Arizona

Arizona's chapter on sexual exploitation of children defines 'visual depiction' to include an image created or modified by computer software, artificial intelligence, or other digital editing tools. It defines 'minor' to include a visual depiction that is 'indistinguishable' from an actual minor. 'Indistinguishable' means a visual depiction such that a person viewing it would reasonably conclude it is of an actual minor.

Commercial sexual exploitation of a minor under A.R.S. § 13-3552 is a class 2 felony. Sexual exploitation of a minor under A.R.S. § 13-3553 is also a class 2 felony. Where the depicted minor, including an indistinguishable AI-generated depiction, is under fifteen years of age, A.R.S. § 13-705 reclassifies the offense as a dangerous crime against children in the first degree.

A first offense of commercial sexual exploitation of a minor under that reclassification carries a sentencing range of thirteen to twenty-seven years. A first offense of sexual exploitation of a minor under that reclassification carries a sentencing range of ten to twenty-four years. This measure was enacted as House Bill 2678 and approved by the Governor on May 12, 2025, as 2025 Arizona Session Laws chapter 174, which carries no effective-date section or emergency clause of its own.

The Arizona Legislature's own General Effective Dates page states the 2025 First Regular Session's general effective date as September 26, 2025.

Arizona's unlawful-disclosure-of-intimate-images statute defines a 'realistic pictorial representation' as an image created or modified to reasonably appear to be an actual image of an identifiable person depicted in a state of nudity or engaged in specific sexual activities that did not actually occur.

Intentionally disclosing an identifiable person's realistic pictorial representation, where the person has a reasonable expectation of privacy and the disclosure is made with intent to harm, harass, intimidate, threaten, or coerce them, is a class 1 misdemeanor. That is a lower tier than the class 5 felony, or class 4 felony if disclosed by electronic means, that applies to disclosure of a genuine, non-synthetic image.

This measure was enacted as Senate Bill 1462 and approved by the Governor on May 2, 2025, as 2025 Arizona Session Laws chapter 106, which carries no effective-date section or emergency clause of its own. The Arizona Legislature's own General Effective Dates page states the 2025 First Regular Session's general effective date as September 26, 2025.

Before a health care insurer may deny a claim submitted by a provider on the basis of medical necessity, a medical director must individually review the denial, exercise independent medical judgment, and may not rely solely on recommendations from any other source.

The section's own text and the Arizona Senate's fact sheet for the enacting bill, HB 2175 (2025), state this duty in technology-neutral terms; neither document uses the term artificial intelligence, though contemporaneous news coverage of the bill's passage describes it as a response to insurers' use of AI and algorithm-based tools to automate medical-necessity and prior-authorization denials.

Enacted in 2025 as Laws 2025, chapter 165 (HB 2175), approved by the Governor on May 12, 2025, with the act itself providing that it is effective from and after June 30, 2026.

Within ninety days before an election at which a candidate appears on the ballot, a creator, meaning any person who uses artificial intelligence or other digital technology to generate synthetic media, other than a provider of the underlying technology, may not create and distribute a deceptive and fraudulent deepfake of that candidate, meaning synthetic media the creator knows is false and intends to injure the candidate's reputation and that is intentionally calculated to mislead a reasonable person, unless the media carries a clear and conspicuous disclosure that it includes content generated by artificial intelligence.

Satire, parody, and an interactive computer service as defined in 47 U.S.C. § 230 are exempt. A creator who fails to make the required disclosure is liable for the civil penalty prescribed by A.R.S. § 16-937(B) for each day the undisclosed deepfake is distributed. Enacted as chapter 199 of the 2024 session laws, this section was approved by the Governor on May 29, 2024.

Unlike its companion section 16-1023, it carries a severability clause rather than an emergency clause, so it took effect on the legislative session's general effective date rather than immediately on signature. The Arizona Legislature's own General Effective Dates page states that day, for the 2024 Second Regular Session, as September 14, 2024.

A candidate for public office or political party office, or any citizen of Arizona, may bring an action for digital impersonation, defined as synthetic media digitally manipulated or generated using deep generative methods and artificial intelligence techniques to convincingly replace or simulate a person's likeness or voice, created with intent to deceive, that a reasonable viewer or listener would believe is an authentic depiction, and that is not commentary, parody, satire, criticism, or artistic expression.

Liability turns on non-disclosure: a plaintiff must show the digital impersonation was published without the publisher reasonably conveying that it was a digital impersonation or that its authenticity was disputed, or that this would not be obvious to a reasonable person.

The sole remedy is preliminary and permanent declaratory relief unless the plaintiff also proves an additional element, such as a pending election within one hundred eighty days for a candidate-plaintiff, a sexual or criminal-act depiction, or reasonably expected personal, financial, or reputational harm, in which case injunctive relief and damages are also available.

An interactive computer service is not liable under this section merely for publishing content supplied by another information content provider. Enacted as chapter 193 of the 2024 session laws and approved by the Governor as an emergency measure on May 21, 2024, operative immediately, the section states that it applies fourteen days after its effective date.

Arizona's breach-notification statute requires a person that conducts business in the state and owns or licenses unencrypted and unredacted computerized personal information of an Arizona resident to notify the affected individuals within 45 days after determining that a security system breach occurred.

