Washington's New Smart Lock Rental Law: 2027 Rules

Washington State has a new smart lock law for rentals, and it takes effect January 1, 2027. ESSB 5937, passed by state lawmakers in the 2026 session and signed as Chapter 55, Laws of 2026, requires landlords to offer any tenant who asks an alternative key that does not rely on biometrics or an app on the tenant's phone, to give tenants a plain-language privacy policy for the smart access system, and to collect only the minimum data needed to run it. Basic keypads where a tenant types in a code are excluded. The law amends RCW 59.18.030 and adds new sections to chapter 59.18 RCW, the Residential Landlord-Tenant Act, so it reaches ordinary rentals, not just large apartment buildings. Here is what the statute actually says, and what owners running smart locks can put in place before the effective date.

This is one of several 2026-session changes with a delayed start. Our roundup of Washington State rental law changes for 2026 covers the full picture; this guide goes deep on smart access alone.

What Is Washington's Smart Lock Rental Law?

The formal name is Engrossed Substitute Senate Bill 5937, "concerning the use of a smart access system in a residential property subject to the residential landlord-tenant act." It passed the Senate 49 to 0, the House 93 to 1, and was signed on March 16, 2026, becoming Chapter 55, Laws of 2026. The near-unanimous votes mark it as baseline privacy policy, not a partisan fight.

The law does three things:

• Guarantees an alternative key. A tenant who asks must be offered a way in that does not require biometrics or a phone app.
• Requires a written privacy policy. Tenants must receive a plain-language policy describing what the system collects and how the data is handled.
• Limits data collection. The system may only collect the minimum data needed to grant access, from a short statutory list.

Everything applies starting January 1, 2027.

Which Properties and Devices Are Covered?

The statute defines a smart access system as any system that uses electronic or computerized technology, such as a radio frequency identification card, a mobile phone application, biometric identifier information, or any other digital technology designed to gather information in order to grant entry to a building containing a dwelling unit, its elevators, its common areas, or to an individual dwelling unit.

In practice, that covers:

• App-based smart locks that open from a phone.
• Fob and card systems that use RFID or similar credentials.
• Biometric readers. The statute defines biometric identifier information as a retina or iris scan, fingerprint, voiceprint, or a scan of palm, hand, or face geometry.

Two things are expressly outside the definition:

• Manual code keypads. A method of entry that solely relies on a keypad or similar device where someone manually enters a coded sequence of numbers, letters, or both is not a smart access system.
• Entrance cameras that do not unlock anything. The definition of authentication data excludes video, audio, or camera systems that monitor entrances but do not grant entry.

The definitions are not limited to apartment towers. A smart access building is any building containing a dwelling unit that uses a smart access system. A single-family rental with one app-controlled deadbolt sits inside those definitions just as a 200-unit building does.

What Alternative Key Must Owners Offer?

Under the new section, if a tenant requests it, the landlord must offer an alternative key that does not use biometric identifier information or a software application operated on the tenant's mobile phone or other similar electronic device. The statute lists examples:

• A key fob
• A key card
• A physical key
• A method of entry that relies solely on manually entering a code on a keypad
• Another form of physical access

The takeaway for owners: after January 1, 2027, no Washington State tenant can be required to use their own phone or their own body to get into their home. The alternative does not have to be a brass key; a fob, card, or keypad code satisfies the statute, but the option has to exist when a tenant asks.

What Privacy Policy Does the Law Require?

The second new section is a disclosure duty with a deadline. The landlord of a smart access building, or their agent, must give tenants a written policy in plain language either at the initial signing of the lease or within five days of the smart access system being installed.

The landlord must also make available any written privacy policy from the company that developed or currently operates the system. Where that policy does not already cover it, the landlord's written policy must describe, at a minimum:

• What data the system collects, including the extent to which it collects information about a tenant's guests.
• The protocols and safeguards the landlord will use to protect that data.
• The retention schedule, meaning how long the data is kept.
• What happens after unauthorized access or disclosure, including how users are notified.
• Guidelines for permanently destroying, anonymizing, or removing data from the system.
• The process for adding a tenant who has given written consent on a temporary basis to the system.

There is a practical shortcut built into the statute. If the system developer's privacy policy already covers those items and the landlord does not retain or sell any information from the system, the landlord complies by providing the developer's policy or a link to the developer's website where the policy lives.

What Data Can a Smart Access System Collect?

The third new section is a data minimization rule. A landlord or third party may collect only the minimum authentication and reference data necessary to let the system do its job: granting access to the building, its elevators, its common areas, or the user's own home.

