Establishes the Washington privacy act. Addresses the processing of personal data by controllers or processors; facial recognition for profiling; the state's citizens right to privacy; transparency; exemptions; liability; and enforcement. Prohibits state and local government agencies from using facial recognition technology to engage in ongoing surveillance of specified individuals in public spaces, unless it is in support of law enforcement activities. Requires the office of privacy and data protection to conduct an analysis on the public sector use of facial recognition and submit a report of its findings to the appropriate legislative committees.   Official Text and Analysis.

Requires controllers to facilitate requests to exercise consumer rights regarding access, correction, deletion, restriction of processing, data portability, and objection for targeted advertising. ? Requires controllers to conduct risk assessments under certain conditions. ? Specifies the thresholds a business must satisfy for the requirements set forth in this act to apply. ? Provides that violation of this act violates the Consumer Protection Act. ? Requires controllers using facial recognition for profiling to meet certain requirements. ? Prohibits the use of facial recognition technology by all state and local government agencies to engage in ongoing surveillance of specified individuals in public spaces unless in support of law enforcement or in an emergency. ? Requires the Office of Privacy and Data Protection to conduct an analysis on the public sector use of facial recognition technology.

Any legislator who sponsored the act is prohibited from offering services for compensation to assist regulated parties with compliance.