Arizona Privacy Law

Current Status

Arizona is one of the states most frequently cited as being on the verge of passing comprehensive data privacy legislation. Multiple bills have advanced further through the legislative process than in most states without a law — clearing committees with bipartisan support and generating broad consensus on most provisions. The most recent serious attempt was HB 2774 in the 2023–2024 session, which closely mirrored Virginia's Consumer Data Protection Act (CDPA) model. The bill had support from both Republican and Democratic legislators and was seen as a reasonable middle ground between consumer protections and business flexibility. It stalled in the final stages due to disagreements over the scope of exemptions for small businesses and the cure period duration. Arizona's situation is notable because, unlike states where ideological disagreement creates gridlock, most Arizona legislators on both sides broadly agree that a privacy law is needed. The disputes are largely technical — about thresholds, exemptions, and enforcement mechanisms — rather than fundamental. This makes Arizona one of the most likely next states to enact a comprehensive privacy law.

Legislative Timeline

What the Bill Proposes

Arizona's proposed privacy legislation is modeled primarily on Virginia's Consumer Data Protection Act (CDPA) — the same framework adopted by Iowa, Indiana, Kentucky, and several other states. The bill would provide standard consumer rights (access, correction, deletion, portability, opt-out of sale and targeted advertising) and require opt-in consent for sensitive personal data. Arizona's proposed thresholds — 100,000 consumers or 25,000 consumers with data sales generating over 25% of revenue — align with the national majority approach. The bill includes a 30-day cure period before penalties can be imposed, and enforcement would rest exclusively with the Arizona Attorney General with no private right of action.

Proposed Consumer Rights

If enacted as currently drafted, Arizona residents would receive the following privacy rights:

Key Provisions of the Proposed Bill

• Virginia CDPA Model: The bill closely follows Virginia's framework — the most widely adopted state privacy law template, currently used by 8+ states.
• Sensitive Data Opt-In: Processing of racial origin, health data, sexual orientation, religion, geolocation, biometrics, and children's data would require explicit opt-in consent.
• Data Protection Assessments: High-risk processing activities (targeted advertising, sale, profiling, sensitive data) would require documented impact assessments.
• 30-Day Cure Period: Businesses would receive 30 days to cure violations before the AG could pursue penalties — standard in the Virginia-model framework.
• No Private Right of Action: Enforcement rests solely with the AZ Attorney General — a provision favored by businesses and controversial among consumer advocates.
• Bipartisan Support: Unlike many states where privacy bills divide along party lines, Arizona's bill has genuine support from both Republican and Democratic legislators.

Why It Hasn't Passed Yet

Arizona's delays have been largely technical rather than ideological. The main sticking points in recent sessions have been: (1) Small business exemptions — how to define the revenue/data threshold so that truly small businesses aren't burdened while still covering the major data processors; (2) Cure period length — business groups have pushed for a permanent cure period (allowing companies to fix violations before paying fines indefinitely) while consumer advocates argue this eliminates accountability; (3) Nonprofit exemptions — whether nonprofit data collectors (including hospitals, universities, and advocacy organizations that process large amounts of personal data) should be fully exempt. These are resolvable differences, and observers widely expect Arizona to enact a law within one to two legislative sessions.

How Arizona Compares to States With Laws

Feature	Arizona (Proposed)	Virginia (Active)	California (Active)
Comprehensive privacy rights	Proposed	✅ Yes	✅ Yes
Right to delete	Proposed	✅ Yes	✅ Yes
Opt out of sale of data	Proposed	✅ Yes	✅ Yes
Sensitive data protections	Proposed	✅ Yes	✅ Yes
Enforcement agency	TBD	VA Attorney General	CA Privacy Protection Agency
Private right of action	TBD	No	Yes (breach only)
Currently enforceable	❌ No	✅ Yes	✅ Yes

What You Can Do Right Now

Even though Arizona does not yet have a comprehensive privacy law, you are not without options:

• Contact your state legislators — Tell your state senator and representative you support strong data privacy legislation. Personal constituent messages are more impactful than form letters.
• Use your federal rights — HIPAA protects your medical data, COPPA protects children's data under 13, and FCRA gives you rights over your credit data nationwide.
• Exercise California rights if you travel or have accounts there — Some companies apply CCPA rights to all users regardless of state.
• Opt out of data brokers directly — Even without a state law, you can submit opt-out requests to major data brokers. Many comply voluntarily.
• Enable the Global Privacy Control — States like California and Colorado legally require websites to honor this browser signal, which still protects your data on those sites.

Stay Updated on Arizona's Privacy Law Progress

Privacy legislation moves quickly. Subscribe to our newsletter and we'll alert you the moment Arizona passes a new privacy bill, a vote is scheduled, or a major amendment changes the bill's scope. You'll also receive our monthly digest of all U.S. privacy law changes — free, always.