WHAT THIS BILL REGULATES · 6 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
In this article, unless the context otherwise requires: 1. "AdvertisementAdvertisement"Advertisement" (a) Means Any written or oral statement, illustration or depiction that is displayed in exchange for monetary or other valuable consideration if the written or oral statement, illustration or depiction does either of the following: (i) Promotes the sale or use of a good or service. (ii) Is designed to increase interest in a brand, good or service. (b) Includes access to data between the chatbot provider and a brand, good or service.A.R.S. § 44-1383(1)": (a) Means Any written or oral statement, illustration or depiction that is displayed in exchange for monetary or other valuable consideration if the written or oral statement, illustration or depiction does either of the following: (i) Promotes the sale or use of a good or service. (ii) Is designed to increase interest in a brand, good or service. (b) Includes access to data between the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) and a brand, good or service. 2. "Affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2)": (a) means a clear affirmative act that signifies a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4), if: (i) The request is provided to the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) with disabilities. (iv) The request is made available to the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) in each language in which the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) provides a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3). (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2) to an act or practice may not be inferred from the inaction of the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) or the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s continued use of a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3). (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patternsDark pattern"Dark pattern" means a user interface that is designed or manipulated to subvert or impair a user's autonomy, decision-making or choice.A.R.S. § 44-1383(6). 3. "ChatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3)": (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence. 4. "Chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4)" means any person that creates, distributes or otherwise makes a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) available to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). 5. "Chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5)" means both of the following: (a) Input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) or a record of the input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8). (b) Output data that is generated by a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) or from interactions with a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3). 6. "Dark patternDark pattern"Dark pattern" means a user interface that is designed or manipulated to subvert or impair a user's autonomy, decision-making or choice.A.R.S. § 44-1383(6)" means a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) interface that is designed or manipulated to subvert or impair a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s autonomy, decision-making or choice. 7. "De-identified dataDe-identified data"De-identified data" Means information that: (a) cannot reasonably be used to infer or derive the identity of a user. (b) does not identify a user. (c) is not linked or is reasonably linkable to a user.A.R.S. § 44-1383(7)" Means information that: (a) cannot reasonably be used to infer or derive the identity of a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (b) does not identify a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (c) is not linked or is reasonably linkable to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). 8. "Input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8)": (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) by a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). 9. "ModelModel"Model" means an engineered or machine-based system underlying a chatbot and that is based on the input data that it receives and that can infer how to generate output data that can influence physical or virtual environments.A.R.S. § 44-1383(9)" means an engineered or machine-based system underlying a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) and that is based on the input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) that it receives and that can infer how to generate output data that can influence physical or virtual environments. 10. "Personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10)": (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (ii) A device that identifies or is linked or is reasonably linkable to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (b) Does not include de-identified dataDe-identified data"De-identified data" Means information that: (a) cannot reasonably be used to infer or derive the identity of a user. (b) does not identify a user. (c) is not linked or is reasonably linkable to a user.A.R.S. § 44-1383(7) or publicly available informationPublicly available information"Publicly available information" (a) Means information that has been lawfully made available to the public subject to a public records request pursuant to title 39, chapter 1. (b) Does not include: (i) Obscene items as prescribed in title 13, chapter 35. (ii) Biometric data. (iii) Personal data that is created through the combination of personal data and publicly available information. (iv) Genetic data, unless the genetic data was made available to the public by the user to whom the genetic data pertains. (v) Information that is made available to the public by a user who uses a website or online platform on which the user has restricted the information to a specific audience. (vi) Intimate images that are either authentic or computer generated and that are known to be nonconsensual.A.R.S. § 44-1383(11). 11. "Publicly available informationPublicly available information"Publicly available information" (a) Means information that has been lawfully made available to the public subject to a public records request pursuant to title 39, chapter 1. (b) Does not include: (i) Obscene items as prescribed in title 13, chapter 35. (ii) Biometric data. (iii) Personal data that is created through the combination of personal data and publicly available information. (iv) Genetic data, unless the genetic data was made available to the public by the user to whom the genetic data pertains. (v) Information that is made available to the public by a user who uses a website or online platform on which the user has restricted the information to a specific audience. (vi) Intimate images that are either authentic or computer generated and that are known to be nonconsensual.A.R.S. § 44-1383(11)": (a) Means information that has been lawfully made available to the public subject to a public records request pursuant to title 39, chapter 1. (b) Does not include: (i) Obscene items as prescribed in title 13, chapter 35. (ii) Biometric data. (iii) Personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) that is created through the combination of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) and publicly available