Arizona privacy laws come from several sources rather than a single statute: the state constitution, specific laws on data breaches, genetic testing, recording, surveillance, drones, and identity theft, federal laws that fill certain gaps, and common law claims you can bring in civil court. Some areas get strong, specific protection. Others rely on general doctrines. Which law applies to your situation determines what you can do about it.
The Constitutional Baseline
Article 2, Section 8 of the Arizona Constitution says: “No person shall be disturbed in his private affairs, or his home invaded, without authority of law.”1Justia. Arizona Constitution Article 2 Section 8 – Right to Privacy This provision limits what the government can do, not what private businesses or neighbors can do. It most often matters in criminal cases, where defendants challenge searches or surveillance, and in disputes over government access to personal records. Courts weigh the government’s justification against your reasonable expectation of privacy.
For disputes with private parties, you have to look to the statutes and common law claims below.
No Comprehensive Consumer Data Privacy Law
Arizona has not passed a general consumer data privacy law like those in California, Virginia, or Colorado. Bills have been introduced, none have become law. That means you do not have statutory rights to access, correct, or delete the personal data businesses collect about you, except in a few narrow areas like genetic testing.
Some federal laws cover specific categories. HIPAA governs medical records held by healthcare providers and insurers. The Gramm-Leach-Bliley Act requires financial institutions to disclose their data-sharing practices and protect customer information.2Federal Trade Commission. Gramm-Leach-Bliley Act The Children’s Online Privacy Protection Act restricts data collection from children under 13. Beyond those, the Arizona Attorney General can go after companies that deceive consumers about their data practices under the Arizona Consumer Fraud Act, which broadly prohibits unfair or deceptive business conduct.
Data Breach Notification
If a company holding your personal information suffers a security incident, Arizona law requires them to act. Under ARS 18-552, any person or business operating in Arizona that keeps unencrypted computerized personal information must investigate promptly once they become aware of a breach. If the investigation confirms unauthorized access, they have 45 days to notify affected individuals.3Arizona Legislature. Arizona Code 18-552 – Notification of Security System Breaches
What Information Is Covered
ARS 18-551 defines “personal information” in two ways. The first is your name (first name or initial plus last name) combined with one or more of these sensitive data elements:
- Social Security number
- Driver’s license or state ID number
- Financial account, credit, or debit card number along with a security code or password that would allow account access
- Passport number
- Taxpayer identification number or IRS identity protection PIN
- Health insurance ID number
- Medical or mental health treatment information from a healthcare professional
- Unique biometric data used to authenticate an online account
- Private cryptographic key used to authenticate or sign electronic records
The second trigger is a username or email address combined with a password or security question that permits access to an online account.4Arizona Legislature. Arizona Revised Statutes Title 18 Section 18-551 Publicly available information from government records or widely distributed media is not covered.
How You’ll Be Notified
Notice can come by written letter, email, or a direct phone call (not a prerecorded message). When a breach affects more than 1,000 Arizona residents, the business must also notify the three largest nationwide consumer reporting agencies, the Attorney General, and the Director of the Arizona Department of Homeland Security.3Arizona Legislature. Arizona Code 18-552 – Notification of Security System Breaches
Only the Attorney General can enforce the notification law. There is no private right to sue a company for failing to notify you. Civil penalties for a knowing and willful violation can reach $10,000 per affected individual or the total economic loss sustained, whichever is less, capped at $500,000 per breach or related series of breaches. The Attorney General can also seek restitution for affected individuals.3Arizona Legislature. Arizona Code 18-552 – Notification of Security System Breaches
Genetic Testing Privacy
If you send a DNA sample to a direct-to-consumer genetic testing company, Arizona’s Genetic Information Privacy Act gives you real rights. The company must get your express consent before collecting, using, or sharing your genetic data, and that consent is layered: separate consent is required to share with third parties, use the data beyond the primary test, keep your biological sample after testing, or market to you based on your results.5Arizona Legislature. Arizona Code 44-8002 – Direct-to-Consumer Genetic Testing Company Requirements; Prohibition
You can access your genetic data, delete your account and genetic data, and ask the company to destroy your biological sample. The company has to maintain a security program to guard against unauthorized access. And the law outright bans these companies from disclosing your genetic data to health, life, or long-term care insurers or to employers.5Arizona Legislature. Arizona Code 44-8002 – Direct-to-Consumer Genetic Testing Company Requirements; Prohibition
