Washington AG: 8M Residents Hit by Data Breaches in 2025

Washington has about 8 million residents. In 2025, breaches reported to the Attorney General's Office affected more than 8 million of them. Not the same 8 million, since people appear in several breaches and some records belong to former residents, but the ratio is the finding. More than 80% of those breaches exposed Social Security numbers, the one identifier nobody can rotate or cancel.

Key Takeaways

• Washington Attorney General Nick Brown released the state's first ever Data Privacy Report on August 14, 2026.
• The Attorney General's Office received reports of 209 data breaches in 2025 affecting more than 8 million Washingtonians, and more than 80% of those breaches exposed Social Security numbers.
• A 2025 survey of more than 700 residents across 26 counties found 83% had little or no control over who could access their information, and 95% would never provide it without informed consent.
• The report names four recurring problems: overcollection and secondary use, weak consent and deceptive design, collection and sale of sensitive data, and limited visibility into data broker practices.
• Washington has no generally applicable consumer privacy law, and the report asks the Legislature for one, including annual data broker registration and a centralized deletion request system.

What Did the Washington AG Actually Find?

The report finds Washington's privacy protections are real but patchy, and that the gaps between them are where most personal information now lives. The Attorney General's announcement frames it as a study of how the data economy rewards collecting and keeping information.

The survey numbers are the part legislators will quote. Past the headline 83% and 95%, another pair matters more: 62% said opting out of targeted advertising was difficult or very difficult, and 65% said the same about asking an app to delete their data. That is a rights regime that exists on paper and fails in practice, a different complaint from wanting more rights.

Brown's framing is blunt: "Personal information has become one of the most valuable assets in the modern economy. Yet many Washingtonians report having little control over who holds their data or how it is used." The full report traces breaches, scams, stalking, and housing discrimination back to the same collection habit.

Why Does "Weak Consent and Deceptive Design" Matter?

Because a checkbox everyone clicks without reading produces the legal cover of permission without any of the substance. The report is unusually direct about it: consent is not informed simply because a person clicked a button or agreed to a lengthy privacy policy.

Its examples are the ones you meet daily. "Accept all" rendered large and obvious while the reject option sits three clicks deep. Consent for unrelated purposes bundled into one switch. A choice much harder to reverse than to accept. The conclusion is the policy position: even where a protective option exists, deceptive design pushes people past what they intended, so the existence of a choice is not a defense.

That reasoning already drove enforcement over surveillance pricing, where your data shapes the price you see rather than the ads. We covered the state level fight in Maryland and Connecticut's surveillance pricing bans, and the report leans on the FTC's surveillance pricing study for proof it happens at all.

What Does the Report Want Done About Data Brokers?

It wants brokers to register annually with the state, disclose what they collect and sell, secure it, stop selling sensitive categories, honor deletion and opt out requests, and answer those requests through one centralized system rather than one company at a time.

The gap is specific. Washington requires no broker registration today, and no central place exists for a resident to learn which brokers hold their file. HB 2483 would have created that registry in the 2025 to 2026 session and did not become law. The report cites it in a footnote, a polite way of noting the Legislature already had its chance.

The models it names are ones we have tracked all year. New Jersey's law took effect this summer with penalties reaching $1.5 million, covered in our breakdown of A5328. California's Delete Request and Opt-Out Platform is the working version of what Washington now wants, and its teeth appear in California's DROP deadline and its $200 a day penalties. Vermont, Oregon, and Texas fill out the list.

Most coverage led with the 8 million figure. The more consequential line is the admission that Washington has no generally applicable privacy framework at all, only targeted laws for health data, student records, biometrics, breach notification, and license plate readers. Everything else falls to the Consumer Protection Act, which was never built for it.

Registration also only binds companies that consider themselves brokers. Face search services rarely do, which is how a reverse lookup tool ended up leaving 9 million face photos in an unsecured bucket with no registry entry to hold it accountable.

How Does This Fit the 2026 State Privacy Wave?

Washington is arriving late to a movement it helped start. With no comprehensive federal law and federal coverage still sectoral through HIPAA, FERPA, and COPPA, California, Colorado, Oregon, and Connecticut built their own. Washington passed the My Health My Data Act in 2023, one of the country's most aggressive health privacy laws, with a geofencing ban around care facilities and a private right of action. Then it stopped. A comprehensive Washington Privacy Act has been introduced repeatedly and never passed.

What is new is who is asking: the case now rests on the Attorney General's own breach data rather than advocacy testimony. Watch the enforcement recommendations too. The report asks that any new law name who enforces it, fund that enforcement, and set penalties large enough to change behavior, citing Colorado's rulemaking authority and California's practice of routing 95% of recovered penalties back into privacy work. Budget usually decides whether a privacy law does anything.

What This Means for Your Inbox

The report describes data brokers as businesses that collect, combine, and sell personal information with no direct relationship to the people in their files. The word doing the work is combine. Merging two databases needs a shared key, and for consumer records that key is almost always an email address: unique, stable for years, typed into nearly every signup form, and unlike a name it collides with nobody.

So a breached email address is worth more than it looks. It is not just an inbox to spam. It is the join key that lets a broker attach a leaked Social Security number from one incident to a purchase history from another and a location trail from a third, producing a profile no single company ever assembled or disclosed. The $21 billion in identity theft losses tied to broker sourced data is what that stitching costs downstream.

That mechanism is not a finding of the Attorney General's Office. It is what sits underneath the finding, and it is why a centralized deletion system matters to your inbox: the request you would file through it is keyed on the same address that made the profile possible.

What Happens Next

Nothing automatically. A report from an Attorney General is a request, not a rule, and the Legislature has declined versions of this request before. In the meantime the office has committed to publishing plain language guidance on data collection, device security, and small business obligations, joining the consumer material it already maintains on health data and privacy.

What changed is the evidentiary record. When the next comprehensive privacy bill reaches committee, its sponsors will not argue from principle. They will point at 209 breaches, 8 million affected residents, 80% Social Security number exposure, and 95% of surveyed residents saying no circumstance would make them hand over data without informed consent. That last figure is the one to remember. The breach count measures failure. The consent number measures how far the current arrangement sits from what people would agree to if asked.