{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/arkansas", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/arkansas.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/arkansas", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/arkansas/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/arkansas/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "arkansas", "frontmatter": { "title": "Arkansas Consumer Privacy Law", "description": "Arkansas has no comprehensive consumer-privacy statute. The Personal Information Protection Act governs safeguards, disposal, and breach notice, enforced solely by the Attorney General; a children-and-teens online privacy law takes effect July 1, 2026.", "state": "Arkansas", "lastReviewed": "2026-06-12", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "Personal Information Protection Act, Ark. Code Ann. §§ 4-110-101 to 4-110-108 — Arkansas has no comprehensive consumer-privacy law; PIPA (safeguards, disposal, breach notice) plus the Deceptive Trade Practices Act and the federal overlay is the operative framework, with the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025) effective July 1, 2026", "appliesTo": "Any person or business — however organized, for profit or not, expressly including state agencies — that acquires, owns, or licenses personal information about Arkansas residents; no revenue or consumer-volume threshold. From July 1, 2026, for-profit operators of websites, online services, or apps directed at children or teens, or with actual knowledge of collecting their data, are also covered", "privacyPolicyRequired": "No Arkansas statute mandates a general consumer privacy policy or fixes its contents; whatever is posted must be true under the ADTPA catch-all and FTC Act § 5, and from July 1, 2026 covered operators must give clear and conspicuous notice with six required elements for children's and teens' data", "privateRightOfAction": "Not under PIPA — every violation is punishable by action of the Attorney General under the ADTPA; the ADTPA's own private remedy requires actual financial loss caused by individual reliance and bans private class actions, and Act 952 of 2025 expressly disclaims any private right of action", "regulator": "Arkansas Attorney General", "bottomLine": "Arkansas has not enacted a comprehensive consumer-privacy law, so there are no general data-rights, consent, or processor-contract duties under state law today. The operative statute is the Personal Information Protection Act, which requires reasonable security, secure disposal, and breach notification — including Attorney General notice for breaches affecting more than 1,000 people — and is enforced exclusively by the Attorney General through the Deceptive Trade Practices Act, with no private right of action. The big change is imminent — the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025) takes effect July 1, 2026, banning targeted advertising to children and teens, imposing data-minimization, notice, consent, deletion, and security duties on covered operators, and giving the Attorney General exclusive enforcement authority.", "lawCoverage": "sectoral", "policyMandate": "sectoralPolicy", "consumersCanSue": "no", "sensitiveDataConsent": "categorySpecific", "universalOptOutSignal": "notRequired" }, "about": [ "Arkansas consumer privacy law", "Arkansas Personal Information Protection Act", "Arkansas data breach notification 4-110-105", "Arkansas Children and Teens Online Privacy Protection Act", "Arkansas Act 952 HB 1717 teen privacy", "Arkansas no comprehensive privacy law", "Arkansas privacy policy requirements", "Arkansas Attorney General privacy enforcement", "Arkansas Deceptive Trade Practices Act privacy", "Arkansas data breach private right of action" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "which-privacy-laws-apply", "label": "Which privacy laws apply to your business in Arkansas?", "heading": "Which privacy laws apply to your business in Arkansas?", "answerText": "There is no comprehensive Arkansas consumer-privacy law. The operative state statute is the Personal Information Protection Act (PIPA), a 2005 law whose stated purpose is to encourage individuals, businesses, and state agencies that hold personal information about Arkansans to provide reasonable security for it. PIPA imposes three duties — reasonable security, secure destruction of records no longer retained, and breach notification — and every violation is punishable by action of the Attorney General under the Deceptive Trade Practices Act. The second pillar arrives on July 1, 2026, when the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025) takes effect.", "sources": [ { "id": "pipa-title", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-101", "citation": "Ark. Code Ann. § 4-110-101.", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-101/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-101/#:~:text=This%20chapter%20shall%20be%20known,the%20%22Personal%20Information%20Protection%20Act%22.", "proposition": "Arkansas's operative privacy statute is chapter 110 of Title 4, formally titled the Personal Information Protection Act.", "verbatimQuote": "This chapter shall be known and cited as the \"Personal Information Protection Act\".", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-pipa-title" }, { "id": "pipa-purpose", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-102", "citation": "Ark. Code Ann. § 4-110-102(b).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-102/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-102/#:~:text=To%20that%20end%2C%20the%20purpose,reasonable%20security%20for%20the%20information.", "proposition": "PIPA's stated purpose is to encourage individuals, businesses, and state agencies holding personal information about Arkansans to provide reasonable security for it.", "verbatimQuote": "To that end, the purpose of this chapter is to encourage individuals, businesses, and state agencies that acquire, own, or license personal information about the citizens of the State of Arkansas to provide reasonable security for the information.