Washington compliance for lead-generation companies

Research steps and summary: I conducted targeted searches and scraped official Washington-state sources to collect statutes and Attorney General guidance relevant to lead-generation companies operating in or contacting Washington residents. I (1) located and retrieved the enacted text and bill materials for Engrossed Substitute House Bill 1497 (the Washington “mini-TCPA” / commercial telephone solicitation amendments), (2) gathered the Washington data breach notification statute (RCW Chapter 19.255) and related chapter material, and (3) collected the Washington Attorney General’s guidance page summarizing data-breach obligations and practical details for notices. These sources establish the state-specific telemarketing/telephone solicitation rules enacted in 2022, the state’s data breach timing and notice/content requirements, and the Attorney General’s enforcement role and resources. Key findings (high-level): - HB 1497 (enacted 2022, effective 6/9/2022) amends Washington telemarketing/telephone solicitation law (amending RCW 80.36.390, 19.158.040, and 19.158.110). It revises the definition of commercial telephone solicitation to focus on “person” (not just residential landlines), sets permissible calling hours, and adds new provisions including requiring the Attorney General to maintain a public web page about telephone solicitation laws and complaint procedures. (See bill and session law for full text and specifics.) - Washington’s data breach statute (RCW Chapter 19.255) requires businesses that own or license personal information to notify affected Washington residents “in the most expedient time possible” and no more than 30 calendar days after discovery, with limited exceptions for law-enforcement delays or necessary remediation time. If more than 500 Washington residents are affected, the business must also notify the Attorney General within 30 days and include specific content in the notice (types of information exposed, timeframe, steps taken, sample notice, etc.). The statute defines “personal information” broadly and specifies acceptable notice methods and required content. - The Washington Attorney General’s Office provides practical guidance and resources for data-breach notifications (including a breach notification web form) and enforces both the data breach statute and consumer-protection claims arising from telemarketing or lead-generation misconduct. Next steps (what I prepared the research to support): - Use these Washington-specific sources as the foundation for drafting comprehensive blog and newsletter content for U.S. business owners and LLC founders that operate lead-generation businesses or buy/sell leads involving Washington residents. The final content will: (a) explain Washington’s telemarketing/telephone solicitation requirements and relevant legislative changes (HB 1497); (b) explain consumer contact rules and how state law overlays federal TCPA/Do-Not-Call rules; (c) summarize Washington’s data-breach notice obligations (RCW 19.255) and practical steps for secure handling of leads and breach response; (d) flag industry-specific licensing (e.g., small-loan lead generation amendments to RCW 31.45) and other Washington licensing or disclosure rules where applicable; and (e) provide practical compliance checklists and links to the official sources for recordkeeping, consent capture, DNC management, breach response, and AG complaint reporting. I am ready to draft the Washington-focused blog post and newsletter (with citations and practical checklists) using these primary sources plus federal TCPA/FCC/FTC materials as the federal overlay. If you want, I can now: (A) produce the full blog post and newsletter copy, or (B) produce an outline + checklist first for review. Indicate your preferred next step.