Arkansas Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Arkansas Site Laws Deserve a Closer Look in 2026

Arkansas does not have a generally applicable consumer privacy statute for adults comparable to the laws enacted in California, Texas, or Virginia. The most recent comprehensive proposal, SB 258, the Arkansas Digital Responsibility, Safety, and Trust Act, failed in the Senate and died at sine die adjournment on May 5, 2025. It is a proposal, not Arkansas law.

That absence does not make Arkansas a light-touch state for online businesses. Website owners can still face targeted rules concerning minors’ data, security-breach response, deceptive online sales practices, adult-content age verification, sales-tax collection, AI-generated content, and compensated online content featuring minors. The practical question is usually not whether a site has an Arkansas privacy policy, but whether its business model brings it within one of these narrower statutes.

The Children and Teens’ Online Privacy Protection Act: In Effect Since July 1, 2026

The Arkansas Children and Teens’ Online Privacy Protection Act was enacted as Act 952 of 2025 (HB 1717) and became effective on July 1, 2026. It covers for-profit operators of websites, online services, online applications, and mobile applications that are directed to children or teens, as well as operators with actual knowledge that they collect personal information from them.

For this law, a child is an Arkansas individual age 12 or younger. A teen is an Arkansas individual age 13 through 16. Covered operators must provide clear and conspicuous notice describing their collection, processing, disclosure, and sharing practices. They must obtain verifiable parental consent before collecting, using, or disclosing a child’s personal information. For teens, the statute generally requires consent from either the teen or the teen’s parent before collection, use, or disclosure, subject to statutory exceptions such as providing or maintaining a requested product or service.

The Act also restricts collection to information consistent with the context of the service or relationship, limits retention to what is reasonably necessary, requires reasonable security practices, and provides correction and deletion rights. Its targeted-advertising rule is especially important: a covered operator may not collect, or permit another person to collect, a child’s or teen’s personal information for targeted advertising. The statutory definition focuses on advertising selected from a consumer’s activities over time and across nonaffiliated websites or applications; it excludes, among other things, contextual advertising and advertising based solely on activity within the operator’s own site or app.

Enforcement belongs exclusively to the Arkansas Attorney General; the Act does not create a private right of action. It also expressly does not require an operator to collect age information it does not ordinarily collect or to add age-gating or age-verification functionality. A general-audience online store is therefore not automatically required to age-gate, but a business that operates youth-directed pages or has actual knowledge it collects data from Arkansas users under 17 should review its notices, consent process, retention practices, and third-party advertising tools.

Child Content Creation Protection Act: Rules for Family Influencers and Platforms

Arkansas also enacted the Child Content Creation Protection Act, Act 982 of 2025 (HB 1975), effective July 1, 2026. This is not a general website-privacy law. It is directed at an Arkansas-resident parent or legal guardian who creates compensated static-image or video content performed in Arkansas, including a vlogger, podcaster, social-media influencer, or streamer.

The Act applies its recordkeeping and trust-account rules when a minor age 17 or younger meets the statutory content, compensation, and revenue thresholds. In general, the test includes a minor’s likeness, name, or photograph appearing in at least 30% of a creator’s compensated content during a 30-day period, qualifying views or compensation, and at least $15,000 in actual compensation during the prior 12 months. A covered creator must maintain specified records until the minor turns 21 and set aside the required portion of gross earnings in a qualifying trust account for the minor. The statute provides private civil remedies for specified recordkeeping and trust-account violations.

Act 982 also matters to covered social-media platforms. It requires an easily accessible mechanism through which a featured minor, or an adult featured as a minor on or after July 1, 2026, may request deletion of the content or removal of private information when the person is uniquely identifiable. The platform must review the request and take reasonable steps to remove the content unless the request lacks sufficient accurate information or the platform finds the content sufficiently newsworthy or otherwise in the public interest to outweigh the featured person’s privacy interests. Operators of user-generated social features should assess whether their service falls within the Act’s defined term “social media platform” and whether their intake and removal processes can handle these requests.

The Personal Information Protection Act and Breach Notification

Arkansas’s Personal Information Protection Act, A.C.A. §§ 4-110-101 through 4-110-108, applies to a person or business that acquires, owns, or licenses computerized data containing covered personal information about Arkansas residents. The statute requires reasonable security procedures and practices and requires reasonable destruction of customer records containing personal information when they are no longer retained.

