KLS Keeping Law Simple Legislation in plain English

Straight-ahead summaries built from the official bill text. We keep the source links front and center and leave the decision up to you.

Back to Arizona

SB1717 • 2026

biometric identifiers; commercial use; prohibitions

SB1717 - biometric identifiers; commercial use; prohibitions

Passed Legislature

This bill passed both chambers and reached final enrollment, even if later executive action is not shown here.

Sponsor
Lauren Kuby, Lela Alston, Eva Diaz, Sally Ann Gonzales, Theresa Hatathlie, Catherine Miranda, Analise Ortiz, Priya Sundareshan
Last action
2026-02-09
Official status
Senate second read
Effective date
Not listed

Plain English Breakdown

The effective date of this law is not provided in the source material.

Rules on Using Biometric Data for Business

This law stops businesses from collecting biometric data like fingerprints and face scans without telling people first and getting their permission.

What This Bill Does

  • Requires companies to tell a person before they collect their biometric identifier for business use.
  • Mandates that companies get the individual's consent before capturing any biometric data.
  • Prohibits selling, leasing, or sharing biometric data unless specific exceptions apply, such as law enforcement warrants or financial transactions requested by the individual.
  • Orders businesses to protect stored biometric data with reasonable care at least equal to how they protect other confidential information.
  • Sets a deadline for destroying biometric data within one year after the reason for collecting it ends.

Who It Names or Affects

  • People or companies that collect biometric identifiers for commercial purposes
  • Individuals whose retina scans, fingerprints, voiceprints, hand geometry, face geometry, or other unique biological patterns are collected

Terms To Know

Biometric identifier
A retina or iris scan, fingerprint, voiceprint record of hand or face geometry, or a unique biological pattern.
Commercial purpose
Using data for business activities rather than personal use.

Limits and Unknowns

  • The law does not state a specific date when it will officially take effect.
  • It is unclear how the term 'reasonable time' for destroying data will be measured in court cases, as long as it happens within one year of the purpose ending.

Bill History

  1. 2026-02-09 Senate

    Senate second read

  2. 2026-02-05 Senate

    Senate Rules: None

  3. 2026-02-05 Senate

    Senate Government: None

  4. 2026-02-05 Senate

    Senate first read

Official Summary Text

SB1717 - biometric identifiers; commercial use; prohibitions

Current Bill Text

Read the full stored bill text 
SB1717 - 572R - I Ver

REFERENCE TITLE:
biometric identifiers; commercial use; prohibitions

State of Arizona

Senate

Fifty-seventh Legislature

Second Regular Session

2026

SB 1717

Introduced by

Senators
Kuby: Alston, Diaz, Gonzales, Hatathlie, Miranda, Ortiz, Sundareshan

AN
ACT

amending title 44, chapter 9, arizona
revised statutes, by adding article 27; relating to consumer data.

(TEXT OF BILL BEGINS ON NEXT PAGE)

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 44, chapter 9, Arizona Revised
Statutes, is amended by adding article 27, to read:

ARTICLE 27. consumer biometric
DATA

START_STATUTE
44-1383.

Definitions

In this article, unless the context otherwise
requires:

1. "Artificial
intelligence system" means any machine-based system that, for any explicit
or implicit objective, infers from the inputs the system receives how to
generate outputs, including content, decisions, predictions AND
recommendations.

2. "Biometric
identifier" means a retina or iris scan, fingerprint, voiceprint record of
hand or face geometry or unique biological pattern or characteristic.
END_STATUTE

START_STATUTE
44-1383.01.

Biometric identifiers; commercial purpose; prohibited use; civil
penalty

A. A
person may not capture an individual'S biometric identifier for a commercial
purpose unless the person does both of the following:

1. informs
the individual before capturing the biometric identifier.

2. Receives
the individual's consent to capture the biometric identifier.

b. For
the purposes of Subsection A of this section, an individual has not been
informed of and has not provided consent for the capture or storage of the
individual's biometric identifier for a commercial purpose based solely on the
existence of an image or other mediUM containing one or more biometric
identifiers of the individual on the Internet or another publicly available
source unless the image or other medium was made publicly available by the
individual to whom the biometric identifiers relate.

c. A
person that possesses an individual's biometric identifier that is captured for
a commercial purpose:

1. may
not sell, lease or otherwise disclose the biometric identifier to another
person unless one of the following applies:

(
a
) the individual consents to the disclosure for
identification purposes in the event of the individual's disappearance or
death.

(
b
) the disclosure completes a financial transaction that the
individual requested or authorized.

(
c
) the disclosure is required or allowed by a federal
statute or by a state statute other than title 39, chapter 1.

(
d
)� the disclosure is
made by or to a law enforcement agency for a law enforcement purpose in
response to a warrant.

2. shall
store, transmit and protect from disclosure the biometric identifier using
reasonable care in a manner that is the same as or more protective than the
manner in which the person stores, transmits and protects any other
confidential information the person possesses.

3. shall
destroy the biometric identifier within a reasonable time but not later than
the first anniversary of the date the purpose for collecting the biometric
identifier expires, except as provided by Subsection D of this section.

D. If an
individual's biometric identifier that is captured for a commercial purpose is
used in connection with an instrument or document that is required by another
law to be maintained for a period longer than the period prescribed by Subsection
C, paragraph 3 of this section, the person that possesses the biometric
identifier shall destroy the biometric identifier within a reasonable time but
not later than the first anniversary of the date the instrument or document is
no longer required to be maintained by law.

E. If an
individual'S biometric identifier that is captured for a commercial purpose has
been collected for security purposes by an employer, the purpose for collecting
the biometric identifier under Subsection C, paragraph 3 of this section is
presumed to expire on termination of the employment relationship.

F. A
person THAT violates this section is subject to a civil penalty of not more
than $25,000 for each violation.� The attorney general may bring an action to
recover the civil penalty.
END_STATUTE