wa-law.org > bill > 2025-26 > HB 2380 > Original Bill
The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
"Banking service" means a service offered by a financial institution to a consumer under an agreement including, without limitation, services related to deposits, withdrawals, loans, balance information, funds transfers, account management, bill payment, credit score information, financial transactions, stocks, bonds, securities, or virtual currency.
"Consumer" means a consumer of banking services accessing banking services through a mobile or internet application.
"Financial institution" has the same meaning as in RCW 30A.22.040 and 30A.22.041. For purposes of this chapter only, "financial institution" also means a "broker-dealer" or "investment adviser" as defined in RCW 21.20.005.
"Mobile or internet application" means a service accessible on a mobile phone, computer, digital device, or other internet-connected device.
"Necessary to provide a banking service" means reasonably required by the financial institution for compliance with, or to exercise a power granted to the financial institution under, federal or Washington law.
"Personal information" means any information that directly or indirectly identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to a particular individual, household, or device. Information is reasonably linkable to an individual, household, or device if it can be used on its own or in combination with other information to identify an individual, household, or device.
"Third-party application" means a mobile or internet application other than the financial institution's mobile or internet application.
[Empty]
Except as provided in subsection (3) of this section, a financial institution that offers banking services to consumers through a mobile or internet application must make the disclosure required by subsection (2) of this section to consumers and allow consumers to opt out of the financial institution:
Collecting, storing, or sharing personal information about the consumer when the collection, storing, or sharing is not necessary to provide a banking service to the consumer through the mobile or internet application; and
Allowing a third-party application to collect, store, or share personal information about the consumer obtained from the consumer's use of the financial institution's mobile or internet application.
Except as provided in subsection (3) of this section, a financial institution may not collect, store, or share personal information about a consumer who has opted out of the collection, storage, or sharing of their personal information in the financial service's mobile or internet application as provided in subsection (1) of this section.
Unless exempt under subsection (3) of this section, a financial institution must disclose to a consumer accessing banking services through the financial institution's mobile or internet application:
That the financial institution's mobile or internet application may collect, store, or share, personal information about the consumer, or allow a third-party application to collect, store, or share personal information about the consumer;
That the financial institution's mobile or internet application may collect, store, or share personal information about a consumer from third-party applications installed on the consumer's mobile or internet-connected device; and
That a consumer has a right to opt out of the financial institution collecting, storing, sharing, or allowing third-party applications to collect personal information about the consumer when the collection, storing, or sharing of the consumer's personal information is not necessary to provide a banking service to the consumer through the financial institution's mobile or internet application.
[Empty]
Nothing in this section prohibits a financial institution from collecting, storing, or sharing personal information about a consumer when doing so is necessary to provide a banking service to the consumer and consistent with the agreement between the financial institution and the consumer.
A financial institution is exempt from subsections (1) and (2) of this section if the financial institution ensures that its mobile or internet application does not:
Collect, store, or share personal information about a consumer except as necessary to provide the consumer a banking service and consistent with the agreement between the financial institution and the consumer;
Collect, store, or share personal information about a consumer obtained from a third-party application installed on the consumer's mobile or internet-connected device; and
Allow a third-party application to collect, store, or share personal information about a consumer obtained from the consumer's use of the financial institution's mobile or internet application.
The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. Violations of this chapter are not reasonable in relation to the development and preservation of business. A violation of this chapter is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.
A person injured by a violation of this chapter is entitled to the greater of statutory damages of $7,500, or actual damages under RCW 19.86.090. Statutory damages may be recovered by the attorney general or by a person injured by a violation of this chapter. Any statutory damages recovered by the attorney general must be paid as restitution to the injured person.
If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.