When unencrypted covered personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person, the business generally must notify affected Arkansas residents in the most expedient time and manner possible and without unreasonable delay. The statute permits delay when law enforcement determines notice would impede a criminal investigation, and it permits a business to forgo individual notice after a reasonable investigation if it determines there is no reasonable likelihood of harm to customers. The current breach-notification requirements, notice methods, substitute-notice thresholds, and record-retention rule are set out in A.C.A. § 4-110-105.

If a breach affects the personal information of more than 1,000 individuals, the business required to disclose the breach must also notify the Arkansas Attorney General at the same time it notifies affected individuals or within 45 days after determining a reasonable likelihood of harm to customers, whichever comes first. The Attorney General provides a data-breach reporting page and online reporting form. Businesses must retain their written breach determination and supporting documentation for five years and provide them within 30 days after an Attorney General request.

The Deceptive Trade Practices Act and Your Online Store

The Arkansas Deceptive Trade Practices Act, A.C.A. § 4-88-101 and following sections, is the state’s broad consumer-protection law. It prohibits a range of deceptive, unconscionable, false, or misleading practices in business, commerce, and trade. The Attorney General’s Consumer Protection Division identifies enforcement of the Deceptive Trade Practices Act and the Personal Information Protection Act as part of its work.

For an online business, this is the statute most relevant to ordinary commerce practices: product descriptions, advertised discounts, recurring-payment disclosures, shipping and handling charges, availability claims, endorsements, review practices, and cancellation flows. Make sure material terms are presented before a consumer commits to the transaction, and make sure claims about price, performance, stock, and consumer reviews can be supported. The statute’s application is fact-specific; this report does not substitute for legal advice about a particular campaign or checkout flow.

Age Verification Under Act 612 of 2023

The Protection of Minors from Distribution of Harmful Material Act, enacted as Act 612 of 2023 (SB 66), regulates websites containing a substantial portion of material harmful to minors. “Substantial portion” means more than 33.33% of a website’s total material. The Act took effect in 2023.

A commercial entity must use a reasonable age-verification method before allowing access to a website containing that substantial portion of harmful material. The statute lists a digitized identification card, government-issued identification, or a commercially reasonable method meeting Identity Assurance Level 2 as examples. A commercial entity that knowingly and intentionally publishes or distributes harmful material from a covered site may be liable if it fails to perform reasonable age verification. If the entity or a third-party vendor performs verification, the entity may not retain identifying information after access is granted.

One correction matters for website owners: Act 612 provides an individual right of action for damages, court costs, and reasonable attorney’s fees in the circumstances specified by the statute. It is not an Attorney General-only enforcement law. The Act also contains exclusions and protections for news or public-interest material, news-gathering organizations, cloud-service providers, and certain access providers. For most conventional business and eCommerce sites, the statutory threshold means this law will not apply; sites that primarily publish adult material should assess the text of the statute closely.

Arkansas Site Laws for eCommerce: Sales and Use Tax

Arkansas requires remote sellers and marketplace facilitators to collect and remit applicable Arkansas sales or use tax when, in the prior or current calendar year, their aggregate Arkansas sales of taxable items exceed $100,000 or they make at least 200 separate Arkansas sales transactions. The rule comes from Act 822 of 2019. The threshold is an “or” test, so either level can establish the statutory collection duty.

Marketplace facilitators that meet the threshold generally collect and remit tax on facilitated marketplace sales. A marketplace seller should still account for direct sales through its own website and should not assume marketplace collection resolves every filing or registration question. The Department of Finance and Administration offers remote-seller registration through the Arkansas Taxpayer Access Point.

Taxability depends on what the business sells and how it is delivered. Do not assume that every digital item, subscription, service, or software product is taxed in the same way. Review the applicable product category, sourcing rule, state rate, and local rate using the Department of Finance and Administration’s current sales-and-use-tax materials before configuring checkout tax settings.

The 2025 AI Laws and Your Content

Arkansas enacted several 2025 laws that may matter to businesses using AI in marketing, content production, or user-facing tools. Act 927 of 2025 (HB 1876) provides that a person who supplies input or a directive to a generative-AI tool to generate content or conduct model training owns the resulting content or model-training data, unless the material infringes existing copyright or other intellectual-property rights. When an employee is directed to use generative AI as part of employment duties, the Act provides that the output or model-training data belongs to the employer.

