open-agreements 0.7.7 → 0.8.0

package/skills/legal-explainers/data-privacy-law-explainer/content/arizona.md

@@ -0,0 +1,181 @@
+---
+jurisdiction: "Arizona"
+slug: arizona
+countryCode: US
+snapshotAsOf: "2026-06-19"
+lastReviewed: "2026-06-11"
+canonicalUrl: https://openagreements.org/practice-guides/privacy/us/arizona
+license: CC BY 4.0
+stale: false
+---
+
+> [!IMPORTANT]
+> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
+> provided for general information. It is not legal advice, does not create an attorney-client
+> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
+> Laws change; verify against the canonical version before relying on it.
+>
+> **Canonical:** https://openagreements.org/practice-guides/privacy/us/arizona · **Snapshot as of:** 2026-06-19 · License: CC BY 4.0 · © openagreements.org
+
+# Arizona Consumer Privacy Law[^about]
+
+Arizona has no comprehensive consumer-privacy statute. The operative state laws are the 45-day breach-notification article (A.R.S. §§ 18-551, 18-552), the Consumer Fraud Act, and the Genetic Information Privacy Act for DNA testing companies; the rest of an Arizona privacy program rides the federal overlay.
+
+
+## At a glance
+
+| Question | Arizona |
+| --- | --- |
+| **Law coverage** | Specific data types only |
+| **Summary** | Arizona has no comprehensive consumer-privacy law — despite a circulating vendor claim, none took effect on January 1, 2026 — so the operative state framework is the 45-day breach-notification statute, the Consumer Fraud Act, and the 2021 Genetic Information Privacy Act for DNA testing companies. |
+| **Main law** | A.R.S. §§ 18-551 to 18-552 (data-breach notification) plus the Consumer Fraud Act, A.R.S. §§ 44-1521 et seq. — Arizona has no comprehensive consumer-privacy law; sectoral statutes and a federal overlay are the operative framework |
+| **Privacy policy required?** | No Arizona statute requires a commercial privacy policy — the only state mandates cover state-agency websites and direct-to-consumer genetic testing companies; contents are otherwise driven by FTC Act § 5 and Consumer Fraud Act deception risk |
+| **Who does it cover?** | Any person conducting business in Arizona that owns, maintains, or licenses computerized personal information of Arizona residents — no revenue or consumer-volume threshold; the Genetic Information Privacy Act adds duties for direct-to-consumer genetic testing companies |
+| **Can consumers sue?** | No |
+| **Privacy policy rule** | Policy required only for specific data |
+| **Consent for sensitive data?** | Only for certain data types |
+| **Browser opt-out signals?** | Not required |
+| **Lawsuit detail** | Not under the breach statute or the Genetic Information Privacy Act — both are Attorney General-enforced; other consumer theories, including Consumer Fraud Act or common-law claims, remain fact-specific and untested for pure privacy claims |
+| **Who enforces it?** | Arizona Attorney General |
+
+## Which privacy laws apply to your business in Arizona? {#which-privacy-laws-apply}
+
+**Short answer.** There is no comprehensive Arizona consumer-privacy law. The closest thing to a general state data duty is the breach-notification article, which applies to any person that conducts business in Arizona and that owns, maintains, or licenses unencrypted and unredacted computerized personal information — with no revenue or consumer-volume threshold [^stat-breach-scope]. Day-to-day data practices are policed instead through the Consumer Fraud Act, which declares any deception, deceptive or unfair act or practice, or material omission in connection with the sale or advertisement of any merchandise an unlawful practice [^stat-cfa-unlawful]. The breach article does not reach everyone: persons subject to the Gramm-Leach-Bliley Act and HIPAA covered entities and business associates are exempt from it entirely [^stat-breach-exempt].
+
+One persistent piece of misinformation is worth clearing away first: a claim circulating in compliance-vendor trackers that an Arizona comprehensive privacy law took effect on January 1, 2026 is false — Arizona has never enacted an omnibus privacy statute, and the 2026 proposals (S.B. 1815, which would have created a controller-and-processor framework, and S.B. 1790, which would have regulated data brokers) died in committee without a hearing.
+
+Because no omnibus law exists, Arizona residents have no general state-law rights to access, delete, or correct their personal data or to opt out of its sale or use for targeted advertising, businesses face no notice-at-collection, consent, or data-protection-assessment duties, and universal opt-out signals such as Global Privacy Control have no Arizona statute to hook into. What exists instead is a sectoral patchwork: the breach-notification article sets the one statewide incident-response clock; the Consumer Fraud Act supplies the deception backstop; the Genetic Information Privacy Act regulates direct-to-consumer genetic testing companies; an older article makes genetic-test results confidential and privileged; and narrow statutes restrict Social Security number use and the disposal of paper records. State agencies — but not businesses — must post website privacy-policy statements. Criminal and public-library reader-record rules sit outside this commercial-practice note. The rest of an Arizona-facing program rides the federal overlay: Section 5 of the FTC Act reaches deceptive or unfair privacy practices nationwide, the Gramm-Leach-Bliley Act governs financial institutions, HIPAA governs covered health entities, and the Children's Online Privacy Protection Act governs services directed to children under 13. Businesses with multistate programs can usually layer any future Arizona omnibus obligations onto this federal-and-sectoral baseline.
+
+## What must your Arizona privacy policy contain? {#privacy-policy-contents}
+
+**Short answer.** No Arizona statute requires a commercial website or business to post a consumer privacy policy or fixes what one must say. The state's only privacy-policy mandates are narrowly scoped: every state-agency website must contain a privacy policy statement disclosing its information-gathering and dissemination practices [^stat-agency-policy], and a direct-to-consumer genetic testing company must make available both a high-level privacy policy overview and a prominent, publicly available privacy notice covering its collection, consent, use, disclosure, security, retention, and deletion practices [^q2-gipa-notice]. For everyone else, the governing rule is that whatever you publish must be true: Section 5 of the FTC Act supplies the federal unfair-or-deceptive-practices hook [^fed-ftc5-deceptive], and the Consumer Fraud Act reaches privacy-policy misrepresentations or material omissions tied to the sale or advertisement of merchandise as a matter of state law [^q2-cfa-deception].
+
+In practice the drafting question in Arizona is less what must be included and more does the policy match actual practice. Arizona courts may use FTC Act interpretations as a guide when construing the Consumer Fraud Act, so FTC privacy-deception precedent is a strong analogue rather than an automatic mapping [^q2-cfa-ftc-guide]. Build the policy from the sectoral overlay that applies to you: GLBA privacy notices if you are a financial institution, a COPPA notice if your service is directed to children under 13, and for a HIPAA covered entity a notice of the uses and disclosures of protected health information and of the individual's rights and the entity's duties [^fed-hipaa-notice]. For businesses outside those verticals, follow best practice — describe the categories of data collected, the purposes, the third parties you share with, and how users exercise any choices you offer — then honor it, because the enforceable obligation in Arizona is consistency between the statement and the conduct, not conformity to a state checklist.
+
+## What must your contracts with vendors say? {#vendor-contracts}
+
+**Short answer.** Arizona has no omnibus data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for general commercial contracts. The one statewide vendor duty is breach-specific: a vendor that maintains computerized personal information it does not own or license must notify the owner or licensee as soon as practicable after discovering a breach and cooperate, including by sharing information relevant to the breach [^stat-breach-vendor].
+
+Where a federal or sectoral regime is in scope, it supplies the contracting obligations: the GLBA Safeguards Rule requires financial institutions to oversee service providers by contract and to require them to implement appropriate safeguards [^fed-glba-safeguards], and HIPAA requires a business-associate agreement with mandatory data-protection, breach-reporting, and downstream-subcontractor terms before sharing protected health information [^fed-hipaa-baa]. Outside those verticals, the prudent move is to carry the same protections forward as best practice — processing limited to documented instructions, confidentiality, reasonable security, breach notification back to your business on a clock tighter than the statute's, and return or deletion of data at the end of the engagement — even though no Arizona statute compels them. Note one allocation point in the breach statute worth handling by contract: a vendor that maintains data under an agreement with the owner is not itself required to notify individuals unless the agreement says so, which means the notification burden defaults to you and the contract is where you set the vendor's discovery-to-notice timeline and cooperation duties.
+
+## When must you notify people of a data breach in Arizona? {#breach-notification}
+
+**Short answer.** Arizona runs on a hard 45-day clock. After becoming aware of a *security incident*, a business must promptly investigate whether a *security system breach* occurred [^q4-breach-investigate] — a breach being an unauthorized acquisition of and access to unencrypted, unredacted computerized personal information that materially compromises its security or confidentiality [^stat-breach-def]. If the investigation determines there was a breach, the business must notify affected individuals within forty-five days after the determination, and if more than one thousand individuals must be notified, it must also notify the three largest nationwide consumer reporting agencies, the Attorney General, and the director of the Arizona Department of Homeland Security in writing [^stat-breach-timing].
