Operates a social platform, in Arkansas

Ark. Code Ann. section 4-110-104(b) · Read the law's page

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
• This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
• There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.

Act 900 of 2025 (SB611), amending Ark. Code Ann. § 4-88-1401 et seq. · Read the law's page

• Applies to social media platforms as statutorily defined; the Act lowers the covered minor age from 18 to 16.
• Do not use addictive design features (these duties carried a delayed effective date of April 21, 2026).
• Provide default privacy settings.
• Disable non-essential notifications between 10 PM and 6 AM.

Act 901 of 2025 (SB612), codified at Ark. Code Ann. §§ 4-88-1501 to 4-88-1503 · Read the law's page

• Applies to social media platforms as statutorily defined. Do not let a platform's design, algorithm or feature cause a minor to suffer harm such as an eating disorder, suicide or attempted suicide, or platform addiction.