Crawls the web, in Arizona

A.R.S. sec. 44-7601 · Read the law's page

• This binds any 'entity': a corporation, foreign corporation, unincorporated association, sole proprietorship, partnership, trust, estate, joint venture, limited liability company, or a government, governmental subdivision or agency, that discards or disposes of a paper record or document containing an individual's first and last name, or first initial and last name, combined with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number.
• Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.
• An entity subject to the Gramm-Leach-Bliley Act, a HIPAA covered entity or business associate, or an entity subject to the federal Fair Credit Reporting Act is exempt. An entity that maintains and complies with its own disposal procedures, consistent with this duty, is deemed compliant.
• A county attorney or the Attorney General may enforce this section, and a civil penalty applies per violation arising out of one incident: up to $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The statute states no private right of action of its own.

A.R.S. § 13-2316 · Read the law's page

• Do not access an Arizona-connected computer, computer system, or network without authority or in excess of your authorization; paragraph 8 criminalizes bare unauthorized access even without any intent to defraud, damage, or disrupt.
• Nothing in this statute's own text exempts ordinary, non-disruptive automated access to a publicly available page from the authorization requirement, and no Arizona case confirms how that access is treated in a scraping context.
• Do not design a crawler or bot to prevent a user from exiting a site or a connected location in order to compel the user's device to keep communicating with or displaying your service.
• Do not access a computer, computer system, or network operated by the state, a political subdivision, a health care provider, or a clinical laboratory to obtain information required by law to be kept confidential or records that are not public records.

A.R.S. § 13-2316.01 · Read the law's page

• Do not knowingly possess, traffic in, publish, or control another person's access device, a credential or similar means of reaching an account or system, without the consent of its issuer, owner, or authorized user and with intent to use or distribute it; this can reach obtaining or trading in login credentials used to collect data from behind a login wall.
• Possessing five or more unconsented access devices may itself support an inference of intent to use or distribute them.

A.R.S. § 13-2316.02 · Read the law's page

• Do not communicate, release, or publish proprietary or confidential security information, security-related measures, algorithms, or encryption devices specific to a particular computer, system, or network without that system's owner's or operator's authorization.
• Publishing a security warning or defect information that is not specific to a particular owner's or operator's system, sharing security information among that system's own authorized users, notifying an owner or operator of a perceived threat, or non-target-specific security research, development, or testing is exempt.
• Security research that discloses findings specific to a particular target's own system is not exempt merely because it arose from otherwise-lawful access or legitimate research.