AZ SB1614

Requires businesses meeting specified thresholds (annual revenue over $15 million, handling data on 50,000+ consumers, or deriving 50%+ revenue from selling personal data) to disclose collected personal information categories, data sources, commercial purposes, and third-party recipients upon consumer request within 45 days.

Grants consumers the right to request deletion of their personal information, with exceptions for completing transactions, detecting fraud, debugging, exercising free speech, conducting research, internal uses, and legal compliance.

Prohibits businesses from selling personal information of consumers under 16 without affirmative authorization (parental consent for those under 13, consumer consent for ages 13-15) and establishes opt-out mechanisms including a "do not sell my personal information" link on business websites.

Establishes statutory damages of $100-$750 per consumer per incident for unauthorized access to personal information due to security failures, with a 30-day cure period before enforcement, and allows Attorney General to seek civil penalties up to $7,500 per violation.

Preempts local regulation of consumer data privacy and prohibits businesses from discriminating against consumers who exercise their privacy rights regarding pricing, service denial, or quality differences.