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-pipa-purpose" }, { "id": "pipa-security", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-104", "citation": "Ark. Code Ann. § 4-110-104(b).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-104/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-104/#:~:text=A%20person%20or%20business%20that,destruction%2C%20use%2C%20modification%2C%20or%20disclosure.", "proposition": "PIPA requires any person or business that acquires, owns, or licenses personal information about an Arkansas resident to implement and maintain reasonable security procedures and practices.", "verbatimQuote": "A person or business that acquires, owns, or licenses personal information about an Arkansas resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-pipa-security" }, { "id": "pipa-disposal", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-104", "citation": "Ark. Code Ann. § 4-110-104(a).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-104/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-104/#:~:text=A%20person%20or%20business%20shall,or%20undecipherable%20through%20any%20means.", "proposition": "PIPA requires reasonable steps to destroy a customer's records containing personal information that is no longer to be retained, by shredding, erasing, or otherwise making the information unreadable.", "verbatimQuote": "A person or business shall take all reasonable steps to destroy or arrange for the destruction of a customer's records within its custody or control containing personal information that is no longer to be retained by the person or business by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-pipa-disposal" }, { "id": "pipa-adtpa-bridge", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-108", "citation": "Ark. Code Ann. § 4-110-108.", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/#:~:text=Any%20violation%20of%20this%20chapter,of%20%C2%A7%204%2D88%2D101%20et%20seq.", "proposition": "PIPA's entire enforcement architecture is one sentence: every violation is punishable by action of the Attorney General under the Deceptive Trade Practices Act.", "verbatimQuote": "Any violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-pipa-adtpa-bridge" }, { "id": "pipa-regulated-exemption", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-106", "citation": "Ark. Code Ann. § 4-110-106(a)(1).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-106/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-106/#:~:text=The%20provisions%20of%20this%20chapter,that%20provided%20by%20this%20chapter.", "proposition": "PIPA exempts persons and businesses regulated by a state or federal law that provides greater protection to personal information and at least as thorough breach-disclosure requirements.", "verbatimQuote": "The provisions of this chapter do not apply to a person or business that is regulated by a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breaches of the security of personal information than that provided by this chapter.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-pipa-regulated-exemption" }, { "id": "act952-effective", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 3.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The Arkansas Children and Teens' Online Privacy Protection Act takes effect on July 1, 2026.", "verbatimQuote": "This act shall be effective on and after July 1, 2026.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-act952-effective" }, { "id": "ftc5-overlay", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "FTC Act § 5", "citation": "15 U.S.C. § 45(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/45", "deepLink": "https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.", "proposition": "Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful, which reaches privacy and data-security practices nationwide.", "verbatimQuote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-ftc5-overlay" } ] }, { "slug": "privacy-policy-contents", "label": "What must your Arkansas privacy policy contain?", "heading": "What must your Arkansas privacy policy contain?", "answerText": "No Arkansas statute requires a general commercial business to post a consumer privacy policy or fixes what it must say — today. The enforceable rule is that whatever you publish has to be true: the Deceptive Trade Practices Act's catch-all prohibits any other unconscionable, false, or deceptive act or practice in business, commerce, or trade, and Section 5 of the FTC Act reaches a policy that misstates actual practices. That changes on July 1, 2026 for operators covered by Act 952 of 2025, which requires an operator with actual knowledge that it is collecting personal information from children or teens to provide clear and conspicuous notice of six elements — what is collected, the purpose for processing, disclosure practices, the rights available to parents and teens, the categories of personal data shared with third parties, and the categories of those third parties.", "sources": [ { "id": "q2-adtpa-catchall", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-107", "citation": "Ark. Code Ann. § 4-88-107(a)(10).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-107/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-107/#:~:text=Engaging%20in%20any%20other%20unconscionable%2C,in%20business%2C%20commerce%2C%20or%20trade%3B", "proposition": "The ADTPA's catch-all prohibits any other unconscionable, false, or deceptive act or practice in business, commerce, or trade — the natural theory against a privacy policy that misstates actual practices.", "verbatimQuote": "Engaging in any other unconscionable, false, or deceptive act or practice in business, commerce, or trade;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q2-adtpa-catchall" }, { "id": "q2-ftc5", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "FTC Act § 5", "citation": "15 U.S.C. § 45(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/45", "deepLink": "https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.", "proposition": "Section 5 of the FTC Act declares unfair or deceptive acts or practices unlawful, which reaches a privacy policy that misstates a business's actual data