Arizona privacy laws are not contained in one statute. Protection comes from four layers working together: a state constitutional provision that limits government intrusion, a set of targeted statutes covering specific issues like data breaches, genetic testing, recording, and surveillance, federal laws that fill gaps for medical and financial data, and common-law privacy claims developed by the courts. Which layer applies depends on who invaded your privacy and how. The remedies also differ — some rules are enforced only by the Attorney General, others give you the right to sue directly, and several carry criminal penalties.
The Constitutional Right to Privacy
Article 2, Section 8 of the Arizona Constitution provides that “No person shall be disturbed in his private affairs, or his home invaded, without authority of law.”1Justia. Arizona Constitution Article 2 Section 8 – Right to Privacy This constrains government conduct, not private parties. State and local agencies need legal authority before intruding on your personal affairs, and courts use the provision to review challenges to searches, surveillance, and government access to personal records.
Courts apply it by weighing the government’s justification against your reasonable expectation of privacy. If your dispute is with another person or a business rather than the government, you’ll need one of the statutes or common-law claims below.
Arizona Has No Comprehensive Consumer Data Privacy Law
Unlike California, Virginia, or Colorado, Arizona has not passed a broad consumer data privacy statute. Bills have been introduced, but none have become law. That means Arizona residents do not have general statutory rights to access, correct, or delete personal data that businesses collect about them, outside of narrow contexts like genetic testing.
Federal law covers specific categories. HIPAA governs medical records held by healthcare providers and insurers. The Gramm-Leach-Bliley Act requires financial institutions to disclose their data-sharing practices and protect customer information.2Federal Trade Commission. Gramm-Leach-Bliley Act COPPA restricts how websites collect information from children under 13. And the Arizona Attorney General can pursue companies that mishandle consumer data under the state’s Consumer Fraud Act, which prohibits deceptive or unfair business practices.
Data Breach Notification
Where Arizona does impose enforceable obligations on businesses is breach notification. Under ARS 18-552, any person or business operating in Arizona that maintains unencrypted computerized personal information must investigate promptly when it learns of a security incident. If the investigation confirms a breach, the business has 45 days to notify affected individuals.3Arizona Legislature. Arizona Code 18-552 – Notification of Security System Breaches
What Counts as Personal Information
The duty triggers when someone gains unauthorized access to “personal information,” which ARS 18-551 defines two ways. The first is your name (first name or initial plus last name) combined with one or more sensitive data elements:
- Social Security number
- Driver’s license or state ID number
- Financial account, credit, or debit card number paired with a security code or password that would permit account access
- Passport number
- Taxpayer identification number or IRS identity protection PIN
- Health insurance ID number
- Medical or mental health treatment information from a healthcare professional
- Unique biometric data used for online account authentication
- Private cryptographic key used to authenticate or sign electronic records
The second trigger is a compromised username or email address combined with a password or security question that allows access to an online account.4Arizona Legislature. Arizona Revised Statutes Title 18 Section 18-551 Publicly available information from government records or widely distributed media doesn’t count.
Notice and Penalties
Notice can be given by written letter, email, or a direct phone call (not a prerecorded message). When a breach affects more than 1,000 Arizona residents, the business must also notify the three largest nationwide consumer reporting agencies, the Attorney General, and the Director of the Arizona Department of Homeland Security.3Arizona Legislature. Arizona Code 18-552 – Notification of Security System Breaches
Only the Attorney General can enforce the statute. Knowing and willful violations are unlawful practices under the consumer fraud statutes, and civil penalties can reach $10,000 per affected individual or the total economic loss sustained by affected individuals, whichever is less, capped at $500,000 per breach or series of related breaches. The Attorney General can also seek restitution on top of the penalty.3Arizona Legislature. Arizona Code 18-552 – Notification of Security System Breaches
Genetic Information Privacy
Arizona’s Genetic Information Privacy Act regulates direct-to-consumer genetic testing companies. If you send a DNA sample to one of these services, the company must obtain your express consent before collecting, using, or sharing your genetic data. Consent is layered: the company needs separate consent for sharing data with third parties, using data beyond the primary testing purpose, retaining your biological sample after testing, and marketing to you based on your genetic results.5Arizona Legislature. Arizona Code 44-8002 – Direct-to-Consumer Genetic Testing Company Requirements; Prohibition
You have the right to access your genetic data, delete your account and genetic data, and request destruction of your biological sample. Companies must maintain a security program to guard against unauthorized access. And they are flatly prohibited from disclosing your genetic data to health insurers, life insurers, long-term care insurers, or employers.5Arizona Legislature. Arizona Code 44-8002 – Direct-to-Consumer Genetic Testing Company Requirements; Prohibition
Violations carry a civil penalty of up to $2,500 per violation, plus actual damages to affected consumers and the Attorney General’s costs and attorney fees.6Arizona Legislature. Arizona Code 44 – Genetic Information Privacy Act
Recording Conversations
Arizona is a one-party consent state. Under ARS 13-3005, you can legally record a phone call or in-person conversation as long as you are a party to it. You don’t have to tell the other person. The crime happens when someone who is not part of the conversation intercepts it without any participant’s consent.7Arizona Legislature. Arizona Code 13-3005 – Interception of Wire, Electronic and Oral Communications
Illegal interception of a wire, electronic, or oral communication is a class 5 felony. Installing or using a pen register or trap-and-trace device without legal authority is a class 6 felony.7Arizona Legislature. Arizona Code 13-3005 – Interception of Wire, Electronic and Oral Communications Put simply: if you’re in the conversation, you can record it. If you’re secretly recording a conversation between other people and neither of them consented, you are committing a felony.
