Selling company data to AI companies in Washington

This guide covers Washington law for companies licensing records to AI buyers. Federal law and other states' laws still apply, as our US guide explains. Washington is not among the 21 states that JD Supra counted as having a comprehensive privacy law by spring 2026, but its health data law is stricter than any of them on sales.

What is the My Health My Data Act?

The My Health My Data Act is Washington's law protecting consumer health data, codified at RCW 19.373. The Washington Attorney General says it was designed to stop sensitive health data being collected and shared without consent, and that it sets rules on how and when regulated entities may collect, share and sell that data.

The Attorney General says sections 4 to 9 of the Act applied from March 31, 2024 for regulated entities and from June 30, 2024 for small businesses, and section 10 applied to all persons from July 23, 2023.

The Act reaches beyond Washington residents. RCW 19.373.010 defines a consumer as a Washington resident or a natural person whose consumer health data is collected in Washington, so a company based elsewhere can be caught by data it collected through Washington operations.

What counts as consumer health data?

Consumer health data covers information that identifies a consumer's past, present or future physical or mental health status. The Attorney General's page says it includes the use and purchase of prescribed medication and health inferences drawn from data that is not about health.

The Attorney General adds that purchases limited to toiletries generally do not qualify, but buying non-prescription medication does if the business infers a health status from it. For an AI seller, that means retail, ecommerce, fitness, scheduling and support records can all hold consumer health data. Our retail and ecommerce page covers the industry detail.

Can you sell consumer health data under Washington law?

You can sell consumer health data under Washington law only with a valid authorization from each consumer. RCW 19.373.070(1) makes it unlawful for any person to sell or offer to sell consumer health data without first obtaining one, and RCW 19.373.010 defines a sale as an exchange for monetary or other valuable consideration.

• The specific consumer health data to be sold
• The name and contact information of the seller and of the buyer
• The purpose of the sale, including how the buyer will use the data
• A statement that goods or services cannot be conditioned on signing
• A statement of the right to revoke and how to do it
• A statement that the buyer may redisclose the data and that it may then lose the Act's protection
• An expiration date one year after signing, and the consumer's signature and date

The authorization must be in plain language and separate from the consent needed to collect or share health data. Under RCW 19.373.070(5), the seller and the buyer must each keep copies for six years. Few archives were collected with authorizations of this kind, so most sellers exclude consumer health data about Washingtonians.

Revocation adds a second problem. A consumer can revoke an authorization at any time, so a license built on authorizations needs a working process to find and withdraw revoked records from the buyer.

Does a transfer without payment need consent?

A transfer without payment may still need consent. RCW 19.373.070 keeps the sale authorization separate from the consent required to collect or share consumer health data under RCW 19.373.030, so a free pilot dataset given to an AI developer is not automatically outside the Act. Expect buyers to ask you to confirm in writing that no Washington consumer health data is included.

Is de-identified or staff data covered by the Act?

De-identified data and staff data acting in a work role are outside the Act. RCW 19.373.010 says a consumer does not include an individual acting in an employment context, and that personal information does not include deidentified data.

Deidentified data means data that cannot reasonably be used to infer information about, or be linked to, an identified or identifiable consumer or device, where the holder takes reasonable measures against re-identification, publicly commits not to re-identify it and binds every recipient by contract. Our guide to de-identification for AI training data covers methods.

The Attorney General and consumers can both enforce the My Health My Data Act. The Attorney General says any violation is a per se violation of the Consumer Protection Act, RCW 19.86, which the office enforces and under which consumers can bring private actions.

That private route is what sets the Act apart from comprehensive state privacy laws, most of which leave enforcement to attorneys general. It raises the cost of getting a health data question wrong in a license.

Does Washington restrict selling biometric identifiers?

Washington restricts selling biometric identifiers under RCW 19.375. Section 19.375.020 says a person may not enroll a biometric identifier in a database for a commercial purpose without first giving notice, obtaining consent or providing a mechanism to prevent later commercial use.

A person who has enrolled a biometric identifier may not sell, lease or otherwise disclose it to another person for a commercial purpose without the individual's consent, unless a listed exception applies. Section 19.375.030 says the chapter may be enforced solely by the Attorney General under the Consumer Protection Act.

Does Washington require all-party consent to record calls?

Washington requires all-party consent to record private communications. RCW 9.73.030(1)(a) bars recording a private communication by telephone or similar device without first obtaining the consent of all participants, and the Reporters Committee for Freedom of the Press lists Washington among about 11 all-party consent states.

The same section also covers private conversations, so in-person meeting recordings need the same care. Before licensing call or meeting recordings, confirm that every Washington participant consented to the recording and check what they were told about later use. Our call recording data page sets out what buyers check.

Which buyers accept Washington sellers?

Buyers that accept US sellers accept Washington companies. micro1 says demand is strongest in the US, Endless Data prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction. Endless Data also says it never licenses protected health information.

What are Washington's rules at a glance?

What should a Washington seller do before licensing?

A Washington seller should search its records for health information and health inferences before anything else, because the authorization rule is hard to meet after the fact. These steps follow the statutes cited above.

1. 1

   Find health data and inferences

   Look beyond medical records to purchases, bookings, support tickets and notes that could reveal health status.

2. 2

   Exclude or de-identify it

   Remove consumer health data unless you hold valid authorizations, and de-identify the rest to the statutory standard.

3. 3

   Check biometric enrollment

   Identify any enrolled voice, face or fingerprint data and confirm consent before disclosure.

4. 4

   Confirm recording consent

   Check that every Washington participant consented to call and meeting recordings.

For a view of which buyers fit your records and what to exclude first, request a free data valuation.