Arkansas

Act 159 amends the Frank Broyles Publicity Rights Protection Act of 2016 so that the Act's existing definitions of "likeness" and "photograph" expressly include a reproduction generated through artificial intelligence, and adds a new definition of "voice" that reaches a simulation of an individual's voice, including an AI-generated simulation, whether or not it contains the person's actual voice.

It also narrows a safe harbor for a system or network provider, so that a provider loses that protection once it has actual knowledge that a photograph, voice, or likeness on its system violates the Act. Approved February 25, 2025.

Act 827 creates the offense of unlawful creation or distribution of deepfake visual material: without the depicted person's consent, knowingly creating or distributing an AI-generated or AI-modified visual depiction that an ordinary person would conclude shows an identifiable person nude or engaged in sexual conduct. A first offense is a Class A misdemeanor and a second or subsequent offense is a Class D felony.

The Act separately creates a civil cause of action: a person injured by a violation may sue whoever created the deepfake or the provider or developer of the image-generation technology used to create it, and the Attorney General may separately sue a provider or developer of prompt-based image-generation technology used to create the material if that provider or developer lacked reasonable safeguards against generating it.

Ark. Code Ann. § 5-14-139(d) exempts a provider of, or an affiliate of a provider of, a telecommunication service, information service, or cable service as defined in 47 U.S.C. § 153, for content provided by another person. Approved April 17, 2025.

Act 977 amends the Arkansas Protection of Children Against Exploitation Act of 1979 and the state's computer-crimes-against-minors chapter to add "computer generated" (produced, adapted, or modified, in whole or in part, through artificial intelligence) alongside the existing categories of prohibited child sexual abuse material, and adds "indistinguishable," a visual or print medium that an ordinary person viewing it would conclude depicts an actual child, excluding a drawing, cartoon, sculpture, or painting.

Electronic facilitation of child sexual abuse, which now reaches this computer-generated material, is a Class B felony under section 5-27-603; the felony class for the amended distributing, possessing, or viewing offense at section 5-27-602 is not stated in the text of this Act.

The Act carves out an interactive computer service for content supplied by another party, a law-enforcement investigation exemption, and a safe harbor for a provider or developer whose computer-generated material was produced through adversarial testing conducted in good faith to prevent, detect, or mitigate the risk of an AI system generating this material, so long as the testing was not for personal, exploitative, or unrelated purposes. Approved April 22, 2025.

Act 927 adds Ark. Code Ann. § 18-4-101, assigning default ownership of a generative artificial intelligence tool's output.

Absent a contrary agreement, the person who provides the input or directive to the tool owns the content it generates, and the person who provides the data or input used to train the tool owns the resulting trained model, provided the content or training data does not infringe an existing copyright or other intellectual property right and, for a trained model, that the training data was lawfully acquired and ownership was not otherwise transferred by contract.

Where an employee uses the tool to generate content or train a model within the scope of employment and under the employer's direction and control, the employer owns the result instead. The section grants no ownership over infringing content regardless of AI use. Approved April 21, 2025.

PIPA requires an individual, business, or state agency that acquires, owns, or licenses personal information of an Arkansas resident to implement and maintain reasonable security procedures, dispose of records properly, and notify affected Arkansas residents of a breach of security without unreasonable delay.

If a breach affects more than 1,000 individuals, the person or business must also notify the Attorney General, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever is first.

Biometric data, including faceprint and voiceprint, is one of the data elements that makes information personal information for these purposes, named with no exclusion for data derived from a photograph or recording, but PIPA imposes no separate capture-consent, retention, or destruction duty on biometric data as such.

PIPA violations are enforced by the Attorney General under the Arkansas Deceptive Trade Practices Act; whether that Act's own private-suit provision, section 4-88-113, also arms a private plaintiff for a PIPA violation specifically was not confirmed from primary text and is left as an open question rather than a decided finding. The provisions this entry describes came into force on different days.

Act 952 of 2025 adds Subchapter 15 to Chapter 88 of Title 4 of the Arkansas Code and names it the Arkansas Children and Teens' Online Privacy Protection Act. It takes effect on July 1, 2026. It binds an operator of a website, online service, online application or mobile application that is directed at children or teens, or that has actual knowledge it is collecting personal information from children or teens. A child is an individual twelve years of age or younger.

A teen is an individual located in Arkansas who is thirteen years of age or older and younger than seventeen. The operator must obtain consent for the collection, use or disclosure of a teen's personal information from the teen or the teen's parent, except for purposes the Act lists. The operator must give clear and conspicuous notice of what information it collects from children or teens, the purpose of processing it, and its disclosure practices.

