Arizona Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Arizona Site Laws Follow a Different Pattern

Arizona has not enacted a comprehensive consumer privacy statute of the kind adopted in California, Colorado, Texas, Virginia, and many other states. In the 2026 session, Senate Bill 1815 proposed a broad controller-and-processor privacy framework, and Senate Bill 1790 proposed requirements for businesses collecting personal data, including a data-broker registry. Neither proposal became law. The Legislature completed its 2026 work on June 13, 2026, and neither bill appears among the session’s chaptered laws.

Because no umbrella privacy law exists, Arizona site laws work as a patchwork. A breach-notification statute in Title 18 tells businesses what to do after certain security incidents. The Consumer Fraud Act in Title 44 polices what businesses say and sell. An age-verification statute applies to websites dominated by sexual material harmful to minors. Sales-tax obligations flow from the state’s transaction privilege tax, rather than a conventional sales tax. Understanding each piece separately is the reliable way to assess the rules that may affect your site.

The Arizona Breach Notification Statute: A 45 Day Clock

The most concrete Arizona rule for a website that stores customer data is the breach-notification statute at A.R.S. § 18-552. It applies to a person that conducts business in Arizona and owns, maintains, or licenses unencrypted and unredacted computerized personal information. The statute’s definition of personal information includes a person’s name combined with specified identifiers, such as a Social Security number, driver-license or state-ID number, financial-account information with an access credential, biometric data, medical information, health-insurance information, passport number, or taxpayer identification number. It also separately covers a username or email address combined with a password or security question and answer that permits access to an online account.

When a covered business becomes aware of a security incident, it must promptly investigate whether a security-system breach occurred. If it determines that a breach occurred, the owner or licensee generally must notify affected individuals within 45 days after that determination. The statute permits written, electronic, or telephonic notice and allows substitute notice only under stated conditions, including where direct notice would cost more than $50,000, more than 100,000 people are affected, or sufficient contact information is unavailable. Law-enforcement advice that notice would impede a criminal investigation can delay notice. The statute also includes a risk-of-harm exception where a reasonable investigation concludes that the breach did not result, and is not reasonably likely to result, in substantial economic loss to affected individuals.

Larger breaches trigger additional reporting. If notice is required for more than 1,000 Arizona residents, the business must also notify the three largest nationwide consumer reporting agencies, the Attorney General, and the Director of the Arizona Department of Homeland Security within the same 45-day period. The Attorney General provides a breach-notification submission process. A knowing and willful violation is an unlawful practice under the Consumer Fraud Act, enforceable only by the Attorney General; available civil penalties are capped at $500,000 per breach, in addition to possible restitution. HIPAA-covered entities and business associates, and entities subject to Title V of the Gramm-Leach-Bliley Act, have statutory exceptions, so businesses should confirm the scope of any claimed exemption before relying on it.

The Consumer Fraud Act and Your Online Store

Arizona’s second major rule for websites is the Consumer Fraud Act, codified at A.R.S. §§ 44-1521 through 44-1534. Section 44-1522 makes deception, deceptive or unfair acts, false pretenses, misrepresentations, and concealment, suppression, or omission of material facts unlawful when used in connection with the sale or advertisement of merchandise. The Legislature directs courts to use Federal Trade Commission and federal-court interpretations of specified FTC Act provisions as a guide when construing the statute.

For your website, this law reaches the everyday choices that shape a consumer’s purchase decision. Strikethrough prices unsupported by genuine prior prices, countdown timers that reset on each visit, free-trial offers that convert to paid subscriptions without clear disclosures, fees disclosed only at the end of checkout, and misleading testimonials can all create consumer-protection risk. The Attorney General’s Consumer Protection and Advocacy Section enforces the statute, and consumers may pursue civil claims for damages in appropriate cases. Treat product pages, pricing tables, subscription flows, and review widgets as consumer-facing advertising rather than as informal website copy.

Age Verification Under House Bill 2112

The enacted Arizona law that most directly governs certain website-access controls is House Bill 2112, now codified at A.R.S. § 18-701. It became effective on September 26, 2025. A commercial entity that knowingly and intentionally publishes or distributes material on an internet website, including a social-media platform, where more than one-third of the material is sexual material harmful to minors must use reasonable age-verification methods to verify that a person attempting access is at least 18.