Voyeurism, Surveillance, and Drones
Beyond audio, Arizona criminalizes visual surveillance in places where people expect privacy. Under ARS 13-3019, it is a crime to secretly photograph, record, or view another person in a bathroom, bedroom, locker room, or similar private space while they are undressing, nude, or engaged in intimate activity. It is also illegal to capture images of a person’s intimate body parts, clothed or unclothed, that would not otherwise be visible to the public.8Arizona Legislature. Arizona Revised Statutes Title 13 Section 13-3019
Distributing images obtained this way without the depicted person’s consent is treated even more seriously. When the person in the image is recognizable, distribution is a class 4 felony.8Arizona Legislature. Arizona Revised Statutes Title 13 Section 13-3019
ARS 13-3007 restricts drone use for surveillance. It is illegal to use a drone to monitor people inside their homes, places of worship, or within the closed confines of their property, or in any other location where they have a reasonable expectation of privacy. Law enforcement faces separate restrictions and generally needs a warrant before deploying a drone. A violation is a class 6 felony, evidence obtained illegally through drone surveillance is inadmissible, and an aggrieved party can bring a civil action against a law enforcement agency that violates the statute.9Arizona Legislature. Arizona Code 13-3007 – Unlawful Use of Drones
Identity Theft
Under ARS 13-2008, knowingly taking, purchasing, manufacturing, recording, possessing, or using another person’s identifying information without their consent, with the intent to use it unlawfully, cause financial loss, or obtain or continue employment, is a class 4 felony. The crime is complete the moment someone uses your information with that intent, whether or not you actually suffer economic loss.10Arizona Legislature. Arizona Code 13-2008 – Taking Identity of Another Person or Entity; Classification
Common Law Privacy Torts
Arizona courts recognize four civil claims for invasion of privacy. You don’t have to prove a statutory violation to bring one of these. All four require the defendant’s conduct to be highly offensive to a reasonable person.
- Intrusion upon seclusion: physically or electronically invading someone’s private space or affairs, like unauthorized surveillance in a home or hacking into private accounts.
- Appropriation of name or likeness: using someone’s name, image, or identity for commercial purposes without permission. Sometimes called the right of publicity.
- Public disclosure of private facts: publicly revealing truthful but deeply private information that is not newsworthy and would be highly offensive, such as medical conditions or intimate details of someone’s personal life.
- False light: publishing information that creates a misleading and offensive false impression, even if the individual statements are not technically defamatory.
These claims give you the right to sue for damages. They coexist with the criminal statutes above, so the same conduct — say, secretly recording someone in their bedroom — can produce both a criminal prosecution and a civil lawsuit.1Justia. Arizona Constitution Article 2 Section 8 – Right to Privacy
Public Records and Privacy
Arizona’s Public Records Law, ARS 39-121, starts from the presumption that government records are open. Any person can inspect public records during office hours.11Arizona Legislature. Arizona Code 39-121 – Inspection of Public Records That presumption isn’t absolute. Records can be withheld or redacted when a specific statute makes the information confidential or when a court-developed balancing test tips toward privacy. That test weighs the public’s interest in transparency against the individual’s privacy interest and the state’s interest in confidentiality.12Arizona Attorney General. Arizona Agency Handbook Chapter 6 – Public Records In practice, agencies routinely redact Social Security numbers, dates of birth, and home addresses before releasing documents. The record custodian has to show that withholding is necessary to prevent specific harm.
Workplace Monitoring
Arizona has no state-level statute specifically governing employer monitoring. The federal Electronic Communications Privacy Act sets the floor. It generally prohibits intercepting electronic communications, but employers can monitor communications on company-owned devices when they have employee consent or when monitoring serves a legitimate business purpose and is done with notice. Most employers get consent through disclosures in the employee handbook or onboarding paperwork.
The line that matters is between company equipment and personal devices. Employers who monitor company computers and networks under their own written policies are usually on solid ground. Monitoring personal devices, even when employees use them at work or on company Wi-Fi, carries much more legal risk. Arizona’s one-party consent rule still applies: an employer who is not a party to a conversation cannot secretly record it without any participant’s consent.