AZ SB1815

Establishes consumer data privacy rights in Arizona, allowing residents to access, correct, delete, and obtain portable copies of their personal data from controllers, and to opt out of targeted advertising, data sales, and profiling that produces legal or significant effects

Requires data controllers to provide clear privacy notices disclosing categories of data collected, processing purposes, third-party sharing practices, and methods for consumers to exercise opt-out rights

Prohibits processing of sensitive data (including race, health status, biometric data, precise geolocation, and data from children under 16) without explicit consumer consent

Mandates controllers conduct data protection assessments for high-risk activities including targeted advertising, data sales, and profiling, with assessments subject to attorney general review upon request

Takes effect January 1, 2027, voids any contract provisions that waive consumer rights under the article, and requires controllers to respond to consumer requests within 45 days (with one 45-day extension permitted)