More than 20 states have now passed the “Washington model” of privacy legislation. Washington state hasn’t. 

In the years since then-state Sen. Reuven Carlyle introduced the Washington State Privacy Act in 2019, the blueprint has been adopted across the country, mandating that companies get the consent of consumers before collecting sensitive personal data, and providing consumers with the right to correct and delete their details in those databases.

In its home state, the bill stalled in negotiations between the House and Senate two years in a row. Every year since, a comprehensive privacy bill has been introduced in the Washington state Legislature but has failed to pass. 

Washington state Attorney General Nick Brown released his office’s first data privacy report Aug. 14, calling on lawmakers to pass a privacy law that would limit how much personal information companies can collect and keep in the first place.

But that proposal will face the same hurdle that has blocked efforts to pass a state privacy law for seven years: a fight over whether consumers should be able to sue companies that violate it.

“The attorney general supports greater data privacy protections for Washingtonians,” said Mike Faulk, a spokesperson for the AG’s office. “In our experience, this has proven to be a difficult subject for the Legislature to build consensus on.”

Experts say the stakes are rising as AI systems train on personal data that often falls outside Washington’s existing privacy protections. Without a baseline privacy law, they say, lawmakers also have less to build on when they try to regulate AI itself. 

Rethinking privacy

AI has rendered some parts of the Washington model moot, while making others more necessary than ever, according to policy experts. 

As states have begun to pass the first AI regulations, one of the highest priorities has been the regulation of AI-based high-risk decisions.

In Washington, for example, the state Legislature passed the Prior Authorization Transparency Act, which bars health insurers from using AI as the only basis to deny, delay or modify care. Washington state lawmakers also considered a bill to regulate the use of AI to make decisions of financial, educational, or legal consequence.

This is proving to be a much easier lift in states that passed the “Washington model,” often years before the current AI craze. That’s because Carlyle’s bill happened to include what’s now known as an automated decision-making technology (ADMT) opt-out clause, which granted residents the right to opt out of automated profiling when used for “legal or similarly significant effects.” 

Algorithmic wage and price determinations, as well as AI-based healthcare and employment technologies, could be regulated under the pre-existing privacy act, or by tweaking those laws.

“The states that have passed automated decision making laws have done so on top of existing privacy laws,” said Cobun Zweifel-Keegan, a managing director at the International Association of Privacy Professionals (IAPP). “There’s already restrictions, or at least the beginnings of restrictions, on automated decision making baked into these privacy laws. It’s a natural model to build on top of.”

Meanwhile, AI has made it more dangerous to go without a privacy law, because an absence of privacy legislation means more personal data online for AI models to access, said Kara Williams, counsel at the Electronic Privacy Information Center.

Williams said data minimization could prevent or limit companies from repurposing personal data to train AI systems. 

“It goes back to using the data for the purpose you collected it for,” Williams said. “Almost all of the data that companies have used to train AI systems or develop the algorithms that led to this moment were not collected for the purpose of training AI systems.”

Data minimization requires companies to restrict the collection and use of customer data to the service the customer requested. That often precludes secondary uses like selling it to a data broker.

The Washington attorney general’s privacy report also endorsed a data minimization standard, which the original Washington model does not include.

Carlyle said he might have written one in, if he were drafting the bill today.

“We live in an AI world with a giant vacuum in the sky, sucking up every ounce of data that exists on a person,” Carlyle said. “So I think the concept [of data minimization] makes some sense.” 

Meanwhile, experts say AI makes some elements of the Washington model irrelevant. 

Zweifel-Keegan of IAPP said those elements include the right to control, correct, and delete personal data, which was the bread and butter of Carlyle’s bill. Because LLMs are a weighted map of associated words, there is no straightforward way to selectively delete or change information once a model has been trained.  

“That’s just fundamentally how LLMs work. They’re not a table where you can go to my name and see all the other records that are associated with me,” Zweifel-Keegan said. “You can’t go in and selectively delete information.”

While states around the country that have passed the Washington model are now seeking to revise its provisions to meet the AI moment, Washington state has no comprehensive privacy law to start with.

“AI is making us rethink some of our foundational expectations of what a privacy law does,” Zweifel-Keegan said. “Washington could be the place where that happens.”

The story of the “Washington model”

In 2019, when now-retired State Sen. Carlyle introduced the Washington State Privacy Act, it passed the Senate 46-1 before dying in the House. One year later, it passed both chambers but died after a long and heated fight in conference.