practices.", "verbatimQuote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q2-ftc5" }, { "id": "q2-hipaa-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Notice of Privacy Practices", "citation": "45 C.F.R. § 164.520.", "url": "https://www.law.cornell.edu/cfr/text/45/164.520", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information", "proposition": "A HIPAA covered entity must give individuals a notice describing the uses and disclosures of their protected health information and their rights and the entity's legal duties.", "verbatimQuote": "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q2-hipaa-notice" }, { "id": "q2-act952-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "From July 1, 2026, an operator with actual knowledge that it is collecting personal information from children or teens must provide clear and conspicuous notice.", "verbatimQuote": "An operator of a website, online service, online application, or mobile application that has actual knowledge that it is collecting personal information from children or teens shall: (1) Provide clear and conspicuous notice of:", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q2-act952-notice" }, { "id": "q2-act952-notice-elements", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The required notice covers six elements — data collected, processing purpose, disclosure practices, parent and teen rights, categories of data shared, and categories of third-party recipients.", "verbatimQuote": "What information is collected from children or teens by the operator; (B) The purpose for processing personal data; (C) The operator’s disclosure practices for such information; (D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section; (E) The categories of personal data that the controller shares with third parties, if any; and (F) The categories of third parties, if any, with whom the controller shares personal data;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q2-act952-notice-elements" }, { "id": "q2-act952-consent-policy", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Act 952's consent definition allows authorization to be given through an operator's terms of service or acknowledgement of the operator's privacy policy, making the policy text itself a consent instrument.", "verbatimQuote": "Before the personal information of the teen is collected, freely and unambiguously authorizes, including without limitation the giving of consent through an operator's terms of service or acknowledgement of the operator's privacy policy:", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q2-act952-consent-policy" } ] }, { "slug": "children-teens-online-privacy", "label": "What does Arkansas's children and teens online privacy law require starting July 1, 2026?", "heading": "What does Arkansas's children and teens online privacy law require starting July 1, 2026?", "answerText": "Act 952 of 2025 — the Arkansas Children and Teens' Online Privacy Protection Act, enacted as H.B. 1717 — takes effect July 1, 2026. It extends COPPA-style protections beyond children (twelve and younger) to teens — Arkansans thirteen through sixteen — and its prohibitions reach an operator of a website, online service, online application, or mobile application directed at children or teens, as well as any operator with actual knowledge that it is collecting personal information from children or teens; an operator is anyone who, for commercial purposes, runs such a service and collects or maintains personal information from or about its users. Covered operators may not collect a child's or teen's personal information for targeted advertising or let anyone else use it for that purpose, must limit collection to what is consistent with the context of the service, and may not retain the data longer than reasonably necessary.", "sources": [ { "id": "q3-act952-title", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Act 952 of 2025 is formally titled the Arkansas Children and Teens' Online Privacy Protection Act.", "verbatimQuote": "This subchapter shall be known and may be cited as the \"Arkansas Children and Teens' Online Privacy Protection Act\".", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-title" }, { "id": "q3-act952-effective", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 3.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The Arkansas Children and Teens' Online Privacy Protection Act takes effect on July 1, 2026.", "verbatimQuote": "This act shall be effective on and after July 1, 2026.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-effective" }, { "id": "q3-act952-child", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "A child under the act is an individual twelve years of age or younger in Arkansas.", "verbatimQuote": "\"Child\" means an individual twelve (12) years of age or younger in the State of Arkansas;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-child" }, { "id": "q3-act952-teen", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "A teen under the act is an Arkansan who is thirteen or older and younger than seventeen — thirteen through sixteen.", "verbatimQuote": "\"Teen\" means an individual located in the State of Arkansas who is: (A) Thirteen (13) years of age or older; and (B) Younger than seventeen (17) years of age; and", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-teen" }, { "id": "q3-act952-operator", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "An operator is a person who, for commercial purposes, operates or provides a website, online service, online application, or mobile application and collects or maintains personal information from or about users, or allows another person to collect it.", "verbatimQuote": "\"Operator\" means a person who, for commercial purposes, operates or provides a website on the internet, an online service, an online application, or a mobile application, and who: (i) Collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application; or (ii) Allows another person to collect personal information directly from users of that website, service, or application, in which case, the operator is deemed to have collected the information.