Establishes the Washington privacy act.

Identifies controller and processor obligations.

Requires controllers to facilitate requests to exercise consumer rights regarding access, correction, deletion, restriction of processing, data portability, and objection of direct marketing purposes.

Requires controllers to conduct risk assessments under certain conditions.

Specifies the thresholds a business must satisfy for the requirements set forth in this act to apply.

Provides that this act does not apply to local and state governments, municipal corporations, data regulated by certain federal laws, or employment records.

Provides that violation of this act violates the Consumer Protection Act.

Requires controllers using facial recognition for profiling to meet certain requirements.

Prohibits the use of facial recognition technology by all state and local government agencies to engage in ongoing surveillance of specified individuals in public spaces unless in support of law enforcement or in an emergency.

Requires the Office of Privacy and Data Protection to conduct an analysis on the public sector use of facial recognition technology.