informationPublicly available information"Publicly available information" (a) Means information that has been lawfully made available to the public subject to a public records request pursuant to title 39, chapter 1. (b) Does not include: (i) Obscene items as prescribed in title 13, chapter 35. (ii) Biometric data. (iii) Personal data that is created through the combination of personal data and publicly available information. (iv) Genetic data, unless the genetic data was made available to the public by the user to whom the genetic data pertains. (v) Information that is made available to the public by a user who uses a website or online platform on which the user has restricted the information to a specific audience. (vi) Intimate images that are either authentic or computer generated and that are known to be nonconsensual.A.R.S. § 44-1383(11). (iv) Genetic data, unless the genetic data was made available to the public by the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) to whom the genetic data pertains. (v) Information that is made available to the public by a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) who uses a website or online platform on which the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) has restricted the information to a specific audience. (vi) Intimate images that are either authentic or computer generated and that are known to be nonconsensual. 12. "ProcessProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12)" or "processing": (a) Means any operation or set of operations that are performed on personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8). (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8). 13. "ProfilingProfiling"Profiling" (a) Means to process personal data or input data to classify or designate personality traits and behavioral characteristics of a user. (b) Does not include processing chat logs for user safety or to otherwise comply with this article.A.R.S. § 44-1383(13)": (a) Means to processProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) to classify or designate personality traits and behavioral characteristics of a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (b) Does not include processing chat logsChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) for userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) safety or to otherwise comply with this article. 14. "SellSell"Sell" (a) Means either of the following: (i) The exchange of personal data or input data for monetary or other valuable consideration. (ii) To make personal data or input data available to a third party for monetary or other valuable consideration. (b) Does not include any of the following: (i) The disclosure of personal data or input data to a third party that processes the personal data or input data on behalf of the chatbot provider. (ii) The disclosure of personal data or input data where the user provides affirmative consent and directs the chatbot provider to disclose the personal data or input data or intentionally uses the chatbot provider to interact with a third party. (iii) The disclosure of personal data or input data that the user intentionally made available to the public through social media and did not restrict the information to a specific audience.A.R.S. § 44-1383(14)": (a) Means either of the following: (i) The exchange of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) for monetary or other valuable consideration. (ii) To make personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) available to a third party for monetary or other valuable consideration. (b) Does not include any of the following: (i) The disclosure of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) to a third party that processesProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) the personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) on behalf of the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4). (ii) The disclosure of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) where the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) provides affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2) and directs the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) to disclose the personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) or intentionally uses the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) to interact with a third party. (iii) The disclosure of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) or input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) that the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) intentionally made available to the public through social media and did not restrict the information to a specific audience. 15. "TrainingTraining"Training" (a) Means the use of input data to adjust or modify a model. (b) Does not include: (i) Tests that are used to identify risk of harm to users. (ii) Adjustments or modifications that are made to address identified risk of harm to users. (iii) Any action that is necessary to comply with this article or as otherwise required by law.A.R.S. § 44-1383(15)": (a) Means the use of input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) to adjust or modify a modelModel"Model" means an engineered or machine-based system underlying a chatbot and that is based on the input data that it receives and that can infer how to generate output data that can influence physical or virtual environments.A.R.S. § 44-1383(9). (b) Does not include: (i) Tests that are used to identify risk of harm to usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (ii) Adjustments or modifications that are made to address identified risk of harm to usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (iii) Any action that is necessary to comply with this article or as otherwise required by law. 16. "UserUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)" means any natural person regardless of age.
Section 44-1383 establishes the definitional framework for the ChatBot Protection Act. Key definitions include chatbot (broadly defined as any algorithmic or automated system that generates information through text, audio, image, or video simulating interpersonal interactions), chatbot provider (any person that creates, distributes, or makes a chatbot available), and affirmative consent (a rigorous opt-in standard that prohibits dark patterns, requires stand-alone disclosure, and cannot be inferred from inaction or continued use).
The definition of user as any natural person regardless of age, combined with the separate minor-specific protections in § 44-1383.01, means the bill applies to all users with heightened obligations for minors. The training definition notably carves out safety testing and compliance-related model adjustments, preserving providers' ability to address harms without triggering consent requirements.
(A)(1) 1 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 1. ProcessProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) to inform a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) output unless processing personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) is necessary to fulfill an express request that is made by a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) and the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) provides affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2).
