United States – Arkansas

Regulator And AuthorityAmber

The Arkansas Attorney General enforces PIPA and the Arkansas Deceptive Trade Practices Act; there is no independent data-protection authority equivalent to a GDPR-style DPA.

Claims (1):

• The Arkansas Attorney General is the state regulator responsible for enforcing the Personal Information Protection Act and the Arkansas Deceptive Trade Practices Act, including data-breach and consumer-privacy-adjacent violations.

Act And InstrumentsRed

PIPA is the principal instrument; no comprehensive consumer-privacy act exists.

Claims (1):

• Arkansas has no comprehensive consumer data-protection or privacy statute; the state's principal privacy-relevant law is the Personal Information Protection Act, which addresses data-breach notification and reasonable-security/disposal obligations only.

Material ScopeAmber

PIPA covers persons, businesses and state agencies that acquire, own, or license personal information of Arkansas residents, and imposes reasonable-security and disposal duties.

Claims (1):

• The Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.), effective April 4, 2005, requires individuals, businesses, and state agencies that acquire, own, or license personal information of Arkansas residents to implement reasonable security measures and reasonable data-disposal procedures.

Territorial ScopeAmber

Coverage turns on the residency of the data subject (Arkansas residents), not the location of the regulated entity, giving the statute extraterritorial reach comparable to other early-generation state breach laws.

Claims (1):

• Arkansas expanded the entities subject to its breach-notification statute to any business that acquires, owns, or licenses personal information of a state resident, giving the law reach over out-of-state entities holding Arkansas residents' data.

Regulator Registration And FilingRed

No general controller registration or filing obligation exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas data controller registration requirement, Arkansas Attorney General privacy filing obligation.

Claims (1):

• Arkansas law does not impose a general registration or filing obligation on data controllers or processors.

Lawful BasesRed

No enumerated lawful bases for processing exist under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas lawful basis data processing statute.

Claims (1):

• Arkansas has no general statutory enumeration of lawful bases for processing personal data equivalent to GDPR Article 6; processing outside sector-specific contexts requires no specific lawful-basis justification under Arkansas law.

Consent ThresholdsAmber

Minors-specific consent obligations exist via HB1717 (prospective) and via the now-unenforceable Social Media Safety Act.

Claims (2):

• The Arkansas Children and Teens' Online Privacy Protection Act (HB1717), effective July 1, 2026, prohibits covered operators from collecting personal data from minors for targeted-advertising purposes and mandates specific data-management practices.
• The Arkansas Social Media Safety Act (SB396), which would have required age verification and parental consent for minors under 18 to use social media platforms, was enjoined by the U.S. District Court for the Western District of Arkansas and subsequently held unconstitutional on First and Fourteenth Amendment grounds; its consent mechanism is not currently enforceable.

Special CategoriesRed

No independent state special/sensitive-category regime exists; coverage, if any, derives from federal sectoral overlays (HIPAA, COPPA).

Absence provenance: not recorded. Searched: Arkansas sensitive personal data statute, Arkansas biometric health genetic data law.

Claims (1):

• Arkansas has no independent statutory scheme creating heightened protections for special/sensitive categories of personal data (health, biometric, genetic, etc.) outside of federal sectoral overlays such as HIPAA and COPPA.

Pseudonymisation And AnonymisationRed

No statutory definitions or safe-harbours for pseudonymisation or anonymisation exist under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas pseudonymisation anonymisation statute.

Claims (1):

• Arkansas law provides no statutory definition of, or safe-harbour for, pseudonymised or anonymised data.

Access RightRed

No general right of access to personal data held by private-sector controllers exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas consumer right to access personal data.

Claims (1):

• Arkansas law does not grant consumers a general right of access, rectification, erasure, restriction, objection, or data portability with respect to personal data held by private-sector controllers.

Rectification And ErasureRed

No general right to correct or delete personal data exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas right to delete personal data.

Claims (1):

• Arkansas law does not grant consumers a general right of access, rectification, erasure, restriction, objection, or data portability with respect to personal data held by private-sector controllers.

Restriction And ObjectionRed

No general right to restrict processing or object to profiling exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas right to object to processing.

Claims (1):

• Arkansas law does not grant consumers a general right of access, rectification, erasure, restriction, objection, or data portability with respect to personal data held by private-sector controllers.

Data PortabilityRed

No data-portability right exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas data portability right.

Claims (1):

• Arkansas law does not grant consumers a general right of access, rectification, erasure, restriction, objection, or data portability with respect to personal data held by private-sector controllers.

Deadlines And Response WindowsAmber

The only statutory deadline is PIPA's breach-notification timing obligation, not a general DSAR response window.