+
+The notice itself has statutorily fixed contents: the approximate date of the breach, a brief description of the personal information involved, contact details for the three largest nationwide consumer reporting agencies, and contact details for the FTC or another federal identity-theft agency [^stat-breach-contents]. Permitted methods are written, email, or live non-prerecorded telephone notice; substitute notice is allowed only when direct notice would cost more than $50,000, the affected class exceeds one hundred thousand individuals, or contact information is insufficient, and it requires a letter to the Attorney General plus conspicuous website posting for at least 45 days if the person maintains a website [^stat-breach-methods]. *Personal information* is broader than the classic name-plus-SSN pairing: it includes health-insurance ID numbers, medical or mental-health treatment or diagnosis information, passport numbers, taxpayer IDs, biometric authentication data, and online-account credentials [^stat-breach-pi-elements]. For a credential-only breach, the business may direct the individual to reset passwords and should not rely on the breached email account as the compliance notice channel when the breached credentials are for an email account furnished by the business [^stat-breach-credentials]. Three outs matter in practice. Encryption and redaction are built into the breach definition, so properly encrypted data generally does not trigger notice. A business that follows its own consistent notification procedures, or its primary or functional federal regulator's rules, is deemed compliant [^stat-breach-safe-harbors]. And no notice at all is required if the business, an independent third-party forensic auditor, or law enforcement determines after a reasonable investigation that the breach is not reasonably likely to result in substantial economic loss to affected individuals [^stat-breach-exception] — an economic-loss trigger that is narrower than the harm-based formulations many other states use. Enforcement is Attorney General-only: a *knowing and wilful* violation is an unlawful practice under the Consumer Fraud Act, with a civil penalty capped at the lesser of $10,000 per affected individual or the individuals' total economic loss, and a $500,000 maximum per breach or series of related breaches [^q4-breach-penalty].
+
+## What are the rules for genetic data and DNA test kits in Arizona? {#genetic-data}
+
+**Short answer.** Genetic data is the one area where Arizona has real, modern consumer-privacy law — through two distinct regimes. The Genetic Information Privacy Act covers entities that offer genetic testing products or services directly to consumers and collect genetic data or biological samples for analysis [^gipa-company-scope]. A covered company must obtain initial express consent that describes the uses of the genetic data, plus separate express consent for transfers to outsiders, for uses beyond the primary testing purpose, and for retaining the biological sample [^gipa-consent]. The company may never disclose genetic data to a health, life, or long-term-care insurer or to the consumer's employer [^gipa-insurer-ban]. Separately, an older confidentiality article makes genetic-test results confidential and privileged: outside enumerated exceptions, no one may disclose or be compelled to disclose the identity of a person tested or results that allow identification [^genetic-confidential].
+
+The Genetic Information Privacy Act is built around layered consent, but it also imposes operational duties: a comprehensive security program and a requirement of valid legal process before genetic data goes to law enforcement or any other government agency without express written consent [^gipa-government-security]. The company also must provide a consumer process to access genetic data, delete the account and genetic data, and obtain destruction of the biological sample [^gipa-process]. Research transfers need informed consent meeting the federal human-subjects rules, and genetic-data-based marketing needs its own express consent [^gipa-research-marketing]. The act exempts HIPAA-governed protected health information, samples and data generated for medical screening, treatment, or diagnosis, and institutions of higher education [^gipa-exceptions]; combined with the direct-to-consumer definition, those exemptions leave the act focused on consumer DNA-kit services rather than clinical care. Enforcement belongs to the Attorney General, with a civil penalty of up to $2,500 per violation plus consumers' actual damages [^gipa-enforcement]; there is no private right of action under the act.
+
+The older genetic-testing confidentiality article reaches further than DNA-kit companies. It also requires parental or guardian consent before genetic testing of an unemancipated minor [^genetic-minor-consent] and, outside narrow research and public-health circumstances, bars a health care provider from conducting a genetic test without first obtaining written informed consent [^genetic-informed-consent]. State and local agencies must keep genetic-testing records confidential and out of public-records inspection [^genetic-public-records]. One gap worth knowing: the confidentiality article states duties but contains no express penalty or enforcement provision, so how a violation would be remedied — negligence theories, the Consumer Fraud Act, or privacy torts — remains unresolved.
