AZ HB2865

Establishes consumer rights to access, correct, delete, and restrict processing of personal data held by large companies operating in Arizona, with specific definitions for personal data, sensitive data, data brokers, and related terms.

Requires controllers to notify consumers about personal data collection, provide copies of data upon verified request, and obtain consent before collecting additional categories of data or using data for new purposes.

Allows consumers to object to targeted advertising and the sale of personal data to third parties; controllers must communicate deletion requests to third-party recipients who received the data.

Applies to legal entities with at least $25 million annual revenue conducting business in Arizona that either control data of 100,000+ consumers or derive over 35% of revenue from selling personal information of 25,000+ consumers.

Violations subject to civil penalties of up to $2,500 per violation or $7,500 for intentional violations, enforceable by the Arizona Attorney General; exempts government entities and data regulated under HIPAA, HITECH, and Gramm-Leach-Bliley Act.