Claims (1):

• PIPA requires notification of a security breach to affected Arkansas residents and, depending on the number affected, to the Attorney General, functioning as a breach-notice timing obligation rather than a general subject-access-request deadline.

Accountability And DpiaRed

No accountability principle or DPIA-trigger regime exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas DPIA requirement, Arkansas accountability principle privacy.

Claims (1):

• Arkansas law contains no accountability principle or DPIA-trigger obligation comparable to GDPR Articles 5, 25, or 35.

Dpo RequirementsRed

No DPO-appointment threshold or independence requirement exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas data protection officer requirement.

Claims (1):

• Arkansas law imposes no requirement to appoint a data protection officer.

Ropa RequirementsRed

No records-of-processing obligation exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas records of processing activities requirement.

Claims (1):

• Arkansas law imposes no obligation to maintain records of processing activities.

Joint Controller ArrangementsRed

No statutory joint-controller framework exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas joint controller obligations.

Claims (1):

• Arkansas law contains no statutory framework governing joint-controller relationships or allocation of responsibility between co-controllers.

Security MeasuresGreen

PIPA requires reasonable security procedures and practices to protect personal information.

Claims (1):

• The Personal Information Protection Act requires covered persons, businesses, and state agencies to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, use, modification, or disclosure.

Breach NotificationGreen

PIPA requires notification of security breaches to affected residents and, above certain thresholds, to the Attorney General.

Claims (1):

• PIPA requires notification of security breaches involving personal information to affected Arkansas residents and, depending on the number of individuals affected, to the Arkansas Attorney General.

Retention And DisposalAmber

PIPA requires reasonable procedures for the proper disposal of records containing personal information.

Claims (1):

• PIPA requires covered entities to implement reasonable procedures for the proper disposal of records containing personal information to prevent unauthorized access to or use of the information.

Transfer MechanismsRed

No state-level transfer mechanism regime exists.

Absence provenance: not recorded. Searched: Arkansas cross-border data transfer mechanism.

Claims (1):

• Arkansas has no data-localisation mandate or state-level cross-border data-transfer mechanism (adequacy, SCCs, BCRs, or transfer-impact-assessment requirement) applicable to personal data generally, in the absence of a comprehensive consumer-privacy statute.

Adequacy ReceivedRed

Not applicable; Arkansas is a sub-national US jurisdiction and does not receive adequacy determinations.

Absence provenance: not recorded. Searched: Arkansas adequacy decision received.

Adequacy GrantedRed

Not applicable; Arkansas does not grant adequacy determinations.

Absence provenance: not recorded. Searched: Arkansas adequacy decision granted.

Sccs And BcrsRed

No state-level SCC or BCR framework exists.

Absence provenance: not recorded. Searched: Arkansas standard contractual clauses, Arkansas binding corporate rules.

Claims (1):

• Arkansas has no data-localisation mandate or state-level cross-border data-transfer mechanism (adequacy, SCCs, BCRs, or transfer-impact-assessment requirement) applicable to personal data generally, in the absence of a comprehensive consumer-privacy statute.

Transfer Impact AssessmentRed

No TIA requirement exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas transfer impact assessment.

Claims (1):

• Arkansas has no data-localisation mandate or state-level cross-border data-transfer mechanism (adequacy, SCCs, BCRs, or transfer-impact-assessment requirement) applicable to personal data generally, in the absence of a comprehensive consumer-privacy statute.

Data LocalisationRed

No data-localisation mandate exists under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas data localisation requirement.

Claims (1):

• Arkansas has no data-localisation mandate or state-level cross-border data-transfer mechanism (adequacy, SCCs, BCRs, or transfer-impact-assessment requirement) applicable to personal data generally, in the absence of a comprehensive consumer-privacy statute.

Financial Sector OverlayAmber

Act 557 imposes data-security-program and incident-response-plan requirements on virtual-currency businesses.

Claims (1):

• Arkansas Act 557 imposes data-security-program and incident-response-plan requirements on virtual-currency businesses operating in the state, supplementing the general PIPA security baseline for this sector.

Health Sector OverlayAmber

Health-sector personal information in Arkansas is governed primarily by the federal HIPAA framework in the absence of an independent state health-privacy statute.

Claims (1):

• Health-sector personal information in Arkansas is governed primarily by the federal Health Insurance Portability and Accountability Act, as Arkansas has no independent comprehensive state health-privacy statute displacing HIPAA.

Telecoms And EprivacyAmber

The Arkansas Consumer Telephone Privacy Act establishes telemarketing restrictions and a state-wide Do-Not-Call database.