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-operator" }, { "id": "q3-act952-scope", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The act's prohibitions apply to operators of websites, online services, online applications, or mobile applications directed at children or teens, and to any operator with actual knowledge that it is collecting personal information from children or teens.", "verbatimQuote": "Except as provided in subdivision (a)(2) of this section, it is unlawful for an operator of a website, online service, online application, or mobile application directed at children or teens or for any operator of a website, online service, online application, or mobile application with actual knowledge that it is collecting personal information from children or teens: (A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-scope" }, { "id": "q3-act952-targeted-ads", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Covered operators may not collect a child's or teen's personal information for purposes of targeted advertising to children or teens, or allow another person to collect, use, disclose, or maintain it for that purpose.", "verbatimQuote": "Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen personal information of a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this information for targeted advertising to children or teens;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-targeted-ads" }, { "id": "q3-act952-minimization", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The act imposes data minimization: collection of a child's or teen's personal information is unlawful except when consistent with the context of the service or relationship, or required or specifically authorized by law.", "verbatimQuote": "To collect the personal information of a child or teen except when the collection of the personal information is: (i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or (ii) Required or specifically authorized by law", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-minimization" }, { "id": "q3-act952-retention", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The act imposes a retention limit: a child's or teen's personal information may not be kept longer than reasonably necessary to fulfill the transaction or service requested, with safety, integrity, and legal-authorization exceptions.", "verbatimQuote": "To retain the personal information of a child or teen for longer that is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-retention" }, { "id": "q3-act952-teen-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "An operator with actual knowledge must obtain consent for the collection, use, or disclosure of a teen's personal information from a parent of a teen or a teen, subject to enumerated processing exceptions.", "verbatimQuote": "Obtain consent for the collection, use, or disclosure of personal information from a teen from a parent of a teen or a teen, except when the processing is for:", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-teen-consent" }, { "id": "q3-act952-teen-deletion", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "A teen must be given the opportunity at any time to delete personal information collected from the teen or content the teen submitted.", "verbatimQuote": "The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-teen-deletion" }, { "id": "q3-act952-teen-correction", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "A teen must be given the opportunity to challenge the accuracy of the personal information and, on establishing an inaccuracy, to have it corrected.", "verbatimQuote": "The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-teen-correction" }, { "id": "q3-act952-teen-access", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "A teen must be given a means that is reasonable under the circumstances to obtain any personal information the operator has collected from the teen.", "verbatimQuote": "A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the information is available to the operator at the time the teen makes the request;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-teen-access" }, { "id": "q3-act952-parent-deletion", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "A parent must be able to request at any time the deletion of the child's account or content or information the child submitted.", "verbatimQuote": "Request at any time the deletion of the account of the child or content or information submitted by the child to a website,", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-parent-deletion" }, { "id": "q3-act952-security", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Covered operators must establish, implement, and maintain reasonable security practices for children's and teens' personal information.", "verbatimQuote": "Establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and protect the personal information against unauthorized access.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-security" }, { "id": "q3-act952-no-age-verification", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "The act expressly disclaims any duty to collect age information or implement age-gating or age-verification functionality.", "verbatimQuote": "This subchapter shall not be construed to require an operator to: (1) Affirmatively collect any personal information regarding the age of a child or teen that an operator is not already collecting in the normal course of business; or (2) Implement an age-gating or age verification functionality.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-act952-no-age-verification" }, { "id": "q3-coppa-baseline", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "COPPA", "citation": "15 U.S.C. § 6502(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/6502", "deepLink": "https://www.law.cornell.edu/uscode/text/15/6502#:~:text=It%20is%20unlawful%20for%20an,regulations%20prescribed%20under%20subsection%20(b).", "proposition": "COPPA is the federal baseline: it is unlawful for an operator directed to children, or with actual knowledge, to collect a child's personal information in violation of the FTC's regulations.", "verbatimQuote": "It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q3-coppa-baseline" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with vendors say?", "heading": "What must your contracts with vendors say?", "answerText": "Arkansas has no omnibus data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for general private-sector contracts. The one Arkansas rule that directly touches the vendor relationship is PIPA's maintainer duty: a person or business that maintains computerized personal information it does not own must notify the owner or licensee immediately following discovery of a breach.", "sources": [ { "id": "q4-pipa-maintainer-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(b)(1).