language: en · status: in-force · last checked: 2026-10-08

Arizona — student data privacy (A.R.S. §15-1046)

Arizona's SOPIPA-style operator statute, in Title 15 (Education), added by Laws 2017, ch. 180 (SB 1314), approved by the Governor on 21 April 2017; the act names no effective date, so it took effect on the 53rd Legislature, First Regular Session's general effective date, 9 August 2017, under Ariz. Const. art. IV, pt. 1, §1(3). It binds the operator of an internet website, online service, online application or mobile application that knows the service is used primarily for school purposes and was designed and marketed for them. It prohibits targeted advertising, profiling, sale and most disclosure of covered information; requires reasonable security, deletion at the school's request and notice of privacy-policy changes; and is enforced by the Attorney General as an unlawful practice under the Consumer Fraud Act. It also requires each local education agency to adopt a technology-use policy that tells parents they can opt their child out.

Applicability to EdTech

• Who is an operator. The operator of a site, service or application "with actual knowledge that the site, service or application is used primarily for school purposes and was designed and marketed for school purposes" (§15-1046(I)(3)). General-audience services are expressly outside the section (§15-1046(F)(2)).
• Covered information is wide. It includes information gathered through the service that personally identifies a student, with "biometric information", "photos, voice recordings or geographic information", "search activity" and "text messages" listed (§15-1046(I)(1)(c)). Audio captured by a voice-enabled classroom device, or the location and usage data of a headset, falls within the list.
• Four prohibitions, each limited to what the operator does "knowingly": targeted advertising based on information acquired through school use; amassing a profile except in furtherance of school purposes; selling or renting student information; and disclosing covered information except for the listed purposes (§15-1046(A)). Disclosure to a sub-processor is allowed only under a contract that limits its use, prohibits onward disclosure and requires reasonable security (§15-1046(A)(4)(f)).
• Three duties: reasonable security procedures appropriate to the covered information; deletion within a reasonable time at the public school's request; and prominent notice before material changes to privacy policies (§15-1046(C)).
• Product use stays allowed. Maintaining, developing, supporting, improving or diagnosing the service, and adaptive or customised learning (§15-1046(B)); de-identified data for product improvement and for demonstrating effectiveness, including in marketing (§15-1046(E)).
• Parents can opt out at district level. The LEA's technology policy must notify parents of their "ability to prohibit the student from the use of technology and the internet while at school in which covered information may be shared with an operator" (§15-1046(H)). An Arizona deployment should expect some pupils to be opted out and should not need their data in order to run the class session.

Contents

Key obligations at a glance

• No targeted advertising, non-school profiling, sale or unpermitted disclosure — §15-1046(A).
• Reasonable security; delete on the school's request; notice before material privacy-policy changes — §15-1046(C).
• Sub-processors bound by contract to purpose, non-disclosure and security — §15-1046(A)(4)(f).

Enforcement

A violation "constitutes an unlawful practice under section 44-1522", and the Attorney General may investigate and act under title 44, chapter 10, article 7 (the Consumer Fraud Act), in addition to any other enforcement authorised by law (§15-1046(G)).

Licence

The corpus reproduces A.R.S. §15-1046 verbatim from the Arizona Legislative Council's page on azleg.gov (read 2026-10-08), which carries no copyright notice.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in the fact document's {.meta} provenance line, and its Meta section describes what it changed (anchors added, whitespace collapsed, nothing reworded).

Related

• Arizona consent for biometric information and recordings (A.R.S. §15-109, §1-602) — the school-side consent rules for biometric and voice data
• SDPC Arizona state terms — the Arizona exhibit to the National Data Privacy Agreement
• California SOPIPA — the model §15-1046 follows closely

Sources

• Arizona State Legislature — A.R.S. §15-1046
• Arizona State Legislature — Laws 2017, ch. 180 (SB 1314) — adds §15-1046; "APPROVED BY THE GOVERNOR APRIL 21, 2017"; no effective-date section
• Arizona State Legislature — General effective dates — the general effective date of each session: "2017 Fifty-third Legislature - First Regular Session 08-09-2017"
• Arizona State Legislature — Constitution of Arizona, art. IV, pt. 1, §1 — subsection (3): "no act passed by the legislature shall be operative for ninety days after the close of the session of the legislature enacting such measure", save emergency and appropriation measures