The parent of a child must be able to request deletion of the child's account, content or information and to refuse further collection of the child's personal information. A teen must be able at any time to delete personal information collected from the teen and to challenge its accuracy and have inaccurate information corrected. The operator may not collect a child's or teen's personal information for targeted advertising to children or teens, or let another person do so.

It may collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or its relationship with the child or teen, or is required or specifically authorized by law. It may not retain that information for longer than is reasonably necessary to fulfill a transaction or provide a service the child, teen or parent requested, except as required for the safety or integrity of the service or specifically authorized by law.

The operator must establish, implement and maintain reasonable security practices to protect the personal information of children and teens. The Act does not require an operator to collect age information it is not already collecting or to implement age verification. The Attorney General has exclusive authority to enforce the Act, and it creates no private right of action.

A person commits computer fraud by intentionally accessing, or causing to be accessed, any computer, computer system, or computer network for the purpose of devising or executing a scheme to defraud or extort, or of obtaining money, property, or a service through a false or fraudulent intent, representation, or promise.

The offense does not turn on whether the access itself was authorized, only on the fraudulent or extortionate purpose behind it, so ordinary automated access to a public page for a non-fraudulent purpose falls outside this section. Computer fraud is a Class D felony.

A person commits computer trespass by intentionally and without authorization accessing, altering, deleting, damaging, destroying, or disrupting any computer, computer system, computer network, computer program, or data.

The offense is graded by loss or damage caused: a Class C misdemeanor for a first violation causing none, rising to a Class B misdemeanor for a repeat violation causing none or a violation causing less than five hundred dollars, a Class A misdemeanor between five hundred and two thousand five hundred dollars, and a Class D felony at two thousand five hundred dollars or more. The statute requires both intent and a lack of authorization.

A person commits unlawful interference with access to computers by knowingly and without authorization interfering with, denying, or causing the denial of access to or use of a computer, system, or network to a person who has the duty and right to use it, a Class A misdemeanor.

Separately, a person commits unlawful use or access to computers by knowingly and without authorization using, accessing, attempting to access, or causing access to be gained to a computer, system, network, telecommunications device, telecommunications service, or information service, also a Class A misdemeanor, rising to a Class C felony where either violation is committed to devise or execute a scheme to defraud or illegally obtain property.

It is an affirmative defense that the person reasonably believed they were authorized and acting within the scope of that authorization, or that the person able to consent would have authorized the access; a defendant who intends to raise this defense must give the prosecuting attorney written notice at least fourteen calendar days before trial or hearing.

This section is sometimes cited under the caption "unlawful computerized communications," which is instead the name of a different, unrelated section, Ark. Code Ann. § 5-41-108, a harassment statute covering threatening or obscene electronic messages and having no bearing on unauthorized computer access.

A state agency means a department, agency, division, board, or commission within the executive branch of the state government. The State Cybersecurity Office shall be responsible for directing and managing all functions related to state cybersecurity and information security for each state agency. The State Cybersecurity Office shall establish cybersecurity governance policies, procedures, and standards, including cybersecurity and data breach notification.

A state agency shall comply with the governance standards, policies, and procedures established by the State Cybersecurity Office. Cybersecurity personnel and personnel with information security job functions within each state agency shall functionally report to the State Cybersecurity Office. Arkansas Legislative Audit reports that Act 489 created the State Cybersecurity Office as part of the Department of Shared Administrative Services.

All municipalities, counties, and school districts in Arkansas shall participate in the Arkansas Self-Funded Cyber Response Program. The Arkansas Cyber Response Board shall establish minimum cybersecurity criteria for participating governmental entities. A participating governmental entity shall have twelve months to become compliant with the minimum cybersecurity criteria established by the board.

Failure to comply with the minimum cybersecurity criteria may result in the board establishing lower program coverage amounts. To sustain program coverage, a participating governmental entity shall procure an audit of its books and records for each fiscal year, including an information systems audit, review, or assessment performed by Arkansas Legislative Audit.

Arkansas Legislative Audit reports that Act 846 of 2023 authorized formation of the Arkansas Cyber Response Board to oversee the Arkansas Self-Funded Cyber Response Program. The board shall promulgate rules and procedures for use of the program that generally align with a procedure under which a participating governmental entity notifies the cyber response contact designated by the board upon discovery of a cyberattack.

A public entity means an instrumentality funded in whole or in part by taxpayer funds. A public entity shall develop a cybersecurity policy for all technology resources of the public entity based on the standards and guidelines set by the State Cybersecurity Office. The cybersecurity policy duty does not apply to political subdivisions of the state. A public entity shall develop a training program for all employees concerning the technology resources policy and the cybersecurity policy.

A political subdivision of the state is not required to develop a training program under the section for a cybersecurity policy. Each state entity shall submit a cybersecurity policy for approval to the State Cybersecurity Office by October 1 of each even-numbered year. A public entity, except for a political subdivision of the state, shall create a disciplinary procedure for a violation of its cybersecurity policy in consultation with the State Cybersecurity Office.