Some say the bill didn’t deserve to pass after being “rewritten” by tech lobbyists. Others say the lawmakers who opposed the bill let the perfect be the enemy of the good. 

The original bill was based on an opt-out framework, also called “notice and consent,” which required a platform to present a privacy policy to users who consent to the collection of their data by continuing to use the platform. The bill’s sole enforcement mechanism was the state attorney general, and did not offer a private right of action for individuals to sue companies that violated the proposed rules. 

In 2019, Carlyle was focused on establishing a baseline notion of consumer rights — one that could be revised later, as other states ultimately did.

“At that time we didn’t have a direct understanding that consumers have a right to correct or delete their personal data, we didn’t have an understanding of what opt out meant for advertising, or an understanding of data brokers and the role that they play,” Carlyle said.  

His bill also established special protections for sensitive data and frameworks to hold corporations accountable for complying with transparency and disclosure requirements. 

“Those were pretty novel pillars that didn’t exist,” Carlyle said. “That’s why it had a big effect on other state laws.” 

By March 2021, Virginia had passed a privacy law closely modeled off of Carlyle’s template, and over the next few years, more than 20 other states did, too.

In Washington, meanwhile, no progress was made. After Microsoft endorsed the Senate bill in 2019, consumer advocacy groups and some state lawmakers said that the tech lobby’s influence had gone too far. The state House countered with a stronger privacy bill, premised on opt-in data collection frameworks and enforced by a private right of action.

Both the 2019 and 2020 legislative sessions ended in failed negotiations between the state Senate and House over their competing privacy laws. Every year since 2021, Rep. Shelley Kloba has introduced a bill that preserves the House’s stronger language. It has yet to make it to the House floor. 

A potential compromise

The sticking point for Washington negotiators in 2019 and 2020 was the enforcement mechanism. Carlyle’s bill proposed state attorney general enforcement, while the House bill, led primarily by then-Rep. Zack Hudgins, included an additional private right of action.  

Consumer advocacy groups are firm in their support for a private right of action as part of a data privacy law. 

“Attorney general enforcement alone is not sufficient to enforce privacy laws, just because of limited resources and staff and funding that attorneys general across the country face,” said Williams, the EPIC counsel. “We need a stronger enforcement mechanism, like a private right of action, that would allow consumers to vindicate their own privacy rights and to take companies to court who have violated their privacy rights.” 

For some in the tech industry, a private right of action is seen as unnecessarily harsh, stymieing innovation while AG enforcement would have sufficiently guaranteed compliance. 

“I believe that the difference is, are you looking to get companies to comply and have clear enforcement or are you looking to punish?” said Rose Feliciano, TechNet executive director of policy for the Northwest United States. TechNet is a trade association that includes tech industry giants such as Amazon and Google.

Carlyle agreed, saying his efforts failed because the trial attorneys “were not enthusiastic about giving up a right of private action against big tech.” The insistence on letting individuals sue, he said, is a case of “perfect is the enemy of the good.” 

“It’s the ultimate representation of, ‘we can’t have any regulation, any policy framework, any guidelines, any protections whatsoever, unless it’s a grand slam home run for individual lawsuits,'” he said.

The private right of action has continued to hold up privacy legislation.

Rep. Kloba’s alternative, the People’s Privacy Act, ties enforcement to the state’s Consumer Protection Act, under which a plaintiff’s private action can seek damages, attorney’s fees, and treble damages capped at $25,000. Her bill treats all violations, including failure to comply with records keeping and timely responses to consumer queries, with the same severity.

This winter, Kloba may be open to changing that. She said she’s willing to consider separating enforcement rules so that some violations would be eligible for a private right of action and others would be subject to civil penalties enforced by the attorney general’s office. 

“Over the last eight years, various laws have been put in place in different states and we’ve seen them then go back and improve them over time,” she said, “and so I think it’s time to have that conversation.”

GeekWire is profiling over the next few weeks some of the people and teams that are shaping the evolution of Microsoft in what we’re calling its “Microsoft 2.5” era.

The Copilot Super App cat is only partially out of the bag. Sometime in the coming weeks, Microsoft will launch its entry into the AI “super app” space, company officials have said. But Microsoft hasn’t talked much about what the coming Copilot Super App will include beyond a few of the top-level experiences that are meant to unify and organize consumer and business users’ access to key Microsoft AI properties.