The statute permits digital identification or a commercial age-verification system that verifies age through government-issued identification or commercially reasonable public or private transactional data. A covered website and its age-verification provider may not retain identifying information or cause it to be directly or indirectly transmitted to a federal, state, or local government entity. The statute contains exemptions and protections for bona fide news and public-interest content, news-gathering organizations, and certain internet service providers, search engines, and cloud providers that do not create the relevant content.

One important correction is the enforcement mechanism. Section 18-701 does not give the Attorney General a direct enforcement action and does not create a qui tam action. Instead, it creates a civil right of action for the parent or guardian of a minor who accesses covered material and for a person whose identifying information was retained or transmitted because of a violation. A court may award penalties of up to $10,000 per day for operating in violation of the age-verification requirement, up to $10,000 per improper retention or transmission of identifying information, and up to an additional $250,000 where one or more minors accessed the material because of an age-verification violation. A successful plaintiff may recover reasonable attorney fees and costs.

For most small-business websites, the one-third threshold means this law will not apply. The question is more significant for adult-content publishers, adult-novelty retailers, sites with substantial sexual imagery, dating or lifestyle communities, and platforms that host user uploads. If a site’s overall content mix could plausibly meet the statutory threshold, the business should assess its content, access controls, vendor practices, and data-retention procedures carefully.

Arizona Site Laws for eCommerce: Transaction Privilege Tax

Arizona does not have a traditional sales tax. Instead, it imposes transaction privilege tax, usually called TPT, on the seller for the privilege of doing business; a seller may pass the cost through to a buyer. For remote retail sellers without physical presence in Arizona, economic nexus applies when direct Arizona retail sales exceed $100,000 in the current or previous calendar year. There is no transaction-count test. The Department of Revenue’s current economic-threshold guidance confirms that the threshold has been $100,000 since 2021.

Marketplace sales receive different treatment. Sales made through a marketplace facilitator generally do not count toward a remote seller’s economic-nexus threshold because the facilitator reports and remits TPT on those sales. A business selling exclusively through marketplace facilitators generally does not need its own TPT license. A remote seller making direct Arizona sales after exceeding the threshold, however, must register, collect, file, and remit as required. The Department says a remote-seller TPT license costs $12 for the initial calendar year and may be renewed without an additional state renewal fee; registration and filing are handled through AZTaxes.gov.

Rate sourcing and product classification deserve special attention. The Department’s guidance directs remote sellers to report retail sales by the destination jurisdiction, and its rate tables change periodically. Arizona generally taxes retail sales of tangible personal property, a category the Department says can include digital images. Arizona guidance also treats prewritten computer software differently from custom programming; prewritten software may be taxable even when transferred electronically, while custom programming is generally treated as a service when properly separated. Do not assume that every subscription, download, streaming product, or software offering receives identical treatment. Check the current Department guidance and your product facts before relying on a platform’s default tax settings.

What Happened in the 2026 Session

The 2026 regular session did not enact a comprehensive privacy law, a data-broker registry, or a general chatbot statute. SB 1815 and SB 1790 were proposals, not enacted Arizona law. The Legislature completed its work on June 13, 2026, and the Legislature’s session-law index identifies the measures that actually became law.

House Bill 2311 was the session’s most consequential AI proposal for public-facing conversational AI services. As passed by the Legislature, it would have required specified AI disclosures, safeguards involving minors, privacy and account-setting tools, and protocols addressing suicide and self-harm prompts. It also would have authorized Attorney General enforcement and proposed an effective date after September 30, 2027. Governor Katie Hobbs vetoed HB 2311 on June 19, 2026. It therefore did not become law and imposes no new Arizona chatbot requirement.

The practical result is stability, not a new statutory AI compliance mandate. Businesses using chatbots or other AI tools should still evaluate their disclosures, vendor terms, data practices, and safeguards for minors and crisis-related interactions under the Consumer Fraud Act and any applicable federal or sector-specific rules. Those are sensible risk-management steps, but they are not requirements created by vetoed HB 2311.

What You Should Do Now

You do not need a compliance department to address the Arizona laws covered here. You need a short list of concrete tasks that fit your website and the data, products, and services it handles.

