Camera-related state law

Washington's foundational audio-recording statute is RCW 9.73.030, the state Privacy Act. The statute makes it unlawful to intercept or record any private conversation between two or more individuals, or any private telephonic or telegraphic or other electronic communication, without first obtaining the consent of all the parties engaged in the communication. Washington is therefore an all-party consent state for private communications.

The statute uses the word "private" deliberately. Conversations that lack a reasonable expectation of privacy (announcements over a PA system, exchanges in a public lobby, parties at a public event) are treated differently in WA case law. Even so, the safer commercial practice is to assume any conversation in a workspace is private and avoid recording audio unless all-party consent is documented.

RCW 9A.44.115 is Washington's voyeurism statute. It makes it a felony to view, photograph, or film another person without consent in a place where the person has a reasonable expectation of privacy. This is the statute that puts hidden cameras in restrooms, dressing rooms, and hotel guest rooms in criminal territory.

Practical translation. Commercial WA camera installs default to video-only on the cameras and route audio capture through a separate documented intercom or call-recording workflow with all-party consent disclosed. Hidden cameras in spaces where privacy is expected are off the table for the operator and the integrator.

Biometric data and RCW 19.375

Washington has a standalone biometric identifier statute. RCW 19.375 prohibits enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of the biometric identifier for that purpose. Biometric identifier under RCW 19.375 includes fingerprint, voiceprint, eye retina or iris pattern, and other unique biological patterns or characteristics that identify a person.

The statute also restricts sale, lease, and disclosure of an enrolled biometric identifier and requires retention only as long as reasonably necessary for the purpose for which it was collected. Enforcement is by the Washington Attorney General with civil penalties under the Consumer Protection Act. Unlike Illinois BIPA, RCW 19.375 does not include a private right of action, but WA AG enforcement is a real risk for a documented commercial deployment that lacks notice and consent.

The 2023 My Health My Data Act (HB 1155) adds a separate consumer health data regime that reaches some biometric data when used in connection with a health condition. For a typical retail or office camera the MHMD reach is limited, but for clinic waiting rooms, pharmacy queues, and behavioral facilities the consent and contracting obligations can apply standalone where HIPAA does not. WA businesses using fingerprint or facial recognition document consent at enrollment, retention, and access controls, and revisit the MHMD analysis when the use case touches health context.

Privacy in the workplace

Washington has no single workplace electronic-monitoring statute that requires written notice for general video surveillance. Pure video surveillance of common work areas with posted notice is the routine pattern. Cameras in employee-only spaces with a reasonable expectation of privacy (restrooms, locker rooms, lactation rooms) are off-limits and create exposure under RCW 9A.44.115 voyeurism and the WA constitutional right to privacy.

Audio capture by an employer is regulated by RCW 9.73.030 (all-party consent) and RCW 19.375 when voiceprints are involved. Most WA employers issue a single workplace surveillance notice in the handbook covering cameras, badge access, computer monitoring, and call recording together. Out-of-state employee data rules (CCPA for California-resident remote workers, BIPA for Illinois-resident remote workers) can also reach WA-employed remote staff.

Cameras in production lines, retail floor, loading dock, and warehouse aisles are routine when paired with notice. Fingerprint or facial-recognition timeclocks are common in WA but trigger RCW 19.375 notice and consent obligations on every employee enrollment, with a documented retention schedule and a destruction process tied to separation.

Public-place and common-area cameras

For commercial real estate, multi-tenant residential, retail, and hospitality, the practical rule set is consistent. Cameras in lobbies, hallways, exterior, parking, retail floor, and other non-private common areas are lawful with posted notice. Cameras in bathrooms, dressing rooms, hotel guest rooms, and any other space where privacy is reasonably expected are off-limits and create exposure under RCW 9A.44.115.

Multi-tenant residential operators in Washington should review the bylaws and lease covenants. Hotel operators handle guest-room signage at the door and at the front desk and document any guest-area camera coverage in the property security plan. Audio in any common area is the high-risk variable: even in non-private spaces, ambient audio capture can sweep up private conversations and pull the install into RCW 9.73.030 territory. Seattle, Tacoma, Spokane, and Bellevue have additional municipal ordinances that can apply to alarm permits and certain license categories.

Video retention requirements

Washington has no single statewide video retention statute that applies to all commercial cameras. Retention is set by the regime that governs the industry.

  • Cannabis. WSLCB publishes camera coverage and retention rules for licensed producers, processors, and retailers under WAC Title 314. Pull the current WAC text before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility, longer when an investigation is open. The WA My Health My Data Act adds standalone obligations where HIPAA does not apply.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Banks and financial institutions. Federal banking regulators set surveillance and retention expectations through bank examination. WA Department of Financial Institutions supervises non-bank financial activity.
  • Schools. FERPA reach for K-12 districts and higher education. WA district board policies typically set 14 to 30 days retention.
  • Federal contractors and grantees. NDAA Section 889 controls vendor selection. Retention is contractor-driven through the SSP or grant award terms.

Default retention for WA commercial systems with no specific industry rule is 30 days. Operators in higher-risk industries set longer retention with explicit written retention policies in the WISP, facility security plan, or WSLCB SOP.

Notable enforcement examples

WA enforcement against businesses for camera, biometric, and data-handling issues runs through several channels. The Washington Attorney General has brought RCW 19.375 biometric and Consumer Protection Act actions against companies with documented capture or retention failures. The WA AG also publishes received RCW 19.255 breach notifications on a public dashboard, which makes WA one of the most-searchable states in the country for breach history.

Federal HIPAA settlements have reached WA-based defendants where physical safeguards (facility access control, camera coverage of PHI areas) were a documented part of the breach. PCI assessor findings have triggered card brand penalties at WA retailers where camera coverage of the cardholder data environment was inadequate or retention was below 90 days. Real settlements are searchable on the WA AG, HHS OCR, and WSLCB enforcement pages.

What Tec-Tel does to comply with Washington regulations

Tec-Tel installs across Washington for retail, manufacturing, healthcare, multi-tenant residential, financial, hospitality, and licensed cannabis customers. The default install pattern for a WA commercial site:

  • Video-only on cameras unless audio is documented with all-party consent under RCW 9.73.030.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, dressing rooms, hotel guest rooms, or any space prohibited by RCW 9A.44.115 voyeurism rules or where privacy is reasonably expected.
  • RCW 19.375 written notice and consent forms with a documented retention schedule for any biometric capture (fingerprint timeclocks, facial-recognition access, voiceprint authentication).
  • My Health My Data Act review for any deployment touching health-related context (clinics, pharmacies, behavioral facilities).
  • Retention configured to the regime that governs the industry (HIPAA, PCI, WSLCB, NDAA), with the facility's written retention policy attached.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific WA regulatory question, work with your privacy counsel.

Security service in Washington

Tec-Tel deploys AI-era security across Washington with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.