Violations carry a civil penalty of up to $2,500 per violation plus actual damages and the Attorney General’s costs and attorney fees.6Arizona Legislature. Arizona Code 44 – Genetic Information Privacy Act
Recording Conversations
Arizona is a one-party consent state. Under ARS 13-3005, you can legally record a phone call or in-person conversation as long as you are a party to it. You don’t have to tell the other person. What’s illegal is intercepting a conversation when you are not a participant and no participant has consented.7Arizona Legislature. Arizona Code 13-3005 – Interception of Wire, Electronic and Oral Communications
Illegal interception of a wire, electronic, or oral communication is a class 5 felony. Installing or using a pen register or trap-and-trace device without legal authority to monitor someone’s lines is a class 6 felony.7Arizona Legislature. Arizona Code 13-3005 – Interception of Wire, Electronic and Oral Communications
Hidden Cameras, Intimate Images, and Drones
ARS 13-3019 makes it a crime to secretly photograph, record, or view another person in a bathroom, bedroom, locker room, or similar private space where they are undressing, nude, or engaged in intimate activity. It is also illegal to capture images of a person’s intimate body parts, clothed or unclothed, that would not otherwise be visible to the public.8Arizona Legislature. Arizona Revised Statutes Title 13 Section 13-3019
Distributing images obtained this way without the depicted person’s consent is treated more seriously. When the person in the image is recognizable, distribution is a class 4 felony. The base offense committed with a recording device is a class 5 felony. Offenses committed without a recording device are a class 6 felony for a first offense and escalate to a class 5 felony for repeat violations.8Arizona Legislature. Arizona Revised Statutes Title 13 Section 13-3019
Drones have their own rule. ARS 13-3007 makes it illegal to use a drone to monitor people inside their homes, places of worship, or within the closed confines of their property, or anywhere else they would have a reasonable expectation of privacy. Law enforcement generally needs a search warrant before deploying a drone. A violation is a class 6 felony, evidence obtained through illegal drone surveillance is inadmissible, and an aggrieved person can bring a civil action against a law enforcement agency that violates the statute.9Arizona Legislature. Arizona Code 13-3007 – Unlawful Use of Drones
Identity Theft
Under ARS 13-2008, knowingly taking, purchasing, manufacturing, recording, possessing, or using another person’s identifying information without consent, with intent to use the identity unlawfully, cause financial loss, or obtain or continue employment, is a class 4 felony. It applies whether or not the victim actually suffers economic loss. The crime is complete the moment someone uses your information with the required intent.10Arizona Legislature. Arizona Code 13-2008 – Taking Identity of Another Person or Entity; Classification
Suing for Invasion of Privacy
Arizona courts recognize four civil claims for invasion of privacy. You don’t need a statute to bring these; they are judge-made rules that let you sue when your privacy has been seriously violated. All four require the defendant’s conduct to be highly offensive to a reasonable person.
- Intrusion upon seclusion: physically or electronically invading someone’s private space or affairs, such as unauthorized surveillance in a home or hacking into private accounts.
- Appropriation of name or likeness: using someone’s name, image, or identity for commercial purposes without permission. Sometimes called the right of publicity.
- Public disclosure of private facts: publicly revealing truthful but deeply private information that is not newsworthy and would be highly offensive, such as medical conditions or intimate details of someone’s personal life.
- False light: publishing information that creates a misleading and offensive false impression about someone, even if the individual statements are not technically defamatory.
These claims exist alongside the criminal statutes above. The same conduct, say secretly recording someone in their bedroom, can produce both a criminal prosecution and a civil lawsuit for damages.1Justia. Arizona Constitution Article 2 Section 8 – Right to Privacy
Workplace Monitoring
Arizona has no state law specifically governing employer monitoring of workers. The federal Electronic Communications Privacy Act sets the floor. It generally prohibits intercepting electronic communications, but employers can monitor communications on company-owned devices when they have employee consent or a legitimate business purpose with notice. Most employers meet the consent requirement by putting monitoring disclosures in employee handbooks or onboarding paperwork.
Company equipment and personal devices are not the same. Employers who monitor company-owned computers and networks under their own written policies are generally on solid ground. Monitoring personal devices, even when used on company property or company Wi-Fi, creates much greater legal risk. Arizona’s one-party consent rule applies here too: an employer who is not a party to a conversation cannot secretly record it unless some participant consents.