Effective July 23, 2017, Washington will join Illinois and Texas as the third U.S. state to impose statutory restrictions on how businesses collect, use, disclose and retain biometric information. House Bill 1493 applies to entities that “enroll a biometric identifier in a database for a commercial purpose” and includes requirements to provide notice to individuals and obtain their affirmative consent, both prior to enrollment and if the business seeks to sell, lease or otherwise disclose the identifier to a third party.

The new law does not prescribe the exact form of notice and consent, making clear those processes are “context-dependent,” and notably, there is no specific requirement that consent must be written. The law contains certain exceptions to the consent requirement with respect to disclosures, such as if disclosure is necessary to provide a service or product requested by the individual or if it is made to a third party that “contractually promises” that the biometric identifier will not be further disclosed or enrolled in a database inconsistent with the law.