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=A%20person%20or%20business%20that,acquired%20by%20an%20unauthorized%20person.", "proposition": "A person or business that maintains computerized personal information it does not own must notify the owner or licensee of a breach immediately following discovery.", "verbatimQuote": "A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee that there has been a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q4-pipa-maintainer-notice" }, { "id": "q4-glba-safeguards", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "GLBA Safeguards Rule", "citation": "16 C.F.R. § 314.4(f)(2).", "url": "https://www.law.cornell.edu/cfr/text/16/314.4", "deepLink": "https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards", "proposition": "The GLBA Safeguards Rule requires a financial institution to oversee its service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.", "verbatimQuote": "Requiring your service providers by contract to implement and maintain such safeguards", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q4-glba-safeguards" }, { "id": "q4-hipaa-baa", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Business Associate Contracts", "citation": "45 C.F.R. § 164.504(e)(2).", "url": "https://www.law.cornell.edu/cfr/text/45/164.504", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,and%20a%20business%20associate%20must", "proposition": "HIPAA requires a written business-associate contract that establishes the permitted uses and disclosures of protected health information and binds the business associate to safeguard it.", "verbatimQuote": "A contract between the covered entity and a business associate must", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q4-hipaa-baa" } ] }, { "slug": "breach-notification", "label": "When must you notify people of a data breach in Arkansas?", "heading": "When must you notify people of a data breach in Arkansas?", "answerText": "Any person or business that acquires, owns, or licenses computerized personal information must disclose a breach to any Arkansas resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time and manner possible and without unreasonable delay — Arkansas sets no numeric deadline for individual notice. If a breach affects the personal information of more than 1,000 individuals, the Attorney General must also be notified, at the same time as individual disclosure or within 45 days after determining a reasonable likelihood of harm to customers, whichever occurs first. Notification is excused only if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to customers — and that determination must be put in writing and retained for five years.", "sources": [ { "id": "q5-pipa-notice-duty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(a)(1).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Any%20person%20or%20business%20that,acquired%20by%20an%20unauthorized%20person.", "proposition": "Any person or business holding computerized personal information must disclose a breach to any Arkansas resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.", "verbatimQuote": "Any person or business that acquires, owns, or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of Arkansas whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-notice-duty" }, { "id": "q5-pipa-timing", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(a)(2).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=The%20disclosure%20shall%20be%20made,integrity%20of%20the%20data%20system.", "proposition": "Individual breach notice must be made in the most expedient time and manner possible and without unreasonable delay — there is no numeric deadline.", "verbatimQuote": "The disclosure shall be made in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, or any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-timing" }, { "id": "q5-pipa-ag-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(b)(2).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=If%20a%20breach%20of%20the,breach%20to%20the%20Attorney%20General.", "proposition": "A breach affecting more than 1,000 individuals must be disclosed to the Attorney General at the same time as individual disclosure or within 45 days after determining a reasonable likelihood of harm, whichever occurs first.", "verbatimQuote": "If a breach of the security of a system affects the personal information of more than one thousand (1,000) individuals, the person or business required to make a disclosure of the security breach under subdivision (b)(1) of this section shall, at the same time the security breach is disclosed to an affected individual or within forty-five (45) days after the person or business determines that there is a reasonable likelihood of harm to customers, whichever occurs first, disclose the security breach to the Attorney General.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-ag-notice" }, { "id": "q5-pipa-offramp", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(d).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Notification%20under%20this%20section%20is,likelihood%20of%20harm%20to%20customers.", "proposition": "Notification is not required if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to customers.", "verbatimQuote": "Notification under this section is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-offramp" }, { "id": "q5-pipa-determination-retention", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(g)(1).