 8 million Washington residents. More than 80% of the reported breaches exposed Social Security numbers, increasing the risk of identity theft, financial fraud, and impersonation.

A 2025 AGO survey shows that data privacy is a key concern of Washingtonians. Based on responses from over 700 residents in 26 counties, the survey found that 83% of respondents felt they had little or no control over who could access their personal information. Ninety-five percent said there was no circumstance in which they would be comfortable having their information collected, shared, or sold without informed consent.

Based on these findings and follow-up outreach and research, the report recommends action in three areas: strengthening baseline protections for personal data, bolstering privacy enforcement and institutional capacity, and raising the baseline of digital literacy in Washington.

Following the report's publication, the AGO plans to work with consumer advocates and business associations to develop plain-language public resources to explain:

• How personal data is collected, shared, and sold
• How to secure devices, manage privacy settings, understand cookies, and recognize deceptive design practices
• How small businesses can understand their privacy obligations and reduce data security risks

A copy of the Washington State Attorney General's Data Privacy Report is available here.

-30-

Washington's Attorney General serves the people and the state of Washington. As the state's largest law firm, the Attorney General's Office provides legal representation to every state agency, board, and commission in Washington. Additionally, the Office serves the people directly by enforcing consumer protection, civil rights, and environmental protection laws. The Office also prosecutes elder abuse, Medicaid fraud, and handles sexually violent predator cases in 38 of Washington's 39 counties. Visit www.atg.wa.gov to learn more.

Media Contact:

Email: [email protected]

Phone: (360) 753-2727

General contacts: Click here

Media Resource Guide & Attorney General's Office FAQ