Arkansas

Act 159 amends the Frank Broyles Publicity Rights Protection Act of 2016 so that the Act's existing definitions of "likeness" and "photograph" expressly include a reproduction generated through artificial intelligence, and adds a new definition of "voice" that reaches a simulation of an individual's voice, including an AI-generated simulation, whether or not it contains the person's actual voice.

It also narrows a safe harbor for a system or network provider, so that a provider loses that protection once it has actual knowledge that a photograph, voice, or likeness on its system violates the Act. Approved February 25, 2025.

Act 827 creates the offense of unlawful creation or distribution of deepfake visual material: without the depicted person's consent, knowingly creating or distributing an AI-generated or AI-modified visual depiction that an ordinary person would conclude shows an identifiable person nude or engaged in sexual conduct. A first offense is a Class A misdemeanor and a second or subsequent offense is a Class D felony.

The Act separately creates a civil cause of action: a person injured by a violation may sue whoever created the deepfake or the provider or developer of the image-generation technology used to create it, and the Attorney General may separately sue a provider or developer of prompt-based image-generation technology used to create the material if that provider or developer lacked reasonable safeguards against generating it.

Ark. Code Ann. § 5-14-139(d) exempts a provider of, or an affiliate of a provider of, a telecommunication service, information service, or cable service as defined in 47 U.S.C. § 153, for content provided by another person. Approved April 17, 2025.

Act 977 amends the Arkansas Protection of Children Against Exploitation Act of 1979 and the state's computer-crimes-against-minors chapter to add "computer generated" (produced, adapted, or modified, in whole or in part, through artificial intelligence) alongside the existing categories of prohibited child sexual abuse material, and adds "indistinguishable," a visual or print medium that an ordinary person viewing it would conclude depicts an actual child, excluding a drawing, cartoon, sculpture, or painting.

Electronic facilitation of child sexual abuse, which now reaches this computer-generated material, is a Class B felony under section 5-27-603; the felony class for the amended distributing, possessing, or viewing offense at section 5-27-602 is not stated in the text of this Act.

The Act carves out an interactive computer service for content supplied by another party, a law-enforcement investigation exemption, and a safe harbor for a provider or developer whose computer-generated material was produced through adversarial testing conducted in good faith to prevent, detect, or mitigate the risk of an AI system generating this material, so long as the testing was not for personal, exploitative, or unrelated purposes. Approved April 22, 2025.

Act 927 adds Ark. Code Ann. § 18-4-101, assigning default ownership of a generative artificial intelligence tool's output.

Absent a contrary agreement, the person who provides the input or directive to the tool owns the content it generates, and the person who provides the data or input used to train the tool owns the resulting trained model, provided the content or training data does not infringe an existing copyright or other intellectual property right and, for a trained model, that the training data was lawfully acquired and ownership was not otherwise transferred by contract.

Where an employee uses the tool to generate content or train a model within the scope of employment and under the employer's direction and control, the employer owns the result instead. The section grants no ownership over infringing content regardless of AI use. Approved April 21, 2025.

PIPA requires an individual, business, or state agency that acquires, owns, or licenses personal information of an Arkansas resident to implement and maintain reasonable security procedures, dispose of records properly, and notify affected Arkansas residents of a breach of security without unreasonable delay.

If a breach affects more than 1,000 individuals, the person or business must also notify the Attorney General, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever is first.

Biometric data, including faceprint and voiceprint, is one of the data elements that makes information personal information for these purposes, named with no exclusion for data derived from a photograph or recording, but PIPA imposes no separate capture-consent, retention, or destruction duty on biometric data as such.

PIPA violations are enforced by the Attorney General under the Arkansas Deceptive Trade Practices Act; whether that Act's own private-suit provision, section 4-88-113, also arms a private plaintiff for a PIPA violation specifically was not confirmed from primary text and is left as an open question rather than a decided finding.

A person commits computer fraud by intentionally accessing, or causing to be accessed, any computer, computer system, or computer network for the purpose of devising or executing a scheme to defraud or extort, or of obtaining money, property, or a service through a false or fraudulent intent, representation, or promise.

The offense does not turn on whether the access itself was authorized, only on the fraudulent or extortionate purpose behind it, so ordinary automated access to a public page for a non-fraudulent purpose falls outside this section. Computer fraud is a Class D felony.

A person commits computer trespass by intentionally and without authorization accessing, altering, deleting, damaging, destroying, or disrupting any computer, computer system, computer network, computer program, or data.

The offense is graded by loss or damage caused: a Class C misdemeanor for a first violation causing none, rising to a Class B misdemeanor for a repeat violation causing none or a violation causing less than five hundred dollars, a Class A misdemeanor between five hundred and two thousand five hundred dollars, and a Class D felony at two thousand five hundred dollars or more. The statute requires both intent and a lack of authorization.

A person commits unlawful interference with access to computers by knowingly and without authorization interfering with, denying, or causing the denial of access to or use of a computer, system, or network to a person who has the duty and right to use it, a Class A misdemeanor.

Separately, a person commits unlawful use or access to computers by knowingly and without authorization using, accessing, attempting to access, or causing access to be gained to a computer, system, network, telecommunications device, telecommunications service, or information service, also a Class A misdemeanor, rising to a Class C felony where either violation is committed to devise or execute a scheme to defraud or illegally obtain property.

It is an affirmative defense that the person reasonably believed they were authorized and acting within the scope of that authorization, or that the person able to consent would have authorized the access; a defendant who intends to raise this defense must give the prosecuting attorney written notice at least fourteen calendar days before trial or hearing.

This section is sometimes cited under the caption "unlawful computerized communications," which is instead the name of a different, unrelated section, Ark. Code Ann. § 5-41-108, a harassment statute covering threatening or obscene electronic messages and having no bearing on unauthorized computer access.

A person or business that acquires, owns, or licenses personal information about an Arkansas resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

This reasonable-security duty sits in the same Act, and the same code section, as the Act's separate duty to take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information that is no longer to be retained, and it is legally distinct from the Act's breach-notification duty at section 4-110-105, already researched as this jurisdiction's privacy row.

"Business" is defined to include a state agency, so the duty reaches Arkansas's own state agencies as well as private persons and businesses. The reasonable-security duty has not been amended since the Act's original 2005 enactment: the only later amendment to this subchapter located, Act 1030 of 2019, added biometric data elements to the definition of personal information and separately amended the breach-notification section, and left this duty's own text untouched.

Act 1526 of 2005 itself states no day-precise commencement date and carries no emergency clause, so its default constitutional commencement, ninety days after the 2005 Regular Session's sine die adjournment, is not pinned to a calendar day from primary text here.

The Act names no dedicated regulator and no penalty amount of its own for a violation of this duty; any violation of the subchapter is punishable only by action of the Attorney General under the Arkansas Deceptive Trade Practices Act, and whether that Act's own private-suit provision also arms a private plaintiff for a violation of the reasonable-security duty specifically was not confirmed from primary text.

Makes a commercial entity liable if more than one third of its website content is material harmful to minors and it fails to perform reasonable age verification using a government issued ID, digital identification, or a commercially reasonable method meeting identity assurance level 2.