Law / Arizona

Arizona

age

Arizona requires commercial websites and apps where more than one third of content is sexual material harmful to minors to verify that users are 18 or older, effective September 2025, after Governor Hobbs vetoed a similar bill in 2024. A 2026 bill that would bar social media accounts for children under 14 without parental consent, require parental approval for 14 and 15 year olds, and add an anonymous verification option to the adult content law passed the House in March 2026. Its final disposition in the Senate could not be confirmed from an official source as of this writing.

privacy

Arizona has no comprehensive personal-data privacy law. The one 2026 attempt at an omnibus consumer privacy act, SB 1815, died in the Senate Rules Committee without a floor vote in either chamber and does not qualify as a marquee proposal under this topic's source-quality rules.

Arizona's operative privacy statute is a security-breach notification law, A.R.S. sections 18-551 to 18-552, which requires notice to affected residents within 45 days of a breach determination and, above a 1,000-resident threshold, notice to the Attorney General, the state Department of Homeland Security, and the largest nationwide consumer reporting agencies.

Biometric data generated to authenticate access to an online account is one of eleven data elements the statute treats as personal information for breach purposes, but the Act creates no capture-consent, retention, or destruction duty for biometric data, no data-subject rights of any kind, and no private right of action; enforcement runs exclusively through the Attorney General as an unlawful practice under the Arizona Consumer Fraud Act.

13 instruments named 3 researched in detail As of 2026-08-27

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Adult content age verification (AV)

HB2112, internet pornography, minors, age verification

cite Ariz. Rev. Stat. Title 18, Chapter 7 (§ 18-701 et seq.) stage RECENT in force 11 months effective 2025-09-26 source official Arizona Revised Statutes text (A.R.S. § 18-701), Arizona Legislature

Requires a commercial entity that knowingly publishes material of which more than one third is sexual material harmful to minors to use a reasonable age verification method, such as government issued identification or transactional data, to confirm a visitor is 18 or older, without retaining identifying information.

Note and primary source →

Breach notification

Arizona data breach notification law

cite A.R.S. secs. 18-551 to 18-552 stage IMMINENT commencement not set source official Arizona Revised Statutes text, Arizona State Legislature website

Arizona's breach-notification statute requires a person or entity that owns, maintains, or licenses unencrypted computerized personal information of an Arizona resident to notify the affected individual without unreasonable delay and no later than 45 days after determining a breach of system security occurred.

The duty runs to any 'person' that conducts business in the state, a term A.R.S. sec. 18-551(6) defines to include a government or governmental subdivision or agency alongside a natural person or business entity, with no exclusion for public bodies anywhere in sec. 18-552; this document had previously coded the duty private-only, which understated its reach.

If the breach affects more than 1,000 individuals, the person must also notify the three largest nationwide consumer reporting agencies, the Arizona Attorney General, and the director of the Arizona Department of Homeland Security. Notice may be delayed for an active law enforcement investigation, and no notice is required at all if a reasonable investigation determines there is no substantial risk of economic loss. GLBA- and HIPAA-regulated entities are exempt.

The statute creates no lawful-basis, purpose-limitation, or data-subject-rights framework for ordinary processing; it governs breach response only.

What it asks of an app →

Social media and minors

HB2991, social media, online content, minors

cite H.B. 2991, 57th Leg., 2nd Reg. Sess. (Arizona 2026) stage PROPOSED draft date not recorded source official engrossed bill text, Arizona State Legislature

Would bar social media platforms from allowing account creation for children under 14 without parental consent, require parental consent for 14 and 15 year old users, and require an anonymous age verification option for adult content sites.

Passed the Arizona House 44-6 on March 5, 2026; a Senate committee adopted a strike everything amendment and the bill cleared the Senate Rules Committee on April 7, 2026, but no final Senate floor vote or governor action was confirmed from an official source as of the as_of_date.

Note and primary source →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.