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=A%20person%20or%20business%20shall,the%20security%20of%20the%20system.", "proposition": "A written determination of a breach and its supporting documentation must be retained for five years from the date of the determination.", "verbatimQuote": "A person or business shall retain a copy of the written determination of a breach of the security of the system and supporting documentation for five (5) years from the date of determination of the breach of the security of the system.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-determination-retention" }, { "id": "q5-pipa-determination-production", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(g)(2).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=If%20the%20Attorney%20General%20submits,of%20receipt%20of%20the%20request.", "proposition": "On the Attorney General's written request, the business must produce the written breach determination and supporting documentation within 30 days.", "verbatimQuote": "If the Attorney General submits a written request for the written determination of the breach of the security of the system, the person or business shall send a copy of the written determination of the breach of the security of the system and supporting documentation to the Attorney General no later than thirty (30) days after the date of receipt of the request.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-determination-production" }, { "id": "q5-pipa-breach-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-103", "citation": "Ark. Code Ann. § 4-110-103(1)(A).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22Breach%20of%20the%20security%20of,by%20a%20person%20or%20business.", "proposition": "A breach is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information — an acquisition-based trigger.", "verbatimQuote": "\"Breach of the security of the system\" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-breach-def" }, { "id": "q5-pipa-pi-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-103", "citation": "Ark. Code Ann. § 4-110-103(7).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22Personal%20information%22%20means%20an%20individual's,is%20not%20encrypted%20or%20redacted%3A", "proposition": "Personal information is a name combined with an unencrypted, unredacted Social Security number, driver's license or Arkansas ID number, financial-account credentials, medical information, or biometric data.", "verbatimQuote": "\"Personal information\" means an individual's first name or first initial and his or her last name in combination with any one (1) or more of the following data elements when either the name or the data element is not encrypted or redacted:", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-pi-def" }, { "id": "q5-pipa-medical-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-103", "citation": "Ark. Code Ann. § 4-110-103(5).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22Medical%20information%22%20means%20any%20individually,diagnosis%20by%20a%20healthcare%20professional%3B", "proposition": "Medical information means any individually identifiable information, in electronic or physical form, regarding medical history, treatment, or diagnosis by a healthcare professional.", "verbatimQuote": "\"Medical information\" means any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a healthcare professional;", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-medical-def" }, { "id": "q5-pipa-biometric-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-103", "citation": "Ark. Code Ann. § 4-110-103(7)(E)(ii).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22biometric%20data%22%20means%20data%20generated,biological%20characteristics%2C%20including%20without%20limitation%3A", "proposition": "Biometric data means data generated by automatic measurements of an individual's biological characteristics, with fingerprints, faceprint, retinal or iris scans, hand geometry, voiceprint analysis, and DNA expressly listed.", "verbatimQuote": "\"biometric data\" means data generated by automatic measurements of an individual's biological characteristics, including without limitation:", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-biometric-def" }, { "id": "q5-pipa-substitute-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(e)(3)(A).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Substitute%20notice%20if%20the%20person,not%20have%20sufficient%20contact%20information.", "proposition": "Substitute notice is available when the cost of notice would exceed $250,000, the affected class exceeds 500,000 persons, or contact information is insufficient.", "verbatimQuote": "Substitute notice if the person or business demonstrates that: - (i) The cost of providing notice would exceed two hundred fifty thousand dollars ($250,000); - (ii) The affected class of persons to be notified exceeds five hundred thousand (500,000); or - (iii) The person or business does not have sufficient contact information.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-substitute-notice" }, { "id": "q5-pipa-law-enforcement", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(c)(1).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=The%20notification%20required%20by%20this,will%20impede%20a%20criminal%20investigation.", "proposition": "Notification may be delayed if a law enforcement agency determines it would impede a criminal investigation.", "verbatimQuote": "The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-law-enforcement" }, { "id": "q5-pipa-own-policy", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-105", "citation": "Ark. Code Ann. § 4-110-105(f).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Notwithstanding%20subsection%20(e)%20of%20this,the%20security%20of%20the%20system.", "proposition": "A business that notifies affected persons under its own information-security-policy procedures, consistent with the statute's timing requirements, is deemed compliant.", "verbatimQuote": "Notwithstanding subsection (e) of this section, a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies affected persons in accordance with its policies in the event of a breach of the security of the system.