(A)(2) 2 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 2. ProcessProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5): (a) To determine whether to display an advertisementAdvertisement"Advertisement" (a) Means Any written or oral statement, illustration or depiction that is displayed in exchange for monetary or other valuable consideration if the written or oral statement, illustration or depiction does either of the following: (i) Promotes the sale or use of a good or service. (ii) Is designed to increase interest in a brand, good or service. (b) Includes access to data between the chatbot provider and a brand, good or service.A.R.S. § 44-1383(1) for a product or service to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (b) To determine a product or service or category of a product or service to advertise to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (c) To customize an advertisementAdvertisement"Advertisement" (a) Means Any written or oral statement, illustration or depiction that is displayed in exchange for monetary or other valuable consideration if the written or oral statement, illustration or depiction does either of the following: (i) Promotes the sale or use of a good or service. (ii) Is designed to increase interest in a brand, good or service. (b) Includes access to data between the chatbot provider and a brand, good or service.A.R.S. § 44-1383(1) for presentation to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16).
(A)(3)(a)–(b) 3 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 3. ProcessProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) and personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10): (a) If the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) knows or reasonably should have known that based on knowledge of objective circumstances the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) is a minor and the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s parent or legal guardian did not provide affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2). (b) For trainingTraining"Training" (a) Means the use of input data to adjust or modify a model. (b) Does not include: (i) Tests that are used to identify risk of harm to users. (ii) Adjustments or modifications that are made to address identified risk of harm to users. (iii) Any action that is necessary to comply with this article or as otherwise required by law.A.R.S. § 44-1383(15) purposes if the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) knows or reasonably should have known that based on knowledge of objective circumstances the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) is a minor and the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s parent or legal guardian did not provide affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2).
(A)(3)(c) 4 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 3. ProcessProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) and personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10): (c) for trainingTraining"Training" (a) Means the use of input data to adjust or modify a model. (b) Does not include: (i) Tests that are used to identify risk of harm to users. (ii) Adjustments or modifications that are made to address identified risk of harm to users. (iii) Any action that is necessary to comply with this article or as otherwise required by law.A.R.S. § 44-1383(15) purposes if the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) is an adult, unless the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) first obtains affirmative consentAffirmative consent"Affirmative consent" (a) means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if: (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure. (ii) The request includes a description that is written in easily understandable language. (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities. (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot. (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent. (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot. (b) Does not include: (i) Acceptance given by general or broad terms of use. (ii) Hovering over, muting, pausing or closing a given piece of content. (iii) An agreement that is obtained through the use of a false, fraudulent or materially misleading statement or representation. (iv) An agreement that is obtained through the use of other dark patterns.A.R.S. § 44-1383(2).
(A)(3)(d) 5 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 3. ProcessProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12) a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) and personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10): (d) To engage in profilingProfiling"Profiling" (a) Means to process personal data or input data to classify or designate personality traits and behavioral characteristics of a user. (b) Does not include processing chat logs for user safety or to otherwise comply with this article.A.R.S. § 44-1383(13) beyond what is necessary to fulfill an express request.
(A)(4) 5 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 4. Profile a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) based on any classification or designation of the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s personality or behavioral characteristic beyond what is necessary to fulfill an express request made by the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16).
(A)(5) 6 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 5. SellSell"Sell" (a) Means either of the following: (i) The exchange of personal data or input data for monetary or other valuable consideration. (ii) To make personal data or input data available to a third party for monetary or other valuable consideration. (b) Does not include any of the following: (i) The disclosure of personal data or input data to a third party that processes the personal data or input data on behalf of the chatbot provider. (ii) The disclosure of personal data or input data where the user provides affirmative consent and directs the chatbot provider to disclose the personal data or input data or intentionally uses the chatbot provider to interact with a third party. (iii) The disclosure of personal data or input data that the user intentionally made available to the public through social media and did not restrict the information to a specific audience.A.R.S. § 44-1383(14) a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat logsChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5).
(A)(6) 7 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 6. Retain a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) for more than ten years, unless retention is necessary to comply with this article or otherwise required by law.
(A)(7) 8 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 7. Discriminate or retaliate against a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16), including: (a) Denying products or services to the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (b) Charging different prices or rates for products or services to the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (c) Providing lower quality products or service to the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) for refusing to consent to the use of chat logsChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) or personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) for trainingTraining"Training" (a) Means the use of input data to adjust or modify a model. (b) Does not include: (i) Tests that are used to identify risk of harm to users. (ii) Adjustments or modifications that are made to address identified risk of harm to users. (iii) Any action that is necessary to comply with this article or as otherwise required by law.A.R.S. § 44-1383(15) purposes.
(B) 9 A userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) has a right to access the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s own chat logsChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) at any time. A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) shall provide a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s own chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) on request by the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) and shall provide the chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) in a downloadable and easy to read format. A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not discriminate or retaliate against a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) pursuant to subsection A paragraph 7 of this section that requests the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s chat.