Executive Vice President Charles Lamanna is part of the inner circle known as the Copilot Leadership Team that is spearheading the Super App effort. He also oversees building out and securing the back-end services that will power the Copilot Super App.

As head of Copilot, Agents, and Platform, Lamanna has a lot of responsibility for someone who has been with Microsoft for “only” 13.5 years. He has actually been with the company a bit longer than that, as he has done three tours at Microsoft: He first interned for Windows Live OneCare, then returned in 2009 to work on message-filtering services. He rejoined Microsoft when it bought his cloud performance-management startup MetricsHub Inc. in 2013. He worked as an engineering manager on Azure, then ran the Power Platform and Dynamics 365 teams, before assuming his current role in March 2026.

Lamanna says he emphasizes three things with his team: Be customer-obsessed; get things done by having a “total ownership mindset”; and be kind, not jerks.

Every six months, he writes a “State of the Business” paper for the team, in which he outlines their priorities. In addition to focusing on changing how people work — from tooling, technology, budgeting and organization perspectives — he emphasizes the importance of keeping “the crown jewels” of Office and Microsoft 365 up, reliable and secure.

“There’s going to be a massive surge of demand on the back end (Microsoft 365) because of agents. They’re nonstop,” said Lamanna during GeekWire‘s interview with him this week.

While the Super App itself will likely be free (like the Copilot App today), the services it exposes will likely not. The company has been moving toward usage-based pricing with its AI products, the way it already has with GitHub Copilot and Microsoft 365 Cowork. That kind of model makes sense for the company in a world where always-on agents, not the number of users, drive a lot of the demand.

He also said his team needs to be at the frontier for AI products. “We need to have AI startup and lab characteristics but with Microsoft sensibilities,” he said.

Lamanna made a similar case publicly this week, asserting in a LinkedIn post that “the most important thing my team will do this year won’t be any single product or feature we ship” but rather changing how the team works.

Reining in the Copilot-Palooza. Despite the rise of agents and all things “agentic,” Copilot is still Microsoft’s top priority, Lamanna said. Microsoft’s goal is for Copilot to be a truly personal AI assistant that will know how you work, the apps you use, the processes and workflows that matter to you, and more.

“We had some missteps because we fragmented,” he acknowledged. “It’s like we had a consumer Copilot and we have like a commercial Copilot and we have GitHub Copilot and yeah — ‘Copilot Palooza’ is what I call it internally.”

This is where the coming Copilot Super App fits in. Microsoft wants it to be a single destination that brings the key Copilots together on the work and home fronts.

He said to think of the Super App “almost like a browser or an operating system.” In the same way a browser might have a bunch of different tabs, or Windows a bunch of different apps, the Super App will be the home for Code, Chat, Cowork and Autopilots, or always-on agents. Microsoft is expecting that users still will go directly to apps when needed, but it’s working to make Copilot the first app people boot into and live in, similar to the way many do today with Outlook or Teams, he said.

Microsoft’s goal is to wire into the Super App even more of its core franchises over time. Dynamics 365, its CRM and ERP offerings, are morphing into a set of agents that connect to Dynamics Model Context Protocol (MCP) servers, which connect AI models to back-end data. The plan is to integrate those Dynamics agents into the Super App.

The company also is in the midst of integrating the Dataverse storage and management platform that underlies its Power Platform and Dynamics directly with Copilot. That capability, in testing now, would give users a more streamlined way to query data stored in their ERP and CRM systems from inside Copilot.

Rethinking the ‘headless’ approach. With Microsoft looking to make the Super App its new front-end user experience, what happens to Office? Its competitors like Salesforce and SAP are moving toward the idea of a “headless” approach, meaning customers would access the backend CRM or Commerce data via agents, rather than traditional desktop apps.

Lamanna said he’s not a fan of the “headless” term, as it implies “it’s dumb.” He also said you can’t simply connect an AI model to a programming interface built 10 years ago without working through how to optimize for cost, performance, and retrieval.

He said the Microsoft IQ suite of intelligence layers is the key here. Work IQ analyzes emails, chats, meetings and usage patterns and preferences so Copilot and agents can make context-aware suggestions. Fabric IQ is a similar layer for Microsoft’s data platform.

Work IQ is becoming like the headless version of Microsoft 365, Lamanna said. That means users can get to their email, docs, and files without having to use applications like SharePoint or Outlook in between. Work IQ becomes a kind of in-the-background version of Microsoft 365, and the Super App automatically invokes whichever IQ/service/backend is needed.

