Does Arizona have a privacy law that applies to car dealers?

Arizona has no comprehensive consumer privacy law as of October 31, 2026. Dealers that arrange financing or leases still give the federal GLBA privacy notice.

What federal compliance rules apply to Arizona car dealers?

The FTC Safeguards Rule, the Red Flags Rule, the GLBA privacy notice, OFAC sanctions checks, Form 8300 for cash over $10,000, adverse action and risk-based pricing notices, the Used Car Rule's Buyers Guide, and the FTC's pricing rules for ads.

Arizona Dealer Compliance Checklist (2026)

Q: How fast must an Arizona car dealer report a data breach?

Arizona's law (Ariz. Rev. Stat. § 18-552) says to notify affected residents within 45 days after an investigation determines there has been a security system breach (subject to law-enforcement delay). Also tell the Attorney General and Director of the Arizona Department of Homeland Security (plus the three largest nationwide consumer reporting agencies). If the breach requires notifying more than 1,000 individuals; within 45 days after the determination. Separately, the FTC Safeguards Rule asks for an FTC notice within 30 days when 500 or more consumers are affected.

At a glance

Breach notice to residents: 45 days at most
State regulator notice: Attorney General and Director of the Arizona Department of Homeland Security (plus the three largest nationwide consumer reporting agencies)
State consumer privacy law: None

On this page

Federal rules every dealer follows
Arizona's data breach notice law
Does Arizona have a consumer privacy law?
Arizona dealer compliance checklist
Rules checked and limits
Common questions
Sources

Federal rules every dealer follows

These apply in every state. Each links to a free tool or guide.

FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.

Arizona's data breach notice law

Arizona's breach notice law is Ariz. Rev. Stat. § 18-552. If personal information of Arizona residents is breached, it says to notify them within 45 days after an investigation determines there has been a security system breach (subject to law-enforcement delay).

Who else to tell: the Attorney General and Director of the Arizona Department of Homeland Security (plus the three largest nationwide consumer reporting agencies). If the breach requires notifying more than 1,000 individuals; within 45 days after the determination.

The law has a clause for businesses that follow the breach rules of their own federal regulator (Ariz. Rev. Stat. § 18-552(N)(1) (article does not apply to a person subject to GLBA Title V); also § 18-552(I)). Some clauses like this cover only banks and credit unions, so don't count on it: plan to meet the state deadline as well as the FTC's.

The law reads: "If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall: 1. Notify the individuals affected"

This is on top of the federal rule. Under the FTC Safeguards Rule, a dealer must tell the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. How the FTC notice works.

Does Arizona have a consumer privacy law?

Arizona has no comprehensive consumer privacy law like California's as of October 31, 2026. The federal privacy rules still apply: a dealer that arranges financing or leases gives each of those buyers a privacy notice under the Gramm-Leach-Bliley Act. Make a free GLBA privacy notice.