Arizona

Arizona has no general-purpose AI-transparency or algorithmic-accountability statute of broad application. Five narrower measures are in force.

A.R.S. § 16-1023 creates a private declaratory and injunctive cause of action for any Arizona resident depicted in a non-consensual, undisclosed digital impersonation (a deepfake using deep generative AI methods), with an expedited preliminary-relief track for election candidates and other specified categories; enacted as an emergency measure effective May 21, 2024, with the section applying fourteen days after that date.

A.R.S. § 16-1024, enacted eight days later in the same legislative session, separately requires a person distributing synthetic media depicting a candidate within ninety days of an election to disclose that the content was AI-generated, backed by a civil penalty under A.R.S. § 16-937(B), with exemptions for satire, parody, and interactive computer services.

A.R.S. § 20-3103, in force with the codified section's own effective date of July 1, 2026, bars a health care insurer from denying a claim on medical-necessity grounds without an individualized review by a medical director exercising independent judgment; the statute's own text and the Legislature's own fact sheet for the enacting bill describe this duty in technology-neutral terms and do not themselves use the term artificial intelligence, though contemporaneous news coverage of the bill's passage frames it as a response to insurers' use of AI and algorithmic tools in claims review.

Two 2025 amendments extend Title 13's sexual-offense definitions to reach AI-generated content: HB 2678 (2025 Ariz. Sess. Laws ch. 174) amends A.R.S. §§ 13-3551 and 13-705 so that a computer-generated or digitally altered image indistinguishable from an actual minor is treated the same as an image of a real child, exposing a person who produces, distributes, or possesses such a depiction to the class 2 felony liability Title 13, chapter 35.1 imposes for child exploitation, enhanced under § 13-705 where the depicted minor is under fifteen; and SB 1462 (2025 Ariz. Sess. Laws ch. 106) amends A.R.S. § 13-1425 to add a 'realistic pictorial representation' (an AI-generated or digitally altered image reasonably appearing to be an actual, non-consensual intimate depiction of a person) to the statute's unlawful-disclosure prohibition, though disclosing that kind of synthetic image is itself classified only as a class 1 misdemeanor, a lower tier than the class 5 or class 4 felony that applies to disclosure of a genuine image.

Outside these enacted measures, the Arizona Consumer Fraud Act, A.R.S. §§ 44-1521 to 44-1534, is a general deceptive-practices statute; it names no AI system and creates no AI-specific duty. The Arizona Department of Administration's Statewide Policy P2000 (rev. October 24, 2024) is an executive-branch policy, not a statute, governing state agencies' own use of generative AI tools; it binds no private person and creates no enforceable right.

A general-purpose conversational-AI chatbot disclosure and safety bill, HB 2311 (2026), passed both chambers but was vetoed by Governor Hobbs on June 19, 2026; a companion-privilege bill, HB 2410 (2026), died in Senate committee; and a content-provenance bill, SB 1786 (2026), did not pass. None of the three is in force.

Arizona has no comprehensive personal-data privacy law. The one 2026 attempt at an omnibus consumer privacy act, SB 1815, died in the Senate Rules Committee without a floor vote in either chamber and does not qualify as a marquee proposal under this topic's source-quality rules.

Arizona's operative privacy statute is a security-breach notification law, A.R.S. sections 18-551 to 18-552, which requires notice to affected residents within 45 days of a breach determination and, above a 1,000-resident threshold, notice to the Attorney General, the state Department of Homeland Security, and the largest nationwide consumer reporting agencies.

Biometric data generated to authenticate access to an online account is one of eleven data elements the statute treats as personal information for breach purposes, but the Act creates no capture-consent, retention, or destruction duty for biometric data, no data-subject rights of any kind, and no private right of action; enforcement runs exclusively through the Attorney General as an unlawful practice under the Arizona Consumer Fraud Act.

Arizona's computer-crime scheme, A.R.S. §§ 13-2316 to 13-2316.02, departs from a narrow malicious-intent-only test in the opposite direction from a peer state such as Virginia: alongside intent-based paragraphs for fraud, damage, or disruption, section 13-2316(A)(8) separately criminalizes knowingly accessing a computer, computer system, network, software, program, or data without authority or in excess of authorization, with no further intent element required, making bare unauthorized access a class 6 felony standing on its own.

Nothing in the statute's text carves out ordinary, non-disruptive automated access to a publicly available page. Two companion sections reach trafficking in access devices (credentials) and disclosing a specific system's own confidential security information. Arizona has no comprehensive consumer privacy statute reaching scraped public personal data at the state level; its only enacted privacy measure is a security-breach notification law, covered under the privacy topic, not restated here.

