Camera-related state law

Arizona's audio-recording statute is A.R.S. 13-3005, which makes intentional interception of wire, electronic, or oral communications a class 5 felony unless an exception applies. The most-used commercial exception is consent of one party to the communication. AZ is therefore a one-party consent state for audio.

Video-only surveillance is treated more permissively. Recording video in places where a person has no reasonable expectation of privacy is generally lawful. Hidden cameras in places where privacy is expected (restrooms, locker rooms, fitting rooms, hotel guest rooms) are off-limits and can trigger criminal exposure under A.R.S. 13-3019, which addresses surreptitious photographing or recording without consent in places where a reasonable expectation of privacy exists.

Practical translation. Commercial AZ camera installs default to video-only on the cameras and route audio capture through a separate documented intercom or call-recording workflow. Most multi-site retailers, manufacturers, and warehouses post notice at every public entrance and configure cameras to video-only at the device level.

Biometric data and breach notification

Arizona has no standalone biometric privacy statute on the BIPA model with a private right of action. Biometric data is regulated primarily through A.R.S. 18-552, the data breach notification statute, which includes biometric data within the definition of personal information. A breach affecting biometric records triggers AZ AG notification when the threshold is met.

For commercial security buyers, the practical reach is fingerprint and facial-recognition access control, voice-print authentication, and any AI camera that builds a faceprint template. AZ businesses using biometric capture document consent at enrollment, retention, and access controls as a matter of best practice. Out-of-state employee data rules can also apply: BIPA reaches Illinois-resident remote workers, CCPA reaches California-resident remote workers, CUBI reaches Texas-resident remote workers, and CPA reaches Colorado-resident remote workers.

The practical retention rule for biometric records in AZ is to retain only as long as reasonably necessary for the purpose and to destroy on employee separation or end of lawful purpose. Most multi-state employers in AZ default to BIPA-grade documentation (written informed consent + retention schedule + destruction process) because at least one of their employees is likely to fall under BIPA's reach.

Privacy in the workplace

Arizona has no single workplace electronic-monitoring statute that requires written notice for general video surveillance. Pure video surveillance of common work areas with posted notice is the routine pattern. Cameras in employee-only spaces with a reasonable expectation of privacy (restrooms, locker rooms, lactation rooms) are off-limits and create exposure under A.R.S. 13-3019 and invasion-of-privacy theories.

Audio capture by an employer is regulated by A.R.S. 13-3005 (one-party consent). Most AZ employers issue a single workplace surveillance notice in the employee handbook covering cameras, badge access, computer monitoring, and call recording together. Cameras in production lines, retail floor, loading dock, and warehouse aisles are routine when paired with notice. Fingerprint or facial-recognition timeclocks are common in AZ but should carry written informed-consent forms when any employee is a resident of an outside state with a stricter regime.

Public-place and common-area cameras

For commercial real estate, multi-tenant residential, retail, and hospitality, the practical rule set is consistent. Cameras in lobbies, hallways, exterior, parking, retail floor, and other non-private common areas are lawful with posted notice. Cameras in bathrooms, fitting rooms, hotel guest rooms, and any other space where privacy is expected are off-limits and create exposure under A.R.S. 13-3019.

Multi-tenant residential operators in Arizona should review the bylaws and lease covenants. Hotel operators handle guest-room signage at the door and at the front desk and document any guest-area camera coverage in the property security plan. Phoenix, Tucson, Mesa, Chandler, and Scottsdale have municipal ordinances that can apply to alarm permits and certain license categories. Audio in any common area is the high-risk variable: even in non-private spaces, ambient audio capture without a participating consenter pulls the install into A.R.S. 13-3005 territory.

Video retention requirements

Arizona has no single statewide video retention statute that applies to all commercial cameras. Retention is set by the regime that governs the industry.

  • Cannabis. ADHS publishes camera coverage and retention rules for licensed marijuana establishments under A.A.C. R9-18 (medical) and R9-17 (adult-use). Pull the current rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility, longer when an investigation is open.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Banks and financial institutions. Federal banking regulators set surveillance and retention expectations through bank examination. AZ Department of Insurance and Financial Institutions supervises state-chartered banks and credit unions.
  • Schools. FERPA reach for K-12 districts and higher education. AZ district board policies typically set 14 to 30 days retention. ASP-funded projects come with their own retention expectations.
  • Federal contractors and grantees. NDAA Section 889 controls vendor selection. Retention is contractor-driven through the SSP or grant award terms.

Default retention for AZ commercial systems with no specific industry rule is 30 days. Operators in higher-risk industries set longer retention with explicit written retention policies in the WISP, facility security plan, or ADHS SOP.

Notable enforcement examples

AZ enforcement against businesses for camera, biometric, and data-handling issues runs through several channels. The Arizona Attorney General brings consumer protection and breach actions under A.R.S. 18-552 and the AZ Consumer Fraud Act. The Arizona Department of Health Services has issued sanctions against marijuana licensees for surveillance and retention failures.

Federal HIPAA settlements have reached AZ-based defendants where physical safeguards (facility access control, camera coverage of PHI areas) were a documented part of the breach. PCI assessor findings have triggered card brand penalties at AZ retailers where camera coverage of the cardholder data environment was inadequate or retention was below 90 days. Real settlements are searchable on the AZ AG, ADHS, and HHS OCR enforcement pages.

What Tec-Tel does to comply with Arizona regulations

Tec-Tel installs across Arizona for retail, manufacturing, healthcare, multi-tenant residential, financial, hospitality, and licensed cannabis customers. The default install pattern for an AZ commercial site:

  • Video-only on cameras unless audio is documented with one-party consent under A.R.S. 13-3005.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, fitting rooms, hotel guest rooms, or other spaces where privacy is reasonably expected (A.R.S. 13-3019).
  • Written informed-consent forms with a documented retention schedule for any biometric capture (fingerprint timeclocks, facial-recognition access, voiceprint authentication), defaulted to BIPA-grade documentation when any employee is an out-of-state resident.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, ADHS, NDAA), with the facility's written retention policy attached.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific AZ regulatory question, work with your privacy counsel.

Security service in Arizona

Tec-Tel deploys AI-era security across Arizona with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.