Financial services apps

AN ACT Relating to protecting the personal information of 1
consumers who use financial services applications on their mobile or 2
internet-connected devices; and adding a new chapter to Title 19 RCW.3
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:4
NEW SECTION. Sec. 1. The definitions in this section apply 5
throughout this chapter unless the context clearly requires 6
otherwise.7
(1) "Banking service" means a service offered by a financial 8
institution to a consumer under an agreement including, without 9
limitation, services related to deposits, withdrawals, loans, balance 10
information, funds transfers, account management, bill payment, 11
credit score information, financial transactions, stocks, bonds, 12
securities, or virtual currency. 13
(2) "Consumer" means a consumer of banking services accessing 14
banking services through a mobile or internet application.15
(3) "Financial institution" has the same meaning as in RCW 16
30A.22.040 and 30A.22.041. For purposes of this chapter only, 17
"financial institution" also means a "broker-dealer" or "investment 18
adviser" as defined in RCW 21.20.005. 19
H-2816.1
HOUSE BILL 2380
State of Washington 69th Legislature 2026 Regular Session
By Representatives Low, Kloba, and Graham
Prefiled 01/09/26. Read first time 01/12/26. Referred to Committee
on Consumer Protection & Business.
p. 1 HB 2380
(4) "Mobile or internet application" means a service accessible 1
on a mobile phone, computer, digital device, or other internet-2
connected device. 3
(5) "Necessary to provide a banking service" means reasonably 4
required by the financial institution for compliance with, or to 5
exercise a power granted to the financial institution under, federal 6
or Washington law. 7
(6) "Personal information" means any information that directly or 8
indirectly identifies, relates to, describes, is capable of being 9
associated with, or could reasonably be linked to a particular 10
individual, household, or device. Information is reasonably linkable 11
to an individual, household, or device if it can be used on its own 12
or in combination with other information to identify an individual, 13
household, or device. 14
(7) "Third-party application" means a mobile or internet 15
application other than the financial institution's mobile or internet 16
application. 17
NEW SECTION. Sec. 2. (1)(a) Except as provided in subsection 18
(3) of this section, a financial institution that offers banking 19
services to consumers through a mobile or internet application must 20
make the disclosure required by subsection (2) of this section to 21
consumers and allow consumers to opt out of the financial 22
institution:23
(i) Collecting, storing, or sharing personal information about 24
the consumer when the collection, storing, or sharing is not 25
necessary to provide a banking service to the consumer through the 26
mobile or internet application; and 27
(ii) Allowing a third-party application to collect, store, or 28
share personal information about the consumer obtained from the 29
consumer's use of the financial institution's mobile or internet 30
application. 31
(b) Except as provided in subsection (3) of this section, a 32
financial institution may not collect, store, or share personal 33
information about a consumer who has opted out of the collection, 34
storage, or sharing of their personal information in the financial 35
service's mobile or internet application as provided in subsection 36
(1) of this section. 37
(2) Unless exempt under subsection (3) of this section, a 38
financial institution must disclose to a consumer accessing banking 39
p. 2 HB 2380
services through the financial institution's mobile or internet 1
application: 2
(a) That the financial institution's mobile or internet 3
application may collect, store, or share, personal information about 4
the consumer, or allow a third-party application to collect, store, 5
or share personal information about the consumer; 6
(b) That the financial institution's mobile or internet 7
application may collect, store, or share personal information about a 8
consumer from third-party applications installed on the consumer's 9
mobile or internet-connected device; and 10
(c) That a consumer has a right to opt out of the financial 11
institution collecting, storing, sharing, or allowing third-party 12
applications to collect personal information about the consumer when 13
the collection, storing, or sharing of the consumer's personal 14
information is not necessary to provide a banking service to the 15
consumer through the financial institution's mobile or internet 16
application. 17
(3)(a) Nothing in this section prohibits a financial institution 18
from collecting, storing, or sharing personal information about a 19
consumer when doing so is necessary to provide a banking service to 20
the consumer and consistent with the agreement between the financial 21
institution and the consumer. 22
(b) A financial institution is exempt from subsections (1) and 23
(2) of this section if the financial institution ensures that its 24
mobile or internet application does not: 25
(i) Collect, store, or share personal information about a 26
consumer except as necessary to provide the consumer a banking 27
service and consistent with the agreement between the financial 28
institution and the consumer; 29
(ii) Collect, store, or share personal information about a 30
consumer obtained from a third-party application installed on the 31
consumer's mobile or internet-connected device; and32
(iii) Allow a third-party application to collect, store, or share 33
personal information about a consumer obtained from the consumer's 34
use of the financial institution's mobile or internet application.35
NEW SECTION. Sec. 3. (1) The legislature finds that the 36
practices covered by this chapter are matters vitally affecting the 37
public interest for the purpose of applying the consumer protection 38
act, chapter 19.86 RCW. Violations of this chapter are not reasonable 39
p. 3 HB 2380
in relation to the development and preservation of business. A 1
violation of this chapter is an unfair or deceptive act in trade or 2
commerce and an unfair method of competition for the purpose of 3
applying the consumer protection act, chapter 19.86 RCW.4
(2) A person injured by a violation of this chapter is entitled 5
to the greater of statutory damages of $7,500, or actual damages 6
under RCW 19.86.090. Statutory damages may be recovered by the 7
attorney general or by a person injured by a violation of this 8
chapter. Any statutory damages recovered by the attorney general must 9
be paid as restitution to the injured person. 10
NEW SECTION. Sec. 4. If any provision of this act or its 11
application to any person or circumstance is held invalid, the 12
remainder of the act or the application of the provision to other 13
persons or circumstances is not affected.14
NEW SECTION. Sec. 5. Sections 1 through 3 of this act 15
constitute a new chapter in Title 19 RCW.16
--- END ---
p. 4 HB 2380