Claims (1):

• The Arkansas Consumer Telephone Privacy Act, Ark. Code Ann. § 4-99-401 et seq., sets out telemarketing requirements and establishes a state-wide Do-Not-Call database.

Employment DataRed

No independent Arkansas employment-data-privacy statute was identified.

Absence provenance: not recorded. Searched: Arkansas employment data privacy statute.

Claims (1):

• No independent Arkansas statute governs employment-data privacy, credit-scoring privacy, or education-data privacy beyond the general breach-notification baseline and applicable federal overlays (FCRA, FERPA).

Credit And ScoringRed

Credit and scoring data reliance is on the federal Fair Credit Reporting Act; no independent state credit-scoring privacy statute was identified.

Absence provenance: not recorded. Searched: Arkansas credit scoring privacy statute.

Claims (1):

• No independent Arkansas statute governs employment-data privacy, credit-scoring privacy, or education-data privacy beyond the general breach-notification baseline and applicable federal overlays (FCRA, FERPA).

EducationRed

Education data reliance is on the federal FERPA; no independent Arkansas education-privacy statute beyond general breach law was identified.

Absence provenance: not recorded. Searched: Arkansas student data privacy statute.

Claims (1):

• No independent Arkansas statute governs employment-data privacy, credit-scoring privacy, or education-data privacy beyond the general breach-notification baseline and applicable federal overlays (FCRA, FERPA).

InsuranceAmber

House Bill 1297 regulates AI use in health-insurance decision-making, mandating transparency and quality-assurance requirements.

Claims (1):

• Arkansas House Bill 1297 regulates the use of artificial intelligence in health-insurance decision-making, mandating transparency and quality-assurance requirements for AI algorithms used by insurers.

Cookies And TrackersRed

No state cookie/tracker consent law exists.

Absence provenance: not recorded. Searched: Arkansas cookie consent law.

Claims (1):

• Arkansas has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, or clean-room regulation.

Dark PatternsRed

No dark-pattern prohibition statute exists.

Absence provenance: not recorded. Searched: Arkansas dark patterns statute.

Claims (1):

• Arkansas has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, or clean-room regulation.

Opt Out SignalsRed

No Global Privacy Control or opt-out-signal recognition mandate exists.

Absence provenance: not recorded. Searched: Arkansas Global Privacy Control requirement.

Claims (1):

• Arkansas has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, or clean-room regulation.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room regulation exists.

Absence provenance: not recorded. Searched: Arkansas data clean room regulation.

Claims (1):

• Arkansas has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, or clean-room regulation.

Cross Context AdvertisingAmber

HB1717 prohibits covered operators from engaging in targeted/cross-context advertising directed at minors, effective July 1, 2026.

Claims (1):

• The Arkansas Children and Teens' Online Privacy Protection Act (HB1717) prohibits covered operators from engaging in targeted advertising directed at minors, effective July 1, 2026.

Direct MarketingAmber

The Arkansas Consumer Telephone Privacy Act provides a Do-Not-Call suppression mechanism for telemarketing.

Claims (1):

• The Arkansas Consumer Telephone Privacy Act establishes a state-wide Do-Not-Call database that functions as a direct-marketing suppression mechanism for telemarketing calls.

Profiling RestrictionsRed

No general profiling-restriction statute analogous to GDPR Art. 22 exists for the general population under Arkansas law.

Absence provenance: not recorded. Searched: Arkansas profiling restriction statute.

Claims (1):

• Arkansas has no general statutory restriction on automated profiling of the general population comparable to GDPR Article 22.

Automated Decision Making TransparencyAmber

HB1297 mandates transparency and quality-assurance requirements for AI algorithms used in health-insurance decision-making.

Claims (1):

• Arkansas House Bill 1297 mandates transparency and quality-assurance requirements for AI algorithms used by health insurers in coverage decision-making.

Ai Risk AssessmentsAmber

Arkansas Senate Bill 258 addresses AI and data protection, focused on high-risk AI systems and impact assessments, but its enactment status could not be confirmed.

Claims (1):

• Arkansas Senate Bill 258 addresses AI and data protection, focusing on high-risk AI systems and their impact assessments; whether the bill has been enacted into law could not be confirmed from available sources.

Biometric RegimeRed

No dedicated biometric-data statute (comparable to Illinois BIPA) was identified in Arkansas.

Absence provenance: not recorded. Searched: Arkansas biometric information privacy act.

Claims (1):

• No dedicated biometric-data or genetic-data statute, and no Arkansas-specific state-surveillance carve-out statute, was identified.

Genetic DataRed

No dedicated genetic-data statute was identified in Arkansas.

Absence provenance: not recorded. Searched: Arkansas genetic privacy statute.