Act 159 of 2025 (HB 1071) amended the Frank Broyles Publicity Rights Protection Act to address images, voices, and likenesses reproduced through AI and used commercially. The state’s legislative summary explains that the law allows an affected individual to seek damages and recover certain proceeds from unauthorized commercial use. Businesses should not treat an AI-generated voice, photograph, or likeness of a real person as automatically cleared for advertising use.

Arkansas also enacted criminal laws concerning deepfake sexual material and computer-generated images indistinguishable from images of children. Those laws are especially relevant to platforms that accept user uploads or provide image-generation tools. They do not themselves prescribe a universal website takedown process, but moderation rules, escalation paths, and vendor controls can be important operational safeguards for businesses in these higher-risk categories.

The Social Media Safety Act: Enjoined Litigation, Not a General Website Duty

Arkansas’s 2023 Social Media Safety Act, Act 689, required covered social-media companies to verify account holders’ ages and obtain parental consent for minors. In NetChoice, LLC v. Griffin, the U.S. District Court for the Western District of Arkansas permanently enjoined Act 689 on March 31, 2025. The court held that the statute violated the First Amendment and was impermissibly vague.

In 2025, Arkansas enacted Acts 900 and 901. Act 900 amended and supplemented the social-media framework with provisions addressing certain design practices, default settings, notifications, and parental supervision. Act 901 created state-enforced restrictions and a separate private-right-of-action provision relating to specified harms allegedly caused by a social-media platform. The same federal court preliminarily enjoined enforcement of the portions of Act 901 for which the state defendants had enforcement authority on December 15, 2025, and preliminarily enjoined Act 900 on April 20, 2026. The Act 900 order states that the injunction remains pending final resolution of the case.

The injunctions in the Act 900 and Act 901 case run against enforcement against NetChoice’s members; they are not a final merits decision on every possible application of those statutes. In addition, the Act 901 order did not enjoin its private-right-of-action provision because the state defendants disclaimed authority to enforce that provision, so the court did not decide whether a private plaintiff could pursue it. The related appeals remain pending in the Eighth Circuit. Accordingly, as of September 21, 2026, ordinary business websites should not treat the enjoined state-enforcement provisions as active general website duties, but a company operating a defined social-media platform or user-to-user community should monitor the litigation and assess Act 901’s separate private-litigation risk with counsel.

What You Should Do Now

1. Determine whether your website, app, or online service is directed to users under 17 or whether you have actual knowledge that you collect Arkansas children’s or teens’ personal information. If so, review Act 952 notices, consent practices, retention, security, correction/deletion workflows, and cross-site targeted-advertising arrangements.
2. If you are an Arkansas-based compensated creator who features minors in online content, assess whether Act 982’s statutory thresholds are met. If they are, implement required records and trust-account practices. A covered social-media platform should also evaluate its mechanism for receiving and reviewing Act 982 deletion or private-information-removal requests.
3. Maintain a written incident-response process for Arkansas resident data, including a documented likelihood-of-harm assessment, notice procedures, Attorney General reporting for breaches affecting more than 1,000 individuals, and five-year retention of the written determination and supporting documents.
4. Review offers, advertised prices, subscription renewals, checkout disclosures, endorsements, and review practices for clarity and substantiation under Arkansas consumer-protection law.
5. Track Arkansas sales using both remote-seller nexus measures: more than $100,000 in applicable Arkansas sales or at least 200 separate Arkansas transactions in the current or previous calendar year.
6. If your site uses AI-generated people, voices, images, or marketing content, document rights-clearance and review practices. If your service supports user uploads or image generation, assess whether its moderation and escalation processes address unlawful intimate deepfakes and child sexual-exploitation material.