“Copilot can navigate to these IQs as needed. For email, go to Work IQ. Info inside Dynamics 365, go to the MCP servers that it publishes. Data from Salesforce or ServiceNow, we have connectors. But you stay in the Super App,” Lamanna explained.

If Microsoft is no longer the Windows company or the Office company, what is it going to be when it grows up?

“We want to be the Copilot company,” said Lamanna without hesitation. “Copilot with the Super App is the front door to basically everything, from Dynamics, to GitHub, to Exchange, to SharePoint, to OneDrive, to other services I don’t even remember.”

Alongside that, Microsoft will continue to be an infrastructure company, he added, focusing on tokens, compute and storage.

“Those are probably the two most interesting businesses in technology for the next 10 years.”

The fourth annual Seattle Tech Week got off to a big start Monday, with panels and parties bringing together thousands of people from across the region and out of state. Organizers said the week features more than 250 events and drew more than 29,000 event registrations.

We went to Madrona’s kickoff event at Picklewood Paddle Club with one question for the founders, investors, and operators we met: What are you building? Here’s what we heard and learned.

Jagan Nemani

What he’s building: An AI system that runs a professional cricket franchise — flights, hotels, ground transportation, and daily schedules for players and staff, all handled over WhatsApp.

Nemani is chief product officer of the Seattle Orcas, the Major League Cricket team now in its fourth season. For the first three, he ran team operations the old-fashioned way: “I ran the entire operations using spreadsheets and people and processes,” he said. That meant tracking a constant stream of inbound flights, hotel blocks and car bookings across a season.

This year, he used Claude Code to build the backend for an AI agent that took over roughly 80% of the operation: booking flights, hotels and cars, dealing directly with hotels and transportation vendors, and telling players and staff when their flight lands, which hotel they’re in, and who’s picking them up. It also handles daily schedules, down to massage appointments.

To accommodate players and staff who were reluctant to adopt new tech tools, he built it to run on WhatsApp, the messaging app they already used every day.

Kim Vu

What she’s building: A B2B tool that lets thrift, vintage, and consignment resellers photograph an item and get back the identification, pricing, and listing details they now assemble by hand.

Vu is founder and CEO of StyleOrigin. Getting a single secondhand garment listed for sale is still manual work that takes 30 to 45 minutes an item, she said. With StyleOrigin, a reseller takes one image and an AI analysis returns what they need to list and price it. The company also gives sellers data to guide inventory decisions.

She found the problem herself. Vu ran environmental, social and governance work at Remitly until she stepped down in 2023, then took a year off and started selling vintage clothing. She assumed she was slow because she was new to it. “But turns out everybody does it the same, and so there wasn’t really any good solution out there.”

She taught herself to code and built the first version of the product. StyleOrigin has a working MVP but no revenue yet. More than 70 stores around the country are on a waitlist, and Vu is about to bring her first engineer aboard.

Kenny Daniel

What he’s building: Tools for collecting, storing, and analyzing the data AI systems produce — the record of what agents actually did, not just the code they shipped.

Daniel is founder of Hyperparam, an early-stage Seattle startup, and previously co-founded Algorithmia, the Seattle machine learning company acquired by DataRobot in 2021.

Companies are spending heavily on AI without much sense of what they’re getting, he said. “AI is producing this wall of tokens. Companies are paying huge amounts of money to generate all these tokens, but they have really no visibility into what are these agents doing.”

Every token leaves a trail, and Daniel said most companies ignore it. Mining it would show them where AI is working and where it’s wasting money.

“Where are models being stupid? Where are they going down rabbit holes?” Older analytics tools can’t help, he said, because they were built for numbers and clicks: “People haven’t really been thinking about what do you do when the majority of the data being produced in the world is text.”

Cleo Escarez

What she’s building: An urban mine — recovering precious metals from jewelry and returning them to the supply chain for clean technology.

Escarez is founder of Redyoos, which GeekWire featured in Startup Radar last year. The jewelry industry accounts for 40% to 50% of the global supply of precious metals, she said — the same materials found in “anything that has an on and off button,” from cell phones to wiring.

Demand for those metals is climbing with AI and clean energy, and Escarez said projections point to a supply shortfall of 700% over the next couple of decades. “We mathematically cannot solve this deficit,” she said, which is why she sees jewelry as a viable source.

