KLS Keeping Law Simple Legislation in plain English

Straight-ahead summaries built from the official bill text. We keep the source links front and center and leave the decision up to you.

Back to Arizona

SB1717 • 2026

biometric identifiers; commercial use; prohibitions

SB1717 - biometric identifiers; commercial use; prohibitions

Passed Legislature

This bill passed both chambers and reached final enrollment, even if later executive action is not shown here.

Sponsor
Lauren Kuby, Lela Alston, Eva Diaz, Sally Ann Gonzales, Theresa Hatathlie, Catherine Miranda, Analise Ortiz, Priya Sundareshan
Last action
2026-02-09
Official status
Senate second read
Effective date
Not listed

Plain English Breakdown

Checked against official source text during the last sync.

Biometric Identifiers: Rules for Commercial Use

This bill sets rules about how businesses can use biometric data like fingerprints and face scans, requiring them to inform people before collecting such information and limiting how they can share or store it.

What This Bill Does

  • Defines what a 'biometric identifier' is, including things like fingerprints, iris scans, voiceprints, hand geometry, and face geometry.
  • Requires businesses to tell individuals before capturing their biometric data for commercial purposes and get their consent.
  • Limits the ways businesses can sell, lease, or share biometric identifiers without specific exceptions such as legal requirements or individual consent.
  • Requires businesses to protect biometric data with reasonable care and destroy it within a year after its purpose expires, unless required by law to keep it longer.

Who It Names or Affects

  • Businesses that collect biometric data for commercial purposes
  • Individuals whose biometric data is collected

Terms To Know

Biometric Identifier
A unique biological characteristic like a fingerprint, iris scan, voiceprint, hand geometry, or face geometry used to identify individuals.
Commercial Purpose
Using biometric data for business activities such as marketing or security.

Limits and Unknowns

  • The bill does not specify the exact penalties for violations beyond a maximum of $25,000 per violation.
  • It is unclear how businesses will be required to inform individuals about their biometric data collection practices in detail.

Bill History

  1. 2026-02-09 Senate

    Senate second read

  2. 2026-02-05 Senate

    Senate Rules: None

  3. 2026-02-05 Senate

    Senate Government: None

  4. 2026-02-05 Senate

    Senate first read

Official Summary Text

SB1717 - biometric identifiers; commercial use; prohibitions

Current Bill Text

Read the full stored bill text 
SB1717 - 572R - I Ver

REFERENCE TITLE:
biometric identifiers; commercial use; prohibitions

State of Arizona

Senate

Fifty-seventh Legislature

Second Regular Session

2026

SB 1717

Introduced by

Senators
Kuby: Alston, Diaz, Gonzales, Hatathlie, Miranda, Ortiz, Sundareshan

AN
ACT

amending title 44, chapter 9, arizona
revised statutes, by adding article 27; relating to consumer data.

(TEXT OF BILL BEGINS ON NEXT PAGE)

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 44, chapter 9, Arizona Revised
Statutes, is amended by adding article 27, to read:

ARTICLE 27. consumer biometric
DATA

START_STATUTE
44-1383.

Definitions

In this article, unless the context otherwise
requires:

1. "Artificial
intelligence system" means any machine-based system that, for any explicit
or implicit objective, infers from the inputs the system receives how to
generate outputs, including content, decisions, predictions AND
recommendations.

2. "Biometric
identifier" means a retina or iris scan, fingerprint, voiceprint record of
hand or face geometry or unique biological pattern or characteristic.
END_STATUTE

START_STATUTE
44-1383.01.

Biometric identifiers; commercial purpose; prohibited use; civil
penalty

A. A
person may not capture an individual'S biometric identifier for a commercial
purpose unless the person does both of the following:

1. informs
the individual before capturing the biometric identifier.

2. Receives
the individual's consent to capture the biometric identifier.

b. For
the purposes of Subsection A of this section, an individual has not been
informed of and has not provided consent for the capture or storage of the
individual's biometric identifier for a commercial purpose based solely on the
existence of an image or other mediUM containing one or more biometric
identifiers of the individual on the Internet or another publicly available
source unless the image or other medium was made publicly available by the
individual to whom the biometric identifiers relate.

c. A
person that possesses an individual's biometric identifier that is captured for
a commercial purpose:

1. may
not sell, lease or otherwise disclose the biometric identifier to another
person unless one of the following applies:

(
a
) the individual consents to the disclosure for
identification purposes in the event of the individual's disappearance or
death.

(
b
) the disclosure completes a financial transaction that the
individual requested or authorized.

(
c
) the disclosure is required or allowed by a federal
statute or by a state statute other than title 39, chapter 1.

(
d
)� the disclosure is
made by or to a law enforcement agency for a law enforcement purpose in
response to a warrant.

2. shall
store, transmit and protect from disclosure the biometric identifier using
reasonable care in a manner that is the same as or more protective than the
manner in which the person stores, transmits and protects any other
confidential information the person possesses.

3. shall
destroy the biometric identifier within a reasonable time but not later than
the first anniversary of the date the purpose for collecting the biometric
identifier expires, except as provided by Subsection D of this section.

D. If an
individual's biometric identifier that is captured for a commercial purpose is
used in connection with an instrument or document that is required by another
law to be maintained for a period longer than the period prescribed by Subsection
C, paragraph 3 of this section, the person that possesses the biometric
identifier shall destroy the biometric identifier within a reasonable time but
not later than the first anniversary of the date the instrument or document is
no longer required to be maintained by law.

E. If an
individual'S biometric identifier that is captured for a commercial purpose has
been collected for security purposes by an employer, the purpose for collecting
the biometric identifier under Subsection C, paragraph 3 of this section is
presumed to expire on termination of the employment relationship.

F. A
person THAT violates this section is subject to a civil penalty of not more
than $25,000 for each violation.� The attorney general may bring an action to
recover the civil penalty.
END_STATUTE