Cybersecurity Policy Report, Washington AG Outlines Data Privacy Gaps, (Aug 18, 2026)
By Tony Foley
Washington state Attorney General Nick Brown (D.) has released his office’s first-ever Data Privacy Report, focusing on concerns raised in the modern data economy and discussing potential policies to strengthen protections and improve enforcement.
The report examines how the data economy incentivizes the collection and retention of personal information and the potential harms, including data breaches, surveillance, and harassment, that may result from these incentives, AG Brown said Friday in a news release.
In addition, it makes recommendations to address these concerns and strengthen protections, enforcement, and public education.
“Personal information has become one of the most valuable assets in the modern economy. Yet many Washingtonians report having little control over who holds their data or how it is used,” AG Brown said. “I encourage everyone to use this report to help build a more transparent, accountable, secure, and consumer-centered approach to handling personal information across Washington.”
The report, which may be downloaded from the news release, identifies the following four concerns:
Overcollection and secondary use of personal information;
Weak consent requirements and deceptive design;
The collection and sale of sensitive data; and
A lack of transparency in the data broker industry.
The AG’s office received reports of 209 data breaches in 2025 affecting more than 8 million Washington residents, and a survey conducted by the office last year indicated data privacy is a key concern, with 83% of respondents feeling that they had little or no control over who could access their personal information, and 95% adding that there were no circumstances under which they would be comfortable having their personal information collected, shared, or sold without informed consent.
Based on these findings, the report recommends action in three areas: strengthening baseline protections for personal data, bolstering privacy enforcement and institutional capacity, and raising the baseline of digital literacy. With respect to the latter recommendation, the AG’s office plans to work with consumer advocates and business associations to develop plain-language public resources explaining how personal data is collected, shared, and sold; how to secure devices, manage privacy settings, understand cookies, and recognize deceptive design practices; and how small businesses can understand their privacy obligations and reduce security risks.
News: StateLegislation DataPrivacy DataSecurity