Washington State does not have a broad consumer privacy law like California, and that surprises a lot of dental, legal, and medical practices that assume their AI chatbot or automation platform is either fully covered or fully exempt. Neither is true. Washington regulates privacy and AI narrowly but firmly, through the My Health My Data Act, a strict biometric privacy law, one of the country's toughest call-recording laws, and a wave of new AI-specific rules taking effect in 2026 and 2027. If your Puget Sound practice uses an AI chatbot, an AI phone system, or automated follow-up texts, several of these laws almost certainly already apply to you. This guide breaks down what actually matters, in plain English, and what to check before your next AI rollout.

This guide is general information for Puget Sound business owners, not legal advice. Washington's privacy and AI rules are evolving quickly, so confirm anything below with a Washington-licensed attorney before making compliance decisions for your practice.

Does Washington Have a Comprehensive Privacy Law Like California's?

No, not yet. Unlike California, Colorado, or a dozen other states, Washington still has no single, comprehensive consumer privacy law. A broad bill has been introduced in the legislature nearly every year since 2021 and has stalled again in the current session, mostly over whether consumers should be able to sue directly. That gap does not mean Washington is unregulated. Instead of one big law, the state has built a patchwork of narrower, sector-specific rules that are often stricter than a general law would be, and several apply directly to AI-driven customer interactions. Understanding this patchwork, rather than assuming a CCPA-style law applies, is the first step to getting compliance right.

What Is the Washington My Health My Data Act, and Does It Apply to You?

The My Health My Data Act (MHMDA) is the single most important privacy law for regulated Puget Sound practices, and it is broader than most business owners expect. It covers consumer health data, defined as information that identifies a consumer's past, present, or future physical or mental health status, and it applies to any business operating in or targeting Washington residents, not just hospitals or clinics.

That matters directly for AI automation. If your website chatbot asks a visitor about symptoms, treatment interest, a legal injury, or any condition that could be tied to their health, and stores or passes along their contact details, you are very likely collecting consumer health data under MHMDA. The Act requires affirmative, opt-in consent before that data is collected, a separate consent before it is shared or sold, a dedicated consumer health data privacy policy linked from your homepage, and a way for people to access, delete, or withdraw consent for their data. Compliance deadlines already passed in 2024, including for small businesses, so there is no grace period left in 2026. If MHMDA applies to your practice, it applies now.

The stakes are real. Any violation of MHMDA is automatically treated as a violation of the Washington Consumer Protection Act, which the Washington State Attorney General's office enforces, and which also gives individual consumers a private right to sue. Few other state health privacy laws hand consumers that kind of direct legal standing.

Does Washington's All-Party Consent Law Apply to AI Phone Systems?

Yes, and this is the rule most AI automation vendors never mention. Washington is an all-party consent state under RCW 9.73.030, one of the strictest wiretapping laws in the country. Recording or transcribing a phone call, including with an AI receptionist, AI voice agent, or call-scoring tool, requires every participant's consent, not just yours.

In practice, this is easy to satisfy: play a short recorded notice at the start of every call stating that it may be recorded or monitored, before your AI system starts processing it. A caller who stays on the line after hearing that notice has given valid consent under Washington law. Skipping this step is a criminal gross misdemeanor and opens the door to a private lawsuit, with damages of at least a hundred dollars a day up to a thousand dollars, plus attorney fees, for each violation. If you deployed an AI phone or voice tool without this disclosure, it is worth checking today, not after a complaint.

Does Washington's Biometric Privacy Law Cover AI Voice Agents?

Sometimes, and the distinction matters. Washington's biometric privacy law, RCW 19.375, requires notice and consent before enrolling someone's fingerprint, voiceprint, retina scan, or similar unique biological identifier in a database for a commercial purpose. It explicitly excludes plain photographs, video, and audio recordings, so simply recording or transcribing a call does not trigger this law by itself.

It becomes relevant the moment your AI system generates a voiceprint to identify or verify a specific caller, for example, matching a returning patient by voice rather than by name or phone number. If any AI vendor you are evaluating offers voice-based caller identification, ask directly whether it creates a biometric template, and build consent into that workflow before turning the feature on. Washington's Attorney General is the only enforcer here, with penalties up to $7,500 per violation.

Which New Washington AI Laws Take Effect in 2026 and 2027?

Washington passed several AI-specific laws in the 2026 legislative session worth tracking, even though most will not immediately change how a typical dental, legal, or medical AI chatbot operates. One new law creates rules for AI companion chatbots, bots built to sustain an ongoing, human-like relationship and elicit emotional responses, similar to companion or wellness apps, and takes effect January 1, 2027, with a private right of action. Standard business chatbots used for scheduling, intake, or answering service questions are excluded, as long as they stay focused on that business purpose rather than acting like a relationship.

Separately, a new AI accountability law introduces requirements, including impact assessments and consumer disclosure, for high-impact AI systems used in consequential decisions, with a compliance deadline of January 1, 2027. And if your practice uses AI to monitor staff calls or productivity, a new employer-monitoring law, already in effect since July 1, 2026, requires advance written notice to employees before that monitoring begins.

None of this should discourage a properly built AI chatbot or automation system. It does mean choosing a vendor who tracks these deadlines with you, rather than one who treats compliance as your problem to discover later.

What Should a Compliance Checklist for AI Automation Include?

Before turning on any new AI automation for a dental, legal, or medical practice in Washington, run through this list:

  • Health-data check: Confirm whether your chatbot, intake form, or voice agent ever collects anything that reads as health information, and if so, get affirmative consent before collection, not just a privacy-policy mention.
  • Privacy policy: Publish or update a consumer health data privacy policy linked from your homepage if MHMDA applies to you.
  • Call disclosure: Add a recorded call disclosure to any AI phone or voice system before it starts processing a call.
  • Biometric review: Confirm with your AI vendor whether any feature creates a voiceprint or other biometric template, and get consent if it does.
  • Texting consent: Check that automated texts or calls to leads have documented, affirmative consent and an easy opt-out, consistent with the federal TCPA.
  • 2027 deadlines: Calendar the January 1, 2027 deadlines for Washington's new AI accountability and companion chatbot rules, and revisit your setup before then.

How Does AvioneX Build AI Automation That's Compliant by Design?

This is exactly the gap AvioneX Digital Co. was built to close for Puget Sound practices. We are not a generic AI vendor bolting a chatbot onto your website and moving on. When we build AI chatbots or workflow automation for dental practices, law firms, or medical practices, we configure consent capture, call disclosures, and data-handling settings around Washington's actual rules from day one, not as an afterthought after a complaint. That is what it means to be a local expert: knowing the difference between a general AI trend and the specific law that applies to a Kent dental office or a Tacoma law firm.

The Bottom Line for Regulated Puget Sound Businesses

Washington may not have a CCPA-style privacy law, but its targeted rules, the My Health My Data Act, the all-party consent law, biometric privacy protections, and the new AI-specific laws arriving in 2026 and 2027, add up to real obligations for any dental, legal, or medical practice using AI automation today. None of it is a reason to avoid AI. It is a reason to build it correctly. Treat this guide as a starting point, not a substitute for advice from a Washington-licensed attorney about your specific practice. When you are ready to see what compliant AI automation looks like for your business, book a free demo with AvioneX Digital Co.