personal data; consumers; controllers; requirements

SB 1815 establishes Arizona's first comprehensive data privacy law for businesses handling consumer personal data. It directly affects businesses operating in Arizona that process personal data of state residents, requiring them to obtain clear, affirmative consumer consent for data processing and prohibiting deceptive "dark patterns" that trick users into sharing data. Key provisions define sensitive data types (like biometrics and precise location), set strict standards for valid consent, and ban practices that subvert user choice. The law also restricts the "sale" of personal data and includes specific exemptions for health records and publicly available information.