Arkansas Legislative Audit reports that Act 504 of 2023 requires public entities to develop policies pertaining to the authorized use of technology resources and addressing cybersecurity concerns.

A person or business that acquires, owns, or licenses personal information about an Arkansas resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

This reasonable-security duty sits in the same Act, and the same code section, as the Act's separate duty to take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information that is no longer to be retained, and it is legally distinct from the Act's breach-notification duty at section 4-110-105, already researched as this jurisdiction's privacy row.

"Business" is defined to include a state agency, so the duty reaches Arkansas's own state agencies as well as private persons and businesses. The reasonable-security duty has not been amended since the Act's original 2005 enactment: the only later amendment to this subchapter located, Act 1030 of 2019, added biometric data elements to the definition of personal information and separately amended the breach-notification section, and left this duty's own text untouched.

Act 1526 of 2005 itself states no day-precise commencement date and carries no emergency clause, so it took effect on the general effective date the Arkansas Attorney General set for acts of the 2005 Regular Session that carried neither, August 12, 2005.

The Act names no dedicated regulator and no penalty amount of its own for a violation of this duty; any violation of the subchapter is punishable only by action of the Attorney General under the Arkansas Deceptive Trade Practices Act, and whether that Act's own private-suit provision also arms a private plaintiff for a violation of the reasonable-security duty specifically was not confirmed from primary text.

A public entity means an entity of the state, a political subdivision of the state, or a school. A security incident means any compromise of the security, confidentiality, or integrity of an information system maintained by a public entity, a contractual provider of an information system that contracts with a public entity, or other computer-related services of a public entity, caused by unauthorized access, destruction, or acquisition of data.

A public entity that experiences a security incident shall disclose, in writing, an initial report of the known facts of the incident to the Legislative Auditor within five business days after learning of the incident. A public entity shall provide regular updates of the security incident to the Legislative Auditor until the investigation of the incident is closed. The Legislative Auditor shall maintain a list of all security incidents reported by a public entity.

If the Legislative Auditor believes an incident significantly compromises citizens' data, creates a significant security concern, or involves significant theft, the Legislative Auditor shall notify a list of state officials beginning with the Governor. A report, update, notification, or list created or maintained under the section is exempt from disclosure under the Freedom of Information Act of 1967. The section was amended by Act 175 of 2023, effective August 1, 2023.

Arkansas Legislative Audit reports that 217 cybersecurity incidents were reported to it by 124 public entities from July 1, 2024 through June 30, 2025.

Makes a commercial entity liable if its website contains a substantial portion of material harmful to minors, as the applicability criteria define it, and it fails to perform reasonable age verification using a government issued ID, digital identification, or a commercially reasonable method meeting identity assurance level 2.

Creates a private right of action against a social media platform whose design, algorithm, or feature causes a minor to suffer harm such as an eating disorder, suicide or attempted suicide, or platform addiction. Signed April 21, 2025 and effective August 5, 2025 with no separate effective date clause.

A child is an individual twelve years of age or younger in Arkansas. A teen is an individual located in Arkansas who is thirteen years of age or older and younger than seventeen.

The duties below apply to an operator of a website, online service, online application or mobile application that has actual knowledge that it is collecting personal information from children or teens. The operator must obtain consent for the collection, use or disclosure of a teen's personal information from the teen or the teen's parent, except for purposes the Act lists.

The operator must provide clear and conspicuous notice of what information it collects from children or teens, the purpose of processing it, and its disclosure practices.

The operator must give the parent of a child the opportunity to request deletion of the child's account, content or information and to refuse further collection of the child's personal information, and to challenge and correct inaccurate information. The operator must give a teen the opportunity at any time to delete personal information collected from the teen, and to challenge the accuracy of that information and have inaccurate information corrected.

The operator must establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens.

It is also unlawful for an operator directed at children or teens, or one with actual knowledge that it collects their personal information, to collect that information for targeted advertising to children or teens, to collect it outside the context of a service or the child's or teen's relationship with the operator unless law requires or authorizes it, or to retain it longer than is reasonably necessary to fulfill a transaction or provide a requested service, except as required for the safety or integrity of the service or specifically authorized by law.

The Act does not require an operator to affirmatively collect age information it is not already collecting in the normal course of business, or to implement age-gating or age verification functionality.

The Attorney General has exclusive authority to enforce the Act, and the Act creates no private right of action. A violation of the teen consent duty or of the duties owed to the parent of a child is treated as an unfair or deceptive act or practice under the Deceptive Trade Practices Act.

The Act was approved on April 21, 2025. The Act is effective on and after July 1, 2026.