Key Takeaways

• Act 952, Arkansas’s Children and Teens’ Online Privacy Protection Act, has been effective since July 1, 2026. It applies to covered services directed to children or teens and services with actual knowledge of collection from them.
• Act 952 prohibits covered collection for cross-site targeted advertising to Arkansas children and teens, but it does not itself require age-gating or collection of age data a business does not otherwise collect.
• Act 982, the Child Content Creation Protection Act, has also been effective since July 1, 2026. It can impose recordkeeping and trust-account duties on qualifying compensated creators who feature minors and creates a request mechanism that matters to covered social-media platforms.
• The Personal Information Protection Act requires timely consumer breach notice and Attorney General notification for breaches affecting more than 1,000 individuals under the statutory timing rule.
• Act 612 applies to commercial websites where more than 33.33% of total material is harmful to minors and provides a private civil remedy; it is not limited to Attorney General enforcement.
• Remote-seller nexus can arise through either more than $100,000 in applicable Arkansas sales or at least 200 Arkansas sales transactions.
• Act 689 is permanently enjoined. Acts 900 and the state-enforceable portions of Act 901 are preliminarily enjoined against NetChoice’s members, while Act 901’s private-right-of-action provision was not enjoined in that case.

Frequently Asked Questions About Arkansas Site Laws

Does Arkansas have a privacy law like California’s CCPA?

No. As of September 21, 2026, Arkansas does not have a generally applicable consumer privacy statute for adults. SB 258, the 2025 comprehensive privacy proposal, died at adjournment and was not enacted. Arkansas does have the narrower Children and Teens’ Online Privacy Protection Act, effective July 1, 2026.

Do Arkansas site laws apply if my business is located in another state?

They can. For example, Act 952 applies to covered operators directed to Arkansas children or teens or with actual knowledge of collection from them; the breach statute protects Arkansas residents’ covered data; and remote-seller tax obligations may apply when the statutory sales or transaction threshold is met. Act 982 may also matter to a covered social-media platform handling eligible removal requests.

Do Arkansas site laws require age verification on my website?

Act 612 requires reasonable age verification only for a commercial website containing more than 33.33% material harmful to minors. Act 952 does not require a covered operator to age-gate or to collect age data it does not already collect in the ordinary course of business. Act 689’s social-media age-verification framework remains permanently enjoined.

What Arkansas law applies to a parent who earns money from content featuring a child?

Act 982 may apply if the creator and content meet its location, revenue, view or compensation, and content-percentage thresholds. Qualifying creators have recordkeeping and trust-account duties, and the Act provides specified private civil remedies. The statute is targeted to compensated content creation featuring minors, not every family photograph or ordinary business post.

How quickly must I report a data breach in Arkansas?

Consumer notice must be made in the most expedient time and manner possible and without unreasonable delay, subject to the statute’s law-enforcement and reasonable-likelihood-of-harm provisions. For a breach affecting more than 1,000 individuals, Attorney General notice is due at the same time as affected-individual notice or within 45 days after the business determines there is a reasonable likelihood of harm to customers, whichever comes first.

Who owns content my business creates with AI tools under Arkansas law?

Act 927 generally assigns ownership of generated content or model-training data to the person who supplies the input or directive, subject to the Act’s limitation for material that infringes existing copyright or other intellectual-property rights. The Act separately addresses output created by an employee directed to use generative AI as part of employment duties.

Conclusion

Arkansas site-law compliance in 2026 is largely a matter of targeted rules rather than one omnibus privacy statute. The most significant current changes are Act 952’s protections for children and teens, including limits on targeted advertising and consent, notice, retention, security, and data-rights requirements for covered operators, and Act 982’s protections for minors featured in qualifying compensated online content.

For many businesses, the durable baseline remains practical: secure Arkansas customer data, maintain a breach-response plan, present online offers and subscriptions clearly, track remote-seller tax thresholds, and take special care with adult-content access, child-featured creator content, and AI-generated depictions of real people. This report is informational and not legal advice.

Updates

09/21/2026: Child Content Creation Protection Act (Act 982 of 2025; HB 1975)

Status: Effective

September 21, 2026 — Arkansas Child Content Creation Protection Act now effective. Arkansas’s Child Content Creation Protection Act, Act 982 of 2025, took effect on July 1, 2026. It is a targeted law for qualifying compensated content creators who are Arkansas-resident parents or legal guardians and feature minors in static-image or video content performed in Arkansas. When the statute’s content-percentage, view or compensation, and revenue thresholds are met, creators must maintain specified records until the featured minor turns 21 and place the required share of gross earnings into a qualifying trust account. The Act also requires covered social-media platforms to offer an accessible process for eligible featured minors, and adults featured as minors, to request content deletion or removal of private information. Read Act 982.

Sources: Official or supporting source | Official or supporting source | Official or supporting source | Official or supporting source