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q5-pipa-own-policy" } ] }, { "slug": "consumer-lawsuit", "label": "Can a consumer sue your business in Arkansas over privacy?", "heading": "Can a consumer sue your business in Arkansas over privacy?", "answerText": "Not under PIPA. The statute's entire enforcement section says any violation is punishable by action of the Attorney General under the Deceptive Trade Practices Act — there is no private right of action, no statutory damages, and no cumulative-remedies clause. The ADTPA itself does have a private remedy, but it was sharply narrowed in 2017: a plaintiff may sue only for an actual financial loss caused by his or her reliance on the unlawful practice, must prove that loss and reliance individually, and cannot bring a private class action — the statute prohibits them outside a narrow constitutional-usury exception. Act 952 of 2025 is even more explicit: the Attorney General has exclusive enforcement authority, and nothing in the act provides the basis for a private right of action for a violation of the act or any other law.", "sources": [ { "id": "q6-pipa-ag-only", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-108", "citation": "Ark. Code Ann. § 4-110-108.", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/#:~:text=Any%20violation%20of%20this%20chapter,of%20%C2%A7%204%2D88%2D101%20et%20seq.", "proposition": "PIPA contains no private right of action — every violation is punishable by action of the Attorney General under the ADTPA.", "verbatimQuote": "Any violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q6-pipa-ag-only" }, { "id": "q6-adtpa-private-suit", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(f)(1)(A).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=A%20person%20who%20suffers%20an,as%20defined%20in%20this%20chapter.", "proposition": "A private ADTPA plaintiff may sue only to recover an actual financial loss proximately caused by his or her reliance on the unlawful practice.", "verbatimQuote": "A person who suffers an actual financial loss as a result of his or her reliance on the use of a practice declared unlawful by this chapter may bring an action to recover his or her actual financial loss proximately caused by the offense or violation, as defined in this chapter.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q6-adtpa-private-suit" }, { "id": "q6-adtpa-class-ban", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(f)(1)(B).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=A%20private%20class%20action%20under,of%20Arkansas%20Constitution%2C%20Amendment%2089.", "proposition": "Private ADTPA class actions are prohibited except for claims under the constitutional usury amendment.", "verbatimQuote": "A private class action under this subsection is prohibited unless the claim is being asserted for a violation of Arkansas Constitution, Amendment 89.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q6-adtpa-class-ban" }, { "id": "q6-adtpa-reliance-proof", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(f)(2).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=To%20prevail%20on%20a%20claim,declared%20unlawful%20under%20this%20chapter.", "proposition": "To prevail, a private ADTPA claimant must prove individually an actual financial loss proximately caused by his or her own reliance on the unlawful practice.", "verbatimQuote": "To prevail on a claim brought under this subsection, a claimant must prove individually that he or she suffered an actual financial loss proximately caused by his or her reliance on the use of a practice declared unlawful under this chapter.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q6-adtpa-reliance-proof" }, { "id": "q6-act952-no-pra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Act 952 gives the Attorney General exclusive enforcement authority and expressly disclaims any private right of action for a violation of the act or any other law.", "verbatimQuote": "The Attorney General shall have exclusive authority to enforce this subchapter. (2) Nothing in this subchapter provides the basis for, or subjects an operator, processor, or person to a private right of action for a violation of this subchapter or any other law.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q6-act952-no-pra" }, { "id": "q6-pipa-anti-waiver", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-107", "citation": "Ark. Code Ann. § 4-110-107.", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-107/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-107/#:~:text=Any%20waiver%20of%20a%20provision,public%20policy%2C%20void%2C%20and%20unenforceable.", "proposition": "Any waiver of a PIPA provision is contrary to public policy, void, and unenforceable — businesses cannot contract around the statute.", "verbatimQuote": "Any waiver of a provision of this chapter is contrary to public policy, void, and unenforceable.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q6-pipa-anti-waiver" } ] }, { "slug": "ag-enforcement", "label": "How is privacy law enforced in Arkansas?", "heading": "How is privacy law enforced in Arkansas?", "answerText": "By the Attorney General, through the Deceptive Trade Practices Act. PIPA routes every violation to the Attorney General under the ADTPA, and in an ADTPA civil-enforcement proceeding the court may assess penalties of up to 10,000 dollars per violation, order restoration of money or property to purchasers who suffered ascertainable loss, and even suspend or forfeit corporate charters, franchises, and licenses to do business in the state. From July 1, 2026, the Attorney General will also enforce Act 952, with express authority to enjoin a practice, enforce compliance, and obtain damages, restitution, or other compensation on behalf of Arkansas residents.", "sources": [ { "id": "q7-pipa-adtpa-bridge", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-110-108", "citation": "Ark. Code Ann. § 4-110-108.", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/#:~:text=Any%20violation%20of%20this%20chapter,of%20%C2%A7%204%2D88%2D101%20et%20seq.", "proposition": "PIPA violations are enforced by the Attorney General under the Deceptive Trade Practices Act.", "verbatimQuote": "Any violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-pipa-adtpa-bridge" }, { "id": "q7-adtpa-penalties", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(a)(3).