Law / United States / 
Arizona
HB2112, internet pornography, minors, age verification
Ariz. Rev. Stat. Title 18, Chapter 7 (§ 18-701 et seq.)
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to a commercial entity that knowingly publishes material of which more than one third is sexual material harmful to minors, including commercial websites and apps and social media platforms that meet that share.
- Use a reasonable age verification method, such as government issued identification or transactional data, to confirm a visitor is 18 or older.no control in the NIST Privacy Framework
- Do not retain identifying information.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Civil liability of up to $10,000 per day of violation and $10,000 per instance of unlawful retention or transmission of identifying information, plus up to an additional $250,000 if a minor accesses the material; a successful plaintiff may recover attorney fees and costs.
Statutory damages
Court-awarded civil penalty under A.R.S. 18-701(F)-(G), available only in a private right of action (the parent or guardian of an affected minor, or a person whose identifying information was retained or transmitted); there is no Attorney General enforcement of this section. The court may award NOT MORE THAN the total of $10,000 per day the entity operates the website in violation of the age-verification requirement plus $10,000 per instance of unlawful retention or transmission of identifying information, plus an additional amount of not more than $250,000 if a minor accessed the material because of the violation; the statute states no guaranteed minimum recovery. The court sets the amount within these caps based on statutory factors (seriousness, history of prior violations, deterrent effect, economic effect on the entity, and the entity's knowledge). A successful plaintiff also recovers reasonable attorney fees and costs.
- As of
- Currency
- USD
Who enforces it
Enforcement body
Exclusively private civil actions by a parent or guardian of a minor who accesses the material, or by a person whose identifying information was retained or transmitted; no Attorney General enforcement.
Settledness
- As of
- Open questions
- Is the one-third share of material under A.R.S. 18-701(A) measured across everything on a social media platform, including user posts, by number of items, running time or views, or only across material the entity itself publishes?
- Does subsection B, which requires an individual to provide digital identification or to comply with a commercial age verification system, make those the only 'reasonable age verification methods' that satisfy subsection A?
What it reaches
Age threshold
18
Covered services
Commercial websites and apps, including social media platforms, where more than one third of content is sexual material harmful to minors.
Obligation class
Age verification, Retention
Verification methods
Gov ID, Digital ID, Transactional data, Third party service
Applicability criteria
Subsection A attaches the age verification duty to a commercial entity that publishes or distributes such material on a website of which more than one-third is sexual material that is harmful to minors, including a social media platform.
- As of
- Combinator
- All of
- Criteria
- knowingly and intentionally publishes or distributes material on an internet website, including a social media platform, of which more than one-third is sexual material that is harmful to minors
What it makes you log
Log retention
The statute states no period; it bars keeping the identifying information at all.
- As of
- Basis
- Unspecified
- Prohibits retaining
- any identifying information of the individual, held by the commercial entity or by a third-party entity that performs the age verification
Logging duty
Section 18-701 requires a commercial entity to use reasonable age verification methods and names no log, record or audit trail of the check. Subsection C goes the other way: the entity and any third-party verifier may not retain identifying information.
- Kind
- None
- As of
What this law does
Requires a commercial entity that knowingly publishes sexual material harmful to minors on a website whose share of such material meets the applicability criteria, to use a reasonable age verification method, such as government issued identification or transactional data, to confirm a visitor is 18 or older, without retaining identifying information.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .