Washington State Invasion of Privacy Laws and Penalties

Washington state invasion of privacy laws give you the right to sue for secret snooping, unauthorized use of your name or image, and public disclosure of private facts; require every party’s consent before a private conversation is recorded; add specific protections for health data, workplace monitoring, and personal accounts; and back all of it with criminal penalties that can reach felony level. If your privacy has been violated, you generally have civil damages available, and in many situations criminal charges are possible as well.

Civil Claims You Can Bring

Washington courts recognize a set of common-law privacy torts, confirmed by the Washington Supreme Court in Reid v. Pierce County, which held that “the common law right of privacy exists in this state and that individuals may bring a cause of action for invasion of that right.”¹ Three of these claims are well-established. A fourth sits in a gray area.

Intrusion Upon Seclusion

You can sue for intrusion when someone intentionally pries into your private affairs in a way a reasonable person would find highly offensive. The elements are a reasonable expectation of privacy, an unauthorized invasion, and offensiveness serious enough to cross the legal line.² Secretly recording someone inside their home or photographing a patient during a medical exam are classic examples.

The intrusion itself creates liability. Nobody has to publish or share what they found; the act of prying is enough.² That distinguishes intrusion from the other privacy torts, which generally require some form of disclosure.

Public Disclosure of Private Facts

If someone broadcasts private information about you without your consent, you may have a claim. The disclosure has to be the kind a reasonable person would find highly offensive, and the information cannot be a matter of legitimate public concern. Even truthful information can create liability when it is private enough. Medical records, financial details, and intimate personal history are the usual examples.

Courts look at whether the information was already public and whether it served a newsworthy purpose. In Reid v. Pierce County, the Washington Supreme Court held that relatives of a deceased person had a protectable privacy interest in autopsy photographs, ruling that even records obtained through official channels could support a privacy claim.¹

Misappropriation of Name, Voice, or Likeness

Washington goes beyond common-law misappropriation with a statute specifically protecting personality rights. Under the Personality Rights Act, RCW 63.60, every person has a property right in their name, voice, signature, photograph, and likeness. Using any of these for commercial purposes without permission creates liability, and the right is freely transferable.³

Unlike the other privacy torts, misappropriation does not require the use to be offensive or embarrassing. Simply profiting from someone’s identity without consent is enough. A business that puts a local athlete’s photo on an advertisement without a licensing deal has created liability regardless of whether the ad was flattering. These rights also survive death and can be inherited or licensed by heirs.⁴

False Light Is Not Clearly Recognized

False light, where someone is misleadingly portrayed in a way that would be highly offensive to a reasonable person, is recognized in many states, but Washington has never explicitly adopted it. In Eastwood v. Cascade Broadcasting, the Washington Supreme Court questioned the wisdom of creating a separate false light tort given its overlap with defamation, and held that where the same facts support both, the two-year defamation statute of limitations governs.⁵ If you believe you have been portrayed in a misleading way, a defamation claim is the more reliable path.

Recording Without Everyone’s Consent Is Illegal

Washington is an all-party consent state. Under RCW 9.73.030, it is illegal to intercept or record any private communication, whether in person, over the phone, or through an electronic device, without first getting consent from every party.⁶ You cannot secretly record a conversation you are part of, even if the recording would prove something important.

Courts read “private conversation” broadly. The test is whether the participants reasonably expected the conversation was not being overheard or recorded. Discussions in workplaces, restaurants, or other semi-public settings can qualify if the speakers reasonably believed they were speaking privately.

Exceptions to the All-Party Rule

The statute carves out situations where recording without full consent is permitted:

Calls reporting a fire, medical emergency, crime, or disaster.
Communications that convey threats of extortion, blackmail, bodily harm, or other unlawful demands.
Anonymous calls, repeated calls, or calls made at extremely inconvenient hours.
Communications by a hostage-taker or barricaded person.

Law enforcement has limited authority to record without full consent during official duties, but generally needs a warrant or prior judicial authorization to intercept communications from someone who has not consented.⁷

Illegal Recordings Can’t Be Used as Evidence

Recordings made in violation of RCW 9.73.030 are inadmissible in court. The Privacy Act has its own exclusionary rule: any information obtained through an illegal recording cannot be used as evidence.⁷ People who secretly record a spouse, business partner, or neighbor to build a case often discover that the recording hurts their position rather than helping it.

Damages for a Recording Violation

Anyone injured by a violation of the Privacy Act can sue and recover either actual damages, including compensation for emotional distress, or liquidated damages of $100 per day of the violation up to a $1,000 cap, whichever is greater. The statute also entitles a successful plaintiff to reasonable attorney fees and litigation costs.⁸ The fee-shifting provision makes smaller claims economically viable to pursue.

Health Data

The Washington My Health My Data Act, RCW 19.373, has been in effect since March 2024. It applies far beyond traditional healthcare providers. Any “regulated entity” that collects, shares, or sells consumer health data in Washington must comply, which sweeps in apps, websites, and retailers handling health-related information.

The law requires separate, specific consent before a business can collect your health data, and a second distinct consent before sharing that data with anyone else. Selling consumer health data without a signed authorization is flatly prohibited. You have the right to have your health data deleted on request. The law also makes it unlawful to use a geofence around any facility that provides in-person healthcare services to identify or track consumers, collect their health data, or send them targeted messages about health services.⁹ The act includes a private right of action, so individuals can sue for violations directly.

Workplace Privacy

Two workplace laws apply now, with a third coming.

