Attorney General Nick Brown released Washington’s first-ever Data Privacy Report on 14 August 2026. It is a state-level accounting of what the data economy is actually doing to residents, and it is worth reading for the numbers rather than the recommendations.

The numbers

209 data breaches reported in 2025, affecting more than 8 million Washington residents. Washington’s population is roughly 8 million. The report is not claiming every resident was breached — one person can appear in several incidents, and non-residents are included in some counts. But the ratio is the point: annual breach notifications now exceed the population of the state.

More than 80% of reported breaches exposed Social Security numbers. This is the number that should alarm people. An SSN is a permanent, unreissuable identifier that the American financial system continues to treat as an authenticator. Four out of five breaches leaking the one identifier you cannot change is not a series of incidents; it is a description of a broken design.

83% of surveyed residents said they had little or no control over who could access their personal information. From a 2025 survey of over 700 residents across 26 counties.

That last figure deserves more weight than it will get. The entire American privacy framework — federal and state — is built on notice and choice. You are informed; you choose. If 83% of people report that they have no meaningful control, then either the mechanism is not working or people are wrong about their own experience. The report treats it as the former, correctly.

What the report identifies

Four failure modes:

Excessive collection and reuse. Companies gather far more than the transaction requires and then find secondary uses for it. Collection is cheap, storage is cheap, and the option value of data you have not yet found a use for is positive, so the rational corporate default is take everything.

Weak consent rules and deceptive design. Dark patterns. Consent obtained through interfaces engineered to make refusal effortful and acceptance one click.

The sale of personal data. Not as an abuse but as an ordinary line of business.

Limited transparency among data brokers. Nobody, including the state, can enumerate who holds what.

The recommendation: a broker registry

The headline policy ask is that Washington require data brokers to register with regulators and follow standard practices to safeguard personal information.

Registries are the necessary first step and an insufficient last one. California has run one since 2019 and it produced two things of value: an enumerated list of brokers, and — crucially — the substrate for DROP, the Delete Request and Opt-out Platform, which went live for brokers on 1 August 2026 and is now the single strongest consumer privacy mechanism in the country.

DROP could not exist without the registry. You cannot build a one-stop deletion system if you do not know who to send the deletion to. So a Washington registry is not a weak recommendation; it is the load-bearing precondition for the thing that actually works. Texas, Oregon, and Vermont have registries too. The pattern is becoming standard, which raises the obvious question of why it should be fifty separate registries rather than one federal one — a question with a well-understood answer.

Where Washington already leads

The report understates the state’s existing position. Washington passed the My Health My Data Act, which is the most aggressive consumer health privacy statute in the country and the only major state privacy law with a private right of action.

That last feature is why it matters disproportionately. Every other state comprehensive privacy law is enforced exclusively by the attorney general, meaning enforcement volume is capped by one office’s budget and priorities. My Health My Data lets individuals sue, which produces enforcement at a scale no AG office can match — and, predictably, an intense industry campaign to narrow it.

Washington also did not pass a comprehensive consumer privacy act in the WPA/VCDPA mould. Attempts failed repeatedly. So the state holds the country’s strongest sectoral health privacy law and no general privacy statute at all. That gap is the unstated context for the report.

What it means in practice

State AGs are now the American privacy regulator, and they are producing their own evidence base. A first-ever report from a state AG’s office is a signal of institutional investment, not a one-off press release. It follows the pattern of state enforcement doubling this year.

The SSN figure is a federal indictment. No state can fix the fact that a nine-digit number issued for retirement accounting functions as a national authenticator. Four-fifths of breaches exposing it is a structural failure that state privacy law is not equipped to address.

“Little or no control” is the honest state of consumer privacy. Eighteen-plus states have comprehensive laws. The rights they grant are real. And the people covered by them overwhelmingly report having no control, because exercising those rights requires knowing which of thousands of companies hold your data and contacting each one individually. DROP exists precisely because that model failed.

Registries are plumbing, not protection. Useful, necessary, and worth nothing on their own. What makes them matter is what gets built on top.

What you can do

  1. Washington residents: read the report and file complaints with the AG’s office. Complaint volume is what determines which sectors get investigated. This report exists because someone counted; complaints are what gets counted.

  2. Use My Health My Data if you are in Washington. It covers a far broader definition of health data than HIPAA — including inferences drawn from your browsing and purchases — and it gives you standing to sue. Almost nobody uses it.

  3. Freeze your credit at all three bureaus. Given that 80%+ of breaches expose SSNs, this is not a response to any particular incident. It is baseline hygiene, it is free, and it is the only control that actually blocks new-account fraud.

  4. If your state has a broker registry, work through it. California, Texas, Oregon, and Vermont publish lists. Each broker must offer an opt-out. It is tedious and it works.

  5. Ask your state legislators for a registry plus a deletion mechanism, not a registry alone. California took seven years to get from one to the other. Other states can skip the wait.