The duty runs to any 'person' that conducts business in the state, a term A.R.S. sec. 18-551(6) defines to include a government or governmental subdivision or agency alongside a natural person or business entity, except the department of public safety, a county sheriff's department, a municipal police department, a prosecution agency and a court, so the duty is not private-sector-only.

If the breach affects more than 1,000 individuals, the person must also notify the three largest nationwide consumer reporting agencies, the Arizona Attorney General, and the director of the Arizona Department of Homeland Security. Notice may be delayed for an active law enforcement investigation, and no notice is required at all if a reasonable investigation determines there is no substantial risk of economic loss. Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities are exempt.

The statute creates no lawful-basis, purpose-limitation, or data-subject-rights framework for ordinary processing; it governs breach response only. The provisions this entry describes came into force on different days.

Subsection A makes it computer tampering for a person, acting without authority or in excess of authorization of use, to do any of eight listed things: paragraphs 1 through 5 require an added mental state such as intent to defraud, knowing alteration or destruction of data, or reckless disruption, but paragraph 8 separately criminalizes knowingly accessing any computer, computer system, network, software, program, or data at all, with no further intent element beyond knowledge and lack of authority, a bare unauthorized-access offense that is a class 6 felony on its own.

Paragraph 6 criminalizes preventing a user from exiting a site or connected location in order to compel the user's device to keep communicating with or displaying the service, and a violation of that paragraph is also an unlawful practice under the Arizona Consumer Fraud Act, enforceable by the Attorney General in addition to any criminal prosecution.

Paragraph 7 reaches knowingly obtaining confidential or non-public information by accessing a computer operated by the state, a political subdivision, a health care provider, or a clinical laboratory. The codified text carries no history note, and no day on which the section came into force has been located.

Makes it unlawful to communicate, release, or publish proprietary or confidential computer security information, security-related measures, algorithms, or encryption devices relating to a particular computer, system, or network, without the authorization of that system's owner or operator.

Exemptions cover releasing a security warning or defect information that is not specific to a particular owner's or operator's system, sharing security information among a system's own authorized users, notifying an owner or operator of a perceived threat, and research, development, or testing of security measures that is likewise not specific to a particular owner's or operator's system.

A scraper or security researcher who discovers and publishes a vulnerability specific to one operator's own system, rather than a generic product defect, is not exempted merely because the underlying access was otherwise lawful. The codified text carries no history note, and no day on which the section came into force has been located.

Makes it unlawful to knowingly possess, traffic in, publish, or control an access device, a credential or similar means of reaching an account or system, without the consent of its issuer, owner, or authorized user and with intent to use or distribute it; possessing five or more such devices without consent may itself support an inference of that intent.

This reaches obtaining or trading in login credentials or similar access devices used to reach data behind a login wall, rather than the act of automated collection itself. The codified text carries no history note, and no day on which the section came into force has been located.

A licensee must implement a comprehensive written customer information security program that includes administrative, technical, and physical safeguards for the protection of customer information. The safeguards must be appropriate to the size and complexity of the licensee and the nature and scope of its activities.

The program must be designed to ensure the security and confidentiality of customer information, protect against anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it. A licensee is an insurance institution, insurance producer, or insurance support organization.

Customer information is nonpublic personal information and privileged information about a customer, in paper, electronic or other form, maintained by or on behalf of an insurance institution, insurance producer, or insurance support organization. Section R20-6-2104 lists non-exclusive illustrations of how a licensee may implement those requirements. Article 21 was made by final rulemaking effective July 13, 2004.

An 'entity' may not knowingly discard or dispose of a paper record or document that combines an individual's first and last name, or first initial and last name, with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number, without first redacting that information or destroying the record or document.

'Entity' is defined broadly to include a corporation, unincorporated association, sole proprietorship, partnership, trust, or a government, governmental subdivision or agency. The duty applies to paper records and documents only. It does not reach an entity already regulated under the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act (HIPAA), or the federal Fair Credit Reporting Act. An entity that maintains and follows its own consistent disposal procedures is deemed compliant.

A county attorney or the Attorney General may enforce the section, and a civil penalty applies per violation arising out of one incident, rising from up to $500 for a first violation to up to $5,000 for a third or subsequent violation.

Each budget unit and its contractors must identify and report security incidents to the statewide information security and privacy office immediately on discovery and deploy mitigation strategies as directed. The statewide information security and privacy office is established in the Arizona department of homeland security.

The office may temporarily suspend operation of information infrastructure to isolate the source of, or stop the spread of, an information security system breach or other similar incident. A budget unit and the department of administration, as applicable, must comply with directives to temporarily discontinue or suspend operations of information infrastructure.

The statewide office is to establish a state security operations center for central detection, reporting and response efforts for security incidents and breaches across the state. In chapter 1 of title 18, a budget unit means a department, commission, board, institution or other agency of the state receiving, expending or disbursing state funds or incurring obligations of the state. Section 41-4282 was added by Laws 2022, chapter 50 (Senate Bill 1598).

Laws 2022, chapter 50 was approved by the Governor on March 23, 2022. The Arizona Legislature gives September 24, 2022 as the general effective date for laws of the 2022 Second Regular Session.

Requires a commercial entity that knowingly publishes sexual material harmful to minors on a website whose share of such material meets the applicability criteria, to use a reasonable age verification method, such as government issued identification or transactional data, to confirm a visitor is 18 or older, without retaining identifying information.