Under RCW 49.44.200, your employer cannot demand your social media login credentials, force you to open your personal accounts in the employer’s presence, compel you to add the employer to your contacts, or require you to change your privacy settings. An employer that fires, disciplines, or refuses to hire you for declining any of these requests violates the statute.¹⁰

Beginning July 1, 2026, HB 1672 will require employers to give detailed written notice before electronically monitoring employees, covering the form and purpose of monitoring, technologies used, who has access to the data, frequency, retention, and how employees can review and correct errors. Employers must also provide an annual list of active monitoring systems affecting each employee. Prior notice is not required when the employer has reasonable grounds to believe an employee is engaged in illegal conduct, is violating another’s rights, or is creating a hostile work environment, and the monitoring is likely to produce evidence of that conduct.¹¹

Computer Access and Data Breaches

Accessing someone’s computer, email account, social media profile, or cloud storage without authorization is a crime. Computer trespass in the first degree, which requires either intent to commit another crime or unauthorized access to a government database, is a Class C felony.¹² Second-degree computer trespass covers unauthorized access that does not rise to first-degree level and is a gross misdemeanor.¹³ Logging into an ex-partner’s email out of curiosity is likely second degree; hacking into that account to steal financial information or getting into a government system is first degree.

When a business operating in Washington suffers a breach exposing residents’ unsecured personal information, it must notify affected consumers within 30 calendar days of discovering the breach, one of the shortest deadlines in the country. The notice has to be in plain language and include the types of personal information compromised, the timeframe of the exposure, and contact information for major credit reporting agencies if financial data was involved. Breaches affecting more than 500 Washington residents also require a separate notification to the Attorney General’s Office within 30 days.¹⁴ Notification is not required if the breached data was encrypted or if the breach is not reasonably likely to cause harm. If a breach exposes your username and password, the notice must tell you to change your credentials promptly, including on any other accounts where you reused the same password.¹⁵

Criminal Penalties

Privacy violations can carry criminal consequences ranging from misdemeanors to felonies.

Violating the all-party consent rule under RCW 9.73.030 is a gross misdemeanor, punishable by up to 364 days in jail and a fine. Penalties escalate to a Class C felony when the illegal recording involves certain law enforcement investigations into controlled substances or commercial sexual abuse.⁷

Voyeurism in the first degree, which is knowingly viewing, photographing, or filming someone without their knowledge in a place where they have a reasonable expectation of privacy for the purpose of sexual gratification, is a Class C felony carrying up to five years in prison and a fine of up to $10,000.¹⁶¹⁷ Second-degree voyeurism is a gross misdemeanor. First-degree voyeurism is classified as a sex offense for sentencing purposes, which brings registration requirements and other collateral consequences.

Identity theft is prosecuted under RCW 9.35.020 at two levels. If the stolen identity is used to obtain more than $1,500 in value, or if the victim is a senior or vulnerable individual, the crime is identity theft in the first degree, a Class B felony carrying up to ten years in prison and a fine of up to $20,000.¹⁸¹⁹ Identity theft in the second degree, where the value is $1,500 or less and no vulnerable victim is involved, is a Class C felony with a maximum of five years and $10,000. Courts frequently order restitution on top of these penalties.

How Long You Have to Sue

Most civil privacy tort claims (intrusion, public disclosure of private facts, and misappropriation) fall under Washington’s three-year statute of limitations for personal injury actions under RCW 4.16.080.²⁰ The clock typically starts when the invasion occurs or when you reasonably discover it.

Claims that overlap with defamation, which includes most false light scenarios, face a shorter two-year deadline. The Washington Supreme Court made this clear in Eastwood v. Cascade Broadcasting, holding that when the same facts support both a defamation claim and a privacy claim, the shorter defamation deadline applies.⁵ Civil claims under the Privacy Act for illegal recordings have their own three-year window tied to the general personal injury limitations period. Missing any of these deadlines permanently bars your claim regardless of how strong the underlying facts are.

1
Justia. Reid v. Pierce County – 1998 – Washington Supreme Court Decisions
2
Cornell Law School Legal Information Institute (LII). Intrusion on Seclusion
3
Washington State Legislature. Chapter 63.60 RCW – Personality Rights
4
Washington State Legislature. Washington Code 63.60.040 – Right Is Exclusive for Individuals and Personalities
5
Justia. Eastwood v. Cascade Broadcasting Co. – 1986 – Washington Supreme Court Decisions
6
Washington State Legislature. Washington Code 9.73.030 – Intercepting, Recording, or Divulging Private Communication – Consent Required – Exceptions
7
Washington State Legislature. Chapter 9.73 RCW – Privacy, Violating Right Of
8
Washington State Legislature. Washington Code 9.73.060 – Violating Right of Privacy – Civil Action – Liability for Damages
9
Washington State Legislature. Chapter 19.373 RCW – Washington My Health My Data Act
10
Washington State Legislature. RCW 49.44.200 – Personal Social Networking Accounts – Restrictions on Employer Access
11
Washington State House of Representatives. HB 1672 Bill Analysis
12
Washington State Legislature. Washington Code 9A.52.110 – Computer Trespass in the First Degree
13
Washington State Legislature. Washington Code 9A.52.120 – Computer Trespass in the Second Degree
14
Washington State Legislature. RCW 19.255.010 – Personal Information – Notice of Security Breaches
15
Washington State Office of the Attorney General. Washington’s Data Breach Notification Laws
16
Washington State Legislature. Washington Code 9A.44.115 – Voyeurism
17
Washington State Legislature. RCW 9A.20.021 – Maximum Sentences for Crimes Committed July 1, 1984, and After
18
Washington State Legislature. Washington Code 9.35.020 – Identity Theft
19
Washington State Legislature. Washington Code 9A.20.021 – Maximum Sentences for Crimes Committed July 1, 1984, and After
20
Washington State Legislature. Washington Code 4.16.080 – Actions Limited to Three Years