(C) 10 A government entity may not compel the production of or access to input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) or chat logsChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) from a chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4), except as pursuant to a wiretap warrant.
(D) 11 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) shall develop, implement and maintain a comprehensive data security program that contains administrative, technical and physical safeguards that are proportionate to the volume and nature of personal dataPersonal data"Personal data" (a) Means either of the following: (i) Any information, including derived data, that is linked or reasonably linkable either by itself or in combination with other information to an identified or identifiable user. (ii) A device that identifies or is linked or is reasonably linkable to a user. (b) Does not include de-identified data or publicly available information.A.R.S. § 44-1383(10) and chat logsChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) that are maintained by the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4). The program shall be written and made publicly available on the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4)'s website.
(E) 12 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) shall take the necessary physical, administrative and technical measures to prevent de-identified dataDe-identified data"De-identified data" Means information that: (a) cannot reasonably be used to infer or derive the identity of a user. (b) does not identify a user. (c) is not linked or is reasonably linkable to a user.A.R.S. § 44-1383(7) from being re-identified and to processProcess"Process" or "processing" (a) Means any operation or set of operations that are performed on personal data or input data. (b) Includes the use, storage, disclosure, analysis, deletion or modification of personal data or input data.A.R.S. § 44-1383(12), retain and transfer de-identified dataDe-identified data"De-identified data" Means information that: (a) cannot reasonably be used to infer or derive the identity of a user. (b) does not identify a user. (c) is not linked or is reasonably linkable to a user.A.R.S. § 44-1383(7) without any reasonable means of re-identification.
Section 44-1383.01 is the bill's core data governance section, imposing a series of prohibitions and affirmative requirements on chatbot providers. Subsection (A) establishes seven categories of prohibited conduct: processing personal data for chatbot output without affirmative consent; using chat logs for advertising purposes; processing minor users' chat logs or personal data without parental consent; using adult chat logs for training without consent; profiling beyond what is necessary; selling chat logs; retaining chat logs beyond ten years; and discriminating or retaliating against users who decline consent.
Subsection (B) creates a user right of access to their own chat logs in a downloadable, easy-to-read format. Subsection (C) restricts government access to input data or chat logs, permitting compelled production only pursuant to a wiretap warrant. Subsection (D) imposes a comprehensive data security program obligation with a public transparency component. Subsection (E) requires safeguards against re-identification of de-identified data.
(A)(1) 13 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 1. Use any term, letter or phrase in the advertising, interface or output data of a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) that states or implies that the advertising, interface or output data of a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) is endorsed by or equivalent to any of the following: (a) Any certified, registered or licensed professional pursuant to title 32. (b) A licensed legal professional. (c) A certified public accountant as defined in section 32-701. (d) An investment advisor or an investment adviser representative as defined in section 44-3101. (e) A licensed fiduciary as prescribed in title 14, chapter 5, article 7.
(A)(2) 14 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) may not: 2. Include any representation in the advertising, interface or output data of a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) that states or implies the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16)'s input dataInput data"Input data" (a) Means information. (b) Includes: (i) Texts. (ii) Photos. (iii) Audio files. (iv) Video files. (v) Any type of file that is provided to a chatbot by a user.A.R.S. § 44-1383(8) or chat logChat log"Chat log" means both of the following: (a) Input data or a record of the input data. (b) Output data that is generated by a chatbot or from interactions with a chatbot.A.R.S. § 44-1383(5) is confidential.
(B) 15 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) shall provide clear, conspicuous and explicit notice to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) that the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) is interacting with a chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) rather than a natural person before the chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) may generate any output data. The chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) shall include this notice at the beginning of each chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) communication with a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16), every hour thereafter and each time a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) asks whether the chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) is a natural person. The text of the notice: 1. shall be written in the same language that the chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) communicates with the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) and shall appear in a font size that is easily readable by an average userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) and is not smaller than the largest font size used for other chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) communications. 2. must comply with the rules adopted by the attorney general pursuant to section 44-1383.03.
(C)(1)–(2) 16 In compliance with the rules adopted by the attorney general pursuant to section 44-1383.03, A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) shall: 1. On a monthly basis: (a) Evaluate its chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) for potential risk of harm to usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). (b) Make information about its chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) publicly available on its website. 2. Mitigate any risk of harm to usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16).