The statute then enumerates exactly what a smart access system may collect, generate, or use:

• The user's name
• The dwelling unit number and the doors and common areas the user can access
• The user's preferred method of contact
• Biometric identifier information, only if the system actually uses biometrics
• The identifier tied to the physical hardware, such as an RFID card number or bluetooth identifier
• Passwords, passcodes, usernames, and contact information used to grant entry or to manage the account tools for the building
• Lease information, including the move-in date and, if available, the move-out date
• The time and method of access, solely for security and operational purposes

If a data point is not on that list, the system is not supposed to collect it. Note the qualifier on the last item: entry logs exist for security and operations, not for general monitoring of how a resident lives.

How Does This Fit With Washington's Entry Notice Law?

The smart access law regulates how tenants get in. A separate statute regulates how owners get in, and ESSB 5937 does not change it.

Under RCW 59.18.150, a landlord must give at least two days' written notice before entering an occupied unit to inspect, make repairs, supply services, or show it, and at least one day's notice to exhibit the unit to prospective or actual purchasers or tenants. The notice has to state the exact date and time, or a window with the earliest and latest possible entry times, plus a phone number for objections or rescheduling. Emergencies are the exception; outside those rules there is no right of access without a court order, an arbitrator, or the tenant's consent.

A smart lock does not create a right of entry. Holding the credentials that open the door does not shorten the notice period or excuse the written notice. The entry statute governs when you may enter; the smart access law now governs what your lock system may know. Our guide to tenant notice for entry in Washington covers the notice mechanics in detail.

What Should Owners With Smart Locks Do Before January 1?

The statute itself defines the preparation list. An owner running smart access hardware needs answers to five questions before the effective date:

• Which of your devices are covered? App, fob, card, and biometric systems are in; a basic manual-code keypad is out. Inventory each door against the definition.
• What is your alternative key? Decide what you will hand a tenant who asks: a physical key, a fob, a card, or a keypad code. If your current lock supports none of those, that is a hardware conversation to have before January.
• Where is the developer's privacy policy? If it covers the required content and you do not retain or sell any system data, providing that policy or a link to it satisfies the disclosure duty.
• Do you retain or sell any of the data? If so, the shortcut closes and you need your own plain-language policy covering all six required items, delivered at lease signing or within five days of installation.
• What does the system actually collect? Anything beyond the statutory list, or any use of entry logs beyond security and operations, is out of step with the new sections.

This is information about what the statute requires, not legal advice; an owner with an unusual setup should run it past counsel before the effective date.

Common Questions About the Smart Access Law

Does the law apply to a single-family rental with one smart lock?

The definitions are not limited to apartment buildings. A smart access building is any building containing a dwelling unit that uses a smart access system, and the alternative key duty applies when a tenant requests one. A single-family home rented under the Residential Landlord-Tenant Act with an app-based or biometric lock falls within the statute, so the alternative key, privacy policy, and data limits all apply starting January 1, 2027.

Are keypad door codes covered by ESSB 5937?

No. The statute excludes methods of entry that solely rely on a keypad or similar device using the manual entry of a coded sequence of numbers, letters, or both. A basic keypad deadbolt is outside the law. If the same lock also grants entry through a phone app, a fingerprint reader, or an RFID credential, it is a smart access system and the rules apply.

Can a landlord require tenants to use a smartphone app for entry?

Not once the law takes effect, if the tenant objects. From January 1, 2027, a landlord must offer a requesting tenant an alternative key that does not use biometric identifier information or a software application on the tenant's phone. A key fob, key card, physical key, or manual keypad code each satisfies the requirement.

How Sagareus Handles Entry and Access

We never just drop by. Washington law requires proper written notice before entering an occupied home for an inspection, a repair, or a showing, and we treat that floor as the start, not the goal. Every entry is scheduled, confirmed in writing, and logged, even when a resident says "come anytime."

For a single home or condo, we ask first. A formal notice can feel like a demand, so we try to arrange access by agreement before we ever serve one. What that looks like:

• Reach out and schedule directly with the resident, offering real options and confirming a time.
• Document every attempt. If we cannot reach agreement after repeated tries, we serve proper written notice rather than force the issue.
• Respect the home. We explain why we are there, keep the visit brief, and never photograph personal belongings.

That discipline protects you. A documented, noticed, scheduled entry is what defeats a tenant claim later, and the respect behind it is exactly why residents cooperate when you need access.

Proper notice is not a hurdle. It is how we keep your access clean and your liability low.

Wondering what full-service management with Sagareus Property Management would cost for your rental? Our instant calculator gives you a real range in under a minute, no email required. Request your instant estimate.

Related Sagareus Services

• Property management for Washington owners
• Get an instant management estimate
• Washington State rental law changes for 2026