Redyoos collects jewelry, refines what contains precious metals, and sells the recovered material to clean-tech manufacturers.

Escarez, a former chief operating officer at Boma Silver Jewelry and brand manager at Starbucks, has bootstrapped the company, which has been live a little over a year and is generating revenue. She is now raising a pre-seed round.

Andy Liu

What he’s building: An engineering team inside a venture capital firm, automating the work of investing.

Liu is a partner at Unlock Venture Partners, which he helped launch in 2018 to back early-stage startups in Seattle and Los Angeles, and which raised a $60 million second fund in 2022. A longtime Seattle entrepreneur and angel investor with stakes in close to 100 companies, he was previously CEO of BuddyTV, acquired by Vizio, and of NetConversions, acquired by aQuantive.

“We actually have an engineering team that’s trying to automate a lot of what we do in VC,” Liu said, “and trying to make sure we can scale our business just like our own portfolio companies.”

The work covers deal memos and diligence on prospective investments, along with the mechanics of dealing with the firm’s own investors and collecting updates from portfolio companies.

The point, he said, is better decisions: “How do we get smarter as VCs?”

Mary Jesse

What she’s building: Private AI — letting people own their own data and context, use any large language model, and not be tracked or trained on.

Jesse is co-founder and CEO of ACME Brains, whose first product, nexie, is in beta. GeekWire wrote about the origins of the company last year: after her husband passed away, she turned to ChatGPT and found real comfort in it, then ran into its limits — it couldn’t carry the context of their conversations, and she had concerns about the privacy of what she was telling it.

nexie keeps a user’s notes, journals, and conversations in what the company calls a personal context engine, and carries that context across AI services instead of leaving it scattered in separate chat histories.

Trading privacy for free services goes back to the early internet, she said, but AI tilts the exchange further. A chatbot draws information out of a person in conversation, then combines it with everything already known about them. “AIs can talk you into your data,” she said.

An electrical engineer with more than two dozen patents who spent decades in wireless at McCaw Cellular and AT&T Wireless, Jesse said most people don’t grasp how AI actually behaves, which leaves them exposed — seniors especially. “You need people that understand it to help protect people that don’t.” Her co-founders are Alan Caplan, Amazon’s original general counsel, and patent attorney and engineer Bob Bergstrom.

Emily Rapp

What she’s building: Voice AI that lets bar and restaurant staff count inventory out loud instead of writing it down by hand.

Rapp is founder and CEO of Köniva. A typical hotel resort bar spends 12 hours and four people on an inventory count, she said; with Köniva it’s two people and 3-and-a-half hours, and more accurate. Staff download an app and wear a lapel mic — you want both hands free on a ladder — and count out loud the way they always have.

She came to the problem after a career in big tech and ad tech. Not wanting to build for an industry she’d never worked in, she took a part-time job at Canlis after training as a sommelier.

When she was injured, the wine director let her help with inventory reconciliation and handed her a clipboard of handwritten numbers plus a login to the restaurant’s inventory software. She asked why they were still using paper and pencil when a whole engineering team had built software for the job. The wine director’s answer: it was faster.

Köniva has 10 customers. At several high-end hotels and restaurants, Rapp said, staff put the app on their personal credit cards to start using it, then helped her pitch their own procurement departments — an unusual path in an industry she said has been badly burned by technology.

“It is insane how bad tech has been to them,” she said.

Henry Arias

What he’s building: A growth equity firm investing at the intersection of food brands and food tech.

Arias is founder and managing partner of Altelan Capital, a Seattle firm he started last year. It underwrites companies around the Series A stage, generally, providing growth capital and strategic support.

He came up in the industry itself, leading finance at restaurants and breweries and most recently running corporate development and financial planning for Seattle Hospitality Group. That operator lens, he said, is what he brings to investments and to coaching founders on growth. He has been an investor since 2015.

Arias calls Altelan an AI-native investment fund, using AI tools to get up to speed on an industry and test assumptions about a business’s ability to scale and where the risks are. He’s equally interested in where the technology doesn’t belong and simplicity is the better option: “AI is great, but it may not be the right tool for the job.”

The bigger shift he’s watching is food and digitization. The industry has traditionally worked off “the proverbial clipboard and a notepad,” he said, and the pandemic accelerated the move to technology across the supply chain. “There are many applications of tech in food,” he said, “and that’s what keeps us up and gets us excited every day.”