Section 44-1383.02 imposes two categories of obligations: professional endorsement prohibitions and AI identity disclosure requirements. Subsection (A)(1) prohibits chatbot providers from implying that chatbot output is endorsed by or equivalent to licensed professionals across five enumerated categories. Subsection (A)(2) prohibits representations that user input data or chat logs are confidential.
Subsection (B) creates a robust AI identity disclosure regime requiring notice before any output is generated, at the beginning of each communication, hourly thereafter, and on demand when a user asks. The notice must be in the same language as the chatbot communication and in a font size at least as large as other chatbot communications. Subsection (C) requires monthly risk-of-harm evaluations and public website disclosures, plus mitigation of identified risks.
(A)–(B) A. The attorney general shall adopt rules to implement this article. The rules shall: 1. Describe the form and content of the notice that is required pursuant to section 44-1383.02. 2. Provide an example template for the notice that is required pursuant to section 44-1383.02. 3. Describe any potential risk of harm to usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). 4. Provide requirements for a chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) to implement to reduce the risk of harm to usersUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16). B. The attorney general may adopt any other rules necessary to implement this article.
Section 44-1383.03 directs the attorney general to adopt implementing rules for the ChatBot Protection Act. The mandatory rulemaking must address four specific areas: the form and content of the AI identity notice, a template for the notice, a description of potential risks of harm to users, and requirements for chatbot providers to reduce those risks. The attorney general also has discretionary authority to adopt additional implementing rules.
This section creates no independent compliance obligation for chatbot providers but is critical infrastructure — several obligations in § 44-1383.02 are expressly conditioned on compliance with the rules adopted under this section.
(A) 17 A chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) is considered a product for the purposes of a product liability action as prescribed in title 12, chapter 6, article 9.
(B) 18 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) has a duty to ensure that the use of the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4)'s does not cause injury to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16).
(C) 18 A chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) is liable for any injury that the chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) causes to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) if either of the following occurs: 1. The chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) exercised all reasonable care in the design and distribution of the chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3). 2. The chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) did not directly distribute the chatbotChatbot"Chatbot" (a) Means an algorithmic or automated system that generates information through text, audio, image or video in a manner that simulates interpersonal interactions or conversation. (b) Includes artificial intelligence.A.R.S. § 44-1383(3) to the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) or otherwise enter into a contractual relationship with the userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16).
Section 44-1383.04 designates chatbots as products for the purposes of Arizona product liability law (Title 12, Chapter 6, Article 9) and imposes a duty on chatbot providers to ensure their chatbot does not cause injury to users. Subsection (C) states that a chatbot provider is liable for injury caused by the chatbot even when the provider exercised all reasonable care or did not directly distribute the chatbot to the user.
This appears to impose strict liability — the provider is liable regardless of whether it exercised reasonable care and regardless of privity of contract. The phrasing of subsection (C) is unusual in that it uses "if either of the following occurs" followed by conditions that are typically defenses to liability (exercise of reasonable care, lack of direct distribution), suggesting an intentional elimination of those defenses or a possible drafting error.
(A) The attorney general or a county attorney may bring a civil action against a chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4) that violates this article and that includes any of the following: 1. Enjoining an act or practice in violation of this article. 2. Enforcing compliance with this article or a rule adopted pursuant to this article. 3. Obtaining damages, civil penalties, restitution or other remedies. 4. Obtaining reasonable attorney fees and other litigation costs.
(B) A violation of section 44-1383.01 or 44-1383.02 constitutes an injury in fact to a userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16).
(C) A userUser"User" means any natural person regardless of age.A.R.S. § 44-1383(16) who is injured by a violation of section 44-1383.01 or 44-1383.02 may bring a civil action against the chatbot providerChatbot provider"Chatbot provider" means any person that creates, distributes or otherwise makes a chatbot available to a user.A.R.S. § 44-1383(4), and a court of competent jurisdiction may award a prevailing plaintiff any of the following: 1. A civil penalty of not more than $5,000 per violation of this article. 2. Punitive damages for reckless and knowing conduct. 3. Injunctive relief. 4. Declaratory relief. 5. Reasonable attorney fees and litigation costs.
Section 44-1383.05 establishes the enforcement framework for the ChatBot Protection Act. Subsection (A) authorizes the attorney general or county attorney to bring civil actions for injunctions, compliance enforcement, damages, civil penalties, restitution, and attorney fees. Subsection (B) provides that a violation of § 44-1383.01 or § 44-1383.02 constitutes an injury in fact, effectively eliminating the standing barrier for private plaintiffs. Subsection (C) creates a private right of action allowing injured users to seek civil penalties up to $5,000 per violation, punitive damages for reckless and knowing conduct, injunctive and declaratory relief, and attorney fees.