Terms-of-service enforceability rests on ordinary Arizona contract law, with no statutory modification located. Copyright, text-and-data-mining, database rights, unfair competition, and robots.txt's legal weight raise only the federal and common-law questions the national document already covers; Arizona adds no state-specific statute on any of them.

No reported Arizona case applying section 13-2316 or its companion sections to an automated web-scraping or bulk-data-collection fact pattern was located.

Arizona's private-sector security-topic footprint is narrow: one enacted state statute imposes a genuine disposal duty on paper records, no enacted state law sets market-entry security requirements for a connected device or software product, no state law creates a general private-sector duty to report a vulnerability or a security incident to an authority, and the one sector regime located binds a role this profile's activity vocabulary cannot express.

A.R.S. section 44-7601 (Title 44, Trade and Commerce, Chapter 33), in effect by at least 2005 (the earliest year for which a copy of this section could be located; the current statute text carries no enactment-date annotation of its own), requires an 'entity,' defined broadly to include a corporation, unincorporated association, sole proprietorship, partnership, trust, and a government, governmental subdivision or agency, to redact or destroy a paper record or document before discarding or disposing of it if the record or document combines an individual's first and last name, or first initial and last name, with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number; the duty reaches paper records and documents only, states no parallel duty over electronic data, and exempts an entity already regulated under the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act (HIPAA), or the federal Fair Credit Reporting Act.

Arizona's Administrative Code, Title 20, Chapter 6, Article 21 (R20-6-2101 through R20-6-2104, adopted in 2004 under the older NAIC Standards for Safeguarding Customer Information model, distinct from and narrower than the newer NAIC Insurance Data Security Model Law), requires a 'licensee,' an insurance institution, insurance producer, or insurance support organization, to implement a comprehensive written customer information security program with administrative, technical and physical safeguards appropriate to the licensee's size and complexity; because it binds only an insurance licensee, a bound-party class no activity in the LexLint vocabulary expresses, and because it carries no duty to report a cybersecurity event to the Insurance Commissioner or to affected consumers, unlike a jurisdiction that has adopted the newer NAIC model law, it is recorded here rather than flagged on a guess or filed as an instrument.

A.R.S. section 15-1046(C)(1) requires an 'operator' of an internet website, online service, online application or mobile application used primarily for school purposes and marketed for school purposes to implement and maintain reasonable security procedures and practices appropriate to the nature of covered student information; that duty is one subsection of Arizona's comprehensive student-data-privacy statute, whose other subsections restrict targeted advertising, profiling and the sale of student data and impose deletion and privacy-policy-notice duties, so the security clause belongs to the privacy topic in the same way the General Data Protection Regulation's Article 32 and the Texas Data Privacy and Security Act's section 541.101(a)(2) do, and it is not yet researched under either topic as of this visit; it is named here rather than duplicated as a security-topic row.

A.R.S. section 13-2316.02, which makes it a felony to communicate, release or publish proprietary or confidential computer security information about a particular computer, computer system or network without its owner's or operator's authorization, binds any person who releases such information about another's system rather than the system's own operator or manufacturer, so it sits with the state's computer-tampering chapter (A.R.S. section 13-2316 and its offense-by-an-intruder siblings) in the scraping topic's computer_misuse family rather than here.

No enacted Arizona statute was located that sets security requirements a connected device or software product must meet before or after it reaches the market, comparable to California's or Oregon's connected-device statutes or the Cyber Resilience Act, or that creates a general private-sector duty to report an exploited vulnerability or a security incident to a state authority; both are researched absences rather than gaps in coverage.

A.R.S. section 44-7601 is enforced by a county attorney in the county where records were wrongfully discarded or disposed, or by the Attorney General, with a civil penalty per violation arising from one incident that rises with each violation (up to $500 for a first violation, $1,000 for a second, and $5,000 for a third or subsequent violation) and no private right of action; no published enforcement record for it is confirmed in the primary text consulted here.

Arizona's breach-notification duty, A.R.S. section 18-552, is already this jurisdiction's privacy row rather than repeated here.

Arizona requires commercial websites and apps where more than one third of content is sexual material harmful to minors to verify that users are 18 or older, effective September 2025, after Governor Hobbs vetoed a similar bill in 2024.

A 2026 bill that would have barred social media accounts for children under 14 without parental consent, required parental approval for 14 and 15 year olds, and added an anonymous verification option to the adult content law passed the House in March 2026 and cleared two Senate committees, but never received a Senate third reading, and it died when the 57th Legislature's second regular session adjourned Sine Die on June 13, 2026 without the bill ever being chaptered.