Strike everything after the enacting clause and insert the following:

Sec. 1. "RCW 66.20.170 and 2016 c 235 s 7 are each amended to read as follows:

(1) A card of identification may for the purpose of this title and for the purpose of procuring liquor, be accepted ((as an identification card)) by any licensee ((and)) as evidence of legal age of the person presenting such card, provided the licensee complies with the conditions and procedures prescribed herein and such regulations as may be made by the board.

(2)(a) A biometric age verification system may for the purpose of this title and for the purpose of procuring liquor, be relied upon by any licensee as evidence of legal age of the person using the biometric age verification system, provided the licensee complies with the conditions and procedures prescribed herein and such regulations as may be made by the board.

(b) A biometric age verification system must:

(i) Use a biometric system;

(ii) Use an electronic authorization process and processes to verify the validity of a card of identification and the identity of the holder of such card of identification;

(iii) Verify the person enrolling in the biometric system is the same as the card of identification holder and securely store the data captured from the card of identification in the biometric system;

(iv) Provide an indication that the card of identification holder meets the age eligibility requirement upon future scans of the biometric characteristic used in the biometric system; and

(v) Maintain records as established by the board.

(c) Use of a biometric age verification system is a mitigating circumstance the board may consider to impose a different penalty than the standard penalties established by the board.

(d) The use of a biometric age verification system is optional for a licensee and a person procuring liquor. Any licensee that relies on a biometric age verification system shall post near its entrance a notice visible to the public that a card of identification may be presented as evidence of legal age of a person instead of participation in the biometric age verification system. When a purchase of liquor occurs separate from a physical point of sale location, the notice must be provided wherever consumers are directed to a biometric age verification system.

(3) A licensee may not collect a person's biometric identifiers to be used in a biometric age verification system except with consent from the person. The consent required under this section must be obtained before enrolling in the biometric system. Consumers must be informed of the categories of data that will be collected, including the specific ways in which it will be used consistent with this chapter, and how a consumer may withdraw consent and request deletion of the data collected.

(4) No person may utilize any data collected for a biometric age verification system pursuant to this section for any purpose other than for age verification for the purchase of liquor. Such transaction may include the purchase of other products and services concurrently with the purchase of liquor.

(5) The legislature finds that the practices regarding biometric age verification systems covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this section by a biometric age verification system provider is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for purposes of applying the consumer protection act, chapter 19.86 RCW. This section related to biometric age verification systems may be enforced solely by the attorney general under the consumer protection act, chapter 19.86 RCW.

NEW SECTION. Sec. 2. A new section is added to chapter 66.20 RCW to read as follows:

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Biometric identifier" means data that is generated from the measurement or technological processing of an individual's biological characteristics and that identifies a consumer including, but not limited to, retina or iris scans, scans of face geometry, fingerprint or palmprint mapping, and voiceprints that are used to identify a specific individual. "Biometric identifier" does not include a physical or digital photograph, video or audio recording or data generated therefrom, or information collected, used, or stored for health care treatment, payment, or operations under the federal health insurance portability and accountability act of 1996.

(2) "Biometric system" means an automated identification system used to capture, process, and store a biometric identifier, compare the biometric identifier to one or more references, and match the biometric identifier to a specific individual.

(3) "Card of identification" means identification issued by any United States state, United States territory, or the District of Columbia, tribal or federal government, as well as any physical identification document issued by a foreign government that contains the holder's photos, date of birth, and signature except on United States federally issued identification where a visible signature is not required.

(4) "Consent" means a clear affirmative act that signifies a consumer's freely given, specific, informed, voluntary, and unambiguous agreement, which may include written consent provided by electronic means. "Consent" may not be obtained by:

(a) A consumer's acceptance of a general or broad terms of use agreement or a similar document that contains descriptions of personal data processing along with other unrelated information; or

(b) A consumer's agreement obtained through the use of deceptive designs.

(5) "Deceptive designs" means a user interface designed or manipulated with the effect of subverting or impairing user autonomy, decision making, or choice."