AZ HB2790

Establishes Arizona's data protection law governing collection, processing, and sale of personal data by entities with annual revenue of at least $25 million that process data of 100,000+ consumers or derive 35%+ revenue from personal data sales.

Grants consumers verified rights to access, correct, and delete their personal data; receive notice of data sales to brokers; and opt out of targeted advertising and personal data sales.

Requires data controllers to notify consumers within 30 days of data requests (extendable 60 days), communicate corrections or deletions to third-party recipients, and prohibit decisions based solely on automated profiling affecting consequential services like loans, housing, or employment.

Establishes enforcement by Arizona Attorney General with civil penalties of up to $2,500 per violation or $7,500 for intentional violations; creates Consumer Privacy Fund from penalty revenues; allows 30-day cure period before penalties apply.

Exempts state and local governments, health records covered by HIPAA and HITECH, employment records, and fair credit reporting activities; prohibits local regulation of data security issues.