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Assess%20penalties%20to%20be%20paid,to%20have%20violated%20this%20chapter.", "proposition": "In an Attorney General civil-enforcement action, the court may assess penalties of up to $10,000 per violation.", "verbatimQuote": "Assess penalties to be paid to the state, not to exceed ten thousand dollars ($10,000) per violation, against persons found to have violated this chapter.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-adtpa-penalties" }, { "id": "q7-adtpa-restitution", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(a)(2)(A).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Restore%20to%20any%20purchaser%20who,together%20with%20other%20damages%20sustained.", "proposition": "The court may order restoration of money or property to any purchaser who suffered ascertainable loss from the prohibited practices.", "verbatimQuote": "Restore to any purchaser who has suffered any ascertainable loss by reason of the use or employment of the prohibited practices any moneys or real or personal property which may have been acquired by means of any practice declared to be unlawful by this chapter, together with other damages sustained.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-adtpa-restitution" }, { "id": "q7-adtpa-charter", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(b).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Upon%20petition%20of%20the%20Attorney,do%20business%20in%20this%20state.", "proposition": "On the Attorney General's petition, the court may suspend or forfeit franchises, corporate charters, and licenses or permits to do business in Arkansas.", "verbatimQuote": "Upon petition of the Attorney General, the court may order the suspension or forfeiture of franchises, corporate charters, or other licenses or permits or authorization to do business in this state.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-adtpa-charter" }, { "id": "q7-adtpa-joint-liability", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(d)(1).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Every%20person%2C%20or%20every%20partner%2C,the%20violation%20or%20liability%20exists.", "proposition": "Controlling persons and knowing facilitators are jointly and severally liable for penalties and monetary judgments in ADTPA civil enforcement.", "verbatimQuote": "Every person, or every partner, officer, or director of another person who directly or indirectly controls another person or who is in violation of or liable under this chapter or every person who directly or indirectly facilitates, assists, acts as intermediary for, or in any way aids another person who is in violation of or liable under this chapter in the operation or continuance of the act or practice for which the violations or liability exists shall be jointly and severally liable for any penalties assessed and any monetary judgments awarded in any proceeding for civil enforcement of this chapter, if the persons to be held jointly and severally liable knew or reasonably should have known of the existence of the facts by reason of which the violation or liability exists.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-adtpa-joint-liability" }, { "id": "q7-adtpa-fees", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Ark. Code Ann. § 4-88-113", "citation": "Ark. Code Ann. § 4-88-113(e).", "url": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/", "deepLink": "https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=As%20compensation%20for%20his%20or,recover%20attorney's%20fees%20and%20costs.", "proposition": "When judgment is rendered for the state, the Attorney General is entitled to all expenses reasonably incurred in investigation and prosecution, including expert-witness expenses, plus attorney's fees and costs.", "verbatimQuote": "As compensation for his or her services under this chapter, the Attorney General shall be entitled to all expenses reasonably incurred in the investigation and prosecution of suits, including, but not limited to, expenses for expert witnesses, to be paid by the defendant when judgment is rendered for the state, and, in addition, shall recover attorney's fees and costs.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-adtpa-fees" }, { "id": "q7-act952-ag-remedies", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Under Act 952, the Attorney General may sue on behalf of Arkansas residents to enjoin a practice, enforce compliance, and obtain damages, restitution, or other compensation.", "verbatimQuote": "In a case in which the Attorney General has reason to believe that an interest of the residents of the state has been or is threatened or adversely affected by the engagement of any person in a practice that violates the provisions of this subchapter, the Attorney General may bring a civil action on behalf of the residents of the state in a court of competent jurisdiction to: (1) Enjoin that practice; (2) Enforce compliance with the rule; (3) Obtain damages, restitution, or other compensation on behalf of residents of the state; or (4) Obtain other relief that the court finds appropriate.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-act952-ag-remedies" }, { "id": "q7-act952-adtpa-bridge", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "H.B. 1717 (Act 952 of 2025)", "citation": "Act 952, 2025 Ark. Acts (H.B. 1717), § 1.", "url": "https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf", "proposition": "Violations of Act 952's consent and parent-and-teen-rights duties are treated as unfair or deceptive acts or practices under the Deceptive Trade Practices Act, subject to the act's stated exceptions.", "verbatimQuote": "a violation of subdivisions (b)(2) and (b)(3) of this section shall be treated as an unfair or deceptive act or practice prescribed under the Deceptive Trade Practices Act, § 4-88-101 et seq.", "anchor": "https://openagreements.org/practice-guides/privacy/us/arkansas#src-q7-act952-adtpa-bridge" } ] } ] } }