According to the Federal Trade Commission, companies known as "data brokers" collect personal information from consumers and sell or share it with others.  Data brokers collect this information from a wide variety of commercial and government sources, and use both raw and inferred data about individuals to develop and market products, verify identities, and defect fraud.  Because these companies generally never interact directly with consumers, consumers are often unaware of their existence, practices, and use of collected personal information.

The Department of Licensing (Department) regulates a number of businesses and professions, including home inspectors, real estate brokers, collection agencies, and notaries.  For regulated professions, the Department issues licenses and ensures compliance with professional standards and laws. 

A data broker must register annually with the Department before collecting, selling, or licensing brokered personal data within Washington.  On or before January 31 each year, a data broker must submit to the Department their name, street address, telephone number, primary website and email address; pay a fee as determined by the Department; and include a declaration which:

• states whether individuals may opt out of all or a portion of the data broker's collection, sale, or licensing of the individuals' brokered personal data;
• identifies which of the data broker's activities an individual may opt out of; and 
• describes the method by which an individual may opt out.

A data broker may collect, sell, or license brokered personal data without registering with the Department if the collection, sale, or licensing involves:

• providing publicly available information that is related to an individual's business or profession;
• providing publicly available information as part of a service that provides alerts for health or safety purposes;
• providing information that is lawfully available from federal, state, or local government records;
• publishing, selling, reselling, distributing, or providing digital access to journals, books, periodicals, newspapers, magazines, news media, or educational, academic, or instructional works;
• developing or maintaining an electronic commerce service or software;
• providing directory assistance or directory information services as, or on behalf of, a telecommunications carrier; or
• selling the assets of a business entity or part of a business entity a single time, or only occasionally, as part of a transfer of control over the assets that is not part of the business entity's conduct.

The Department may approve and renew a registration by means of an agreement with the nationwide multistate licensing system, and may, by rule, conform the practices, procedures, and information that the Department uses to approve or renew a registration accordingly.

The Department must make the information that business entities submit for registration publicly available on its website.

The Department may impose a civil penalty that does not exceed $500 for each violation or $500 for each day the violation continues.  The total amount of penalties that may be imposed on a data broker may not exceed $10,000 during any calendar year.  If the data broker fails to pay the civil penalty, the Attorney General may recover the amount imposed by action in the appropriate court. 

"Brokered personal data" means any of the following computerized data elements about an individual residing in the state, if categorized or organized for sale or licensing to another entity, including name, name of an immediate family or household member, address or address of an immediate family or household member, date or place of birth, mother's maiden name, biometric information, social security number, the number of any other government-issued identification, or other information that, alone or in combination with information that is sold or licensed, can reasonably be associated with the individual. 

"Data broker" means a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person.  A data broker does not include:

• a consumer reporting agency, a person that furnishes information to a consumer reporting agency, or a user of a consumer reporting agency, to the extent that the agency or person is engaged in activities subject to regulation under the federal Fair Credit Reporting Act;
• a financial institution, an affiliate, or a non affiliated third party that are regulated under the Gramm-Leach-Bliley Act; and
• a business entity that collects information about an individual who is or was:  (1) a customer, subscriber, or user of the business entity's goods or services; (2) an employee or agent of the business entity or in a contractual relationship with the business entity; (3) an investor; (4) a donor; or (5) in another relationship with the business entity that performs services for, acts on behalf of, or acts as an agent of a business entity.