Claims (1):

• No dedicated biometric-data or genetic-data statute, and no Arkansas-specific state-surveillance carve-out statute, was identified.

State Surveillance CarveoutsRed

No Arkansas-specific state-surveillance carve-out statute was identified beyond generally applicable federal national-security exemptions.

Absence provenance: not recorded. Searched: Arkansas state surveillance carveout statute.

Claims (1):

• No dedicated biometric-data or genetic-data statute, and no Arkansas-specific state-surveillance carve-out statute, was identified.

Age VerificationAmber

Act 612 requires age-verification methods for websites containing a substantial portion of material harmful to minors.

Claims (1):

• Arkansas's Protection of Minors from the Distribution of Harmful Material Act requires age-verification methods before allowing access to a website containing a substantial portion of material that is harmful to minors.

Parental ConsentRed

The Social Media Safety Act's parental-consent requirement for minors under 18 was enjoined and later ruled unconstitutional; it is not currently enforceable.

Claims (1):

• The Arkansas Social Media Safety Act (SB396), which would have required age verification and parental consent for minors under 18 to use social media platforms, was enjoined by the U.S. District Court for the Western District of Arkansas and subsequently held unconstitutional on First and Fourteenth Amendment grounds; its consent mechanism is not currently enforceable.

Minor Profiling BansAmber

HB1717 prohibits targeted advertising and mandates data-management practices for minors' data, effective July 1, 2026.

Claims (1):

• The Arkansas Children and Teens' Online Privacy Protection Act (HB1717), effective July 1, 2026, prohibits covered operators from collecting personal data from minors for targeted-advertising purposes and mandates specific data-management practices.

Education SettingsRed

No Arkansas education-settings-specific data-protection statute beyond federal FERPA was identified.

Absence provenance: not recorded. Searched: Arkansas student data privacy law.

Claims (1):

• No Arkansas education-settings-specific data-protection statute beyond the federal Family Educational Rights and Privacy Act was identified.

Dependent AdultsRed

No Arkansas dependent-adults data-protection statute was identified; the SAFER AR Act addresses financial-exploitation reporting duties for Adult Protective Services but is not a data-protection statute.

Absence provenance: not recorded. Searched: Arkansas dependent adult data protection statute, Arkansas elder data privacy law.

Claims (1):

• No Arkansas data-protection-specific statute for dependent adults was identified; the state's SAFER AR Act creates a financial-exploitation reporting duty for Adult Protective Services but does not create data-protection rights or obligations.

Regulator Powers And PenaltiesGreen

The Attorney General holds the power to sanction PIPA violations and issue penalties; the Deceptive Trade Practices Act supplies broader civil-penalty authority used for privacy-adjacent enforcement.

Claims (1):

• The Arkansas Attorney General holds the power to sanction violations of the Personal Information Protection Act and issue penalties.

Enforcement Activity IndexGreen

AG Griffin has brought or continued multiple 2024-2026 enforcement actions touching data privacy (TikTok, Meta, Temu, Google, GM).

Claims (1):

• Arkansas Attorney General Tim Griffin has pursued active enforcement in 2024-2026 targeting privacy-adjacent deceptive practices, including suits against TikTok/ByteDance, Meta, and Temu based on Arkansans' personal information.

Regulator Funding And CapacityAmber

The AG's Consumer Protection Division is described as a small team managing a broad portfolio including privacy.

Claims (1):

• The Consumer Protection Division of the Arkansas Attorney General's Office is described as a small team of lawyers and investigators managing antitrust, tobacco, charities enforcement, privacy, and other deceptive-trade-practices matters.

Collective Redress And Class ActionsRed

No confirmed data-protection-specific class-action mechanism was identified; enforcement is AG-driven.

Absence provenance: not recorded. Searched: Arkansas data breach class action mechanism.

Claims (1):

• No Arkansas data-protection-specific collective-redress or class-action mechanism was identified; available enforcement is Attorney-General-driven.

Private Right Of ActionRed

PIPA does not appear to grant Arkansas consumers a private right of action; enforcement rests with the Attorney General.

Claims (1):

• The Personal Information Protection Act does not grant Arkansas consumers an express private right of action; enforcement authority rests with the Attorney General.

Recent Developments 180DAmber

Within the last 180 days, the Social Media Safety Act was held unconstitutional and the Children and Teens' Online Privacy Protection Act's July 1, 2026 effective date approached/occurred.

Claims (1):

• Within the recent reporting window, Arkansas courts held the Social Media Safety Act unconstitutional on First and Fourteenth Amendment grounds, and the Children and Teens' Online Privacy Protection Act's July 1, 2026 effective date approached.