1. Map the personal information your site collects, including account credentials, and identify where it is stored, who can access it, and which service providers receive it.
2. Maintain a breach-response plan that calls for a prompt investigation, measures the 45-day notice period from a breach determination, and identifies the Attorney General, Department of Homeland Security, and consumer-reporting-agency notices required for larger incidents.
3. Review pricing displays, subscription flows, shipping and fee disclosures, endorsements, and reviews against the Consumer Fraud Act and relevant FTC guidance.
4. If you are an out-of-state retailer, total direct Arizona retail sales in the current and prior calendar years; if they exceed $100,000, evaluate TPT registration, collection, filing, and renewal requirements.
5. If your site may be more than one-third sexual material harmful to minors, assess whether A.R.S. § 18-701 applies and whether your age-verification and data-handling process fits the statute.

These steps address rules now in force without treating proposed or vetoed legislation as a current legal requirement. Arizona laws passed without an emergency clause or a different effective date generally take effect after the session’s general effective date, so checking chaptered bills after each session is more reliable than reacting to introduced legislation or headlines.

Key Takeaways

• Arizona has no comprehensive consumer privacy law. SB 1815 and SB 1790 were 2026 proposals and did not become law.
• The breach-notification statute, A.R.S. § 18-552, generally requires notice within 45 days after a breach determination and extra notices for breaches affecting more than 1,000 Arizona residents.
• A.R.S. § 18-701 has required age verification since September 26, 2025 for commercial websites where more than one-third of content is sexual material harmful to minors.
• The age-verification law is enforced through specified private civil actions, not an Attorney General action or a qui tam action.
• Remote retail sellers generally meet Arizona TPT economic nexus after more than $100,000 in direct Arizona retail sales in the current or previous calendar year; marketplace-facilitated sales generally do not count toward that threshold.
• HB 2311, Arizona’s 2026 conversational-AI proposal, was vetoed on June 19, 2026 and is not current law.

Frequently Asked Questions About Arizona Site Laws

Does Arizona have a privacy law like California’s CCPA?

No. As of September 21, 2026, Arizona has not enacted a comprehensive consumer-data privacy statute. SB 1815 proposed one during the 2026 session, but it did not become law. Website obligations instead arise from the breach-notification statute, the Consumer Fraud Act, and sector-specific laws where applicable.

Do Arizona site laws apply to my business if I am located in another state?

They can. The breach-notification statute applies to covered persons conducting business in Arizona and handling Arizona residents’ covered information. The Consumer Fraud Act can apply to advertising and sales involving Arizona consumers. Remote-seller TPT rules can apply when direct retail sales into Arizona exceed the economic threshold.

Do Arizona site laws require age verification on my website?

Only if your commercial website knowingly and intentionally publishes or distributes material and more than one-third of the site is sexual material harmful to minors under A.R.S. § 18-701. A typical business, portfolio, or eCommerce site ordinarily will not meet that content threshold.

How quickly must I report a data breach in Arizona?

A covered owner or licensee generally must notify affected residents within 45 days after determining that a security-system breach occurred. If notice is required for more than 1,000 Arizona residents, the business must also notify the Attorney General, the Director of the Arizona Department of Homeland Security, and the three largest nationwide consumer reporting agencies.

Did Arizona pass an AI chatbot law in 2026?

No. HB 2311 passed the Legislature but Governor Hobbs vetoed it on June 19, 2026. It did not take effect and does not create a current Arizona chatbot compliance obligation.

Conclusion

Arizona site laws remain a targeted patchwork rather than a comprehensive privacy code. The breach-notification statute sets a 45-day deadline and requires additional notices for larger incidents. The Consumer Fraud Act applies to online advertising and sales practices. A.R.S. § 18-701 requires age verification only for commercial sites dominated by sexual material harmful to minors, and its enforcement is through the statute’s private civil actions. For eCommerce, remote sellers should focus on the $100,000 direct-sales TPT threshold, marketplace treatment, sourcing, and accurate product classification. The 2026 privacy and AI bills did not add new requirements: the privacy proposals did not become law, and HB 2311 was vetoed. Keeping these distinctions clear is the soundest approach to Arizona website compliance.