+
+## Does Arizona restrict how you handle Social Security numbers and discard old records? {#ssn-and-records-disposal}
+
+**Short answer.** Yes — two narrow but long-standing statutes apply to nearly every business. Since January 1, 2005, no person or entity may make an individual's Social Security number available to the general public, print it on access cards, require its transmission over the internet unless the connection is secure or the number is encrypted, use it as a website login without an additional authenticator, or print a known Social Security number on mailed materials except within statutory carveouts [^stat-ssn-restrictions]. And an entity may not knowingly discard records containing a name combined with a complete Social Security number, payment-card number, retirement or financial-account number, or driver-license number without first redacting the information or destroying the records [^stat-disposal].
+
+Both statutes are enforced by public officials rather than consumers. Under the Social Security number statute, only the Attorney General or a county attorney may commence a legal action [^stat-ssn-enforcement]. The disposal statute is likewise enforced by the Attorney General or county attorneys [^stat-disposal-enforcement], with tiered civil penalties per incident — up to $500 for a first violation, $1,000 for a second, and $5,000 for a third or subsequent violation [^stat-disposal-penalty]. Scope limits matter on both: the SSN statute grandfathers continuous pre-2005 uses subject to annual disclosure and opt-out duties, and the disposal statute applies only to paper records — electronic data disposal is untouched by it — with an own-procedures safe harbor and exemptions for GLBA, HIPAA, and FCRA-regulated entities [^stat-disposal-limits]. Neither statute creates an express consumer lawsuit in these quoted enforcement provisions, but sloppy SSN handling or dumpster-diving incidents can still surface in Attorney General consumer-protection practice, and a public SSN exposure that contradicts your stated security practices carries independent Consumer Fraud Act and FTC Act deception risk.
+
+## Can a consumer sue your business in Arizona over privacy? {#consumer-lawsuit}
+
+**Short answer.** Not under Arizona's privacy-specific statutes. The breach-notification article is enforceable only by the Attorney General, with a civil penalty capped at the lesser of $10,000 per affected individual or the individuals' total economic loss, up to $500,000 per breach or related series [^q7-breach-penalty]. The Genetic Information Privacy Act is also Attorney General-enforced, with penalties up to $2,500 per violation plus consumers' actual damages [^q7-gipa-enforcement]. The broader exposure runs through the Consumer Fraud Act: the Attorney General can obtain injunctions, restoration of money or property, and disgorgement of profits for any unlawful practice [^q7-cfa-remedies], and can recover a civil penalty of up to $10,000 per wilful violation [^q7-cfa-penalty] — *wilful* meaning the business knew or should have known its conduct was prohibited.
+
+None of these statutes gives a business a cure period — there is no statutory right to fix a violation before the Attorney General acts, only the practical mitigation of cooperating once an inquiry starts. The Attorney General also recovers costs and reasonable attorney fees in Consumer Fraud Act actions [^q7-cfa-costs].
+
+Private litigation is not entirely off the table, but the privacy-specific statutes quoted here do not create a consumer action. A plaintiff trying to plead a statutory privacy-misrepresentation theory would likely start with the Consumer Fraud Act's unlawful-practice language [^q7-cfa-unlawful]; whether that theory works for a pure privacy misrepresentation — a privacy policy that overpromises, a broken security commitment — is untested in Arizona's appellate courts, and the breach statute's text leaves breach-notification enforcement to the Attorney General [^q7-breach-penalty]. Plaintiffs can also plead common-law theories such as negligence or invasion of privacy after an incident, but those face the usual standing and damages hurdles absent actual misuse of the data. The operational takeaway: Arizona privacy exposure today is regulator-shaped — manage it by keeping the privacy policy truthful, hitting the 45-day breach clock, and treating genetic data under its dedicated consent regime.
+
+[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-06-11. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Arizona. This article synthesizes Arizona primary law and is not legal advice from a Arizona-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.
+
+[^stat-breach-scope]: **A.R.S. § 18-552** — "If a person that conducts business in this state and that owns, maintains or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach." *A.R.S. § 18-552(A).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-cfa-unlawful]: **A.R.S. § 44-1522** — "The act, use or employment by any person of any deception, deceptive or unfair act or practice, fraud, false pretense, false promise, misrepresentation, or concealment, suppression or omission of any material fact with intent that others rely on such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise whether or not any person has in fact been misled, deceived or damaged thereby, is declared to be an unlawful practice." *A.R.S. § 44-1522(A).* <https://www.azleg.gov/ars/44/01522.htm>
+
+[^stat-breach-exempt]: **A.R.S. § 18-552** — "This article does not apply to either of the following: 1. A person that is subject to title V of the Gramm-Leach-Bliley act (P.L. 106-102; 113 Stat. 1338; 15 United States Code sections 6801 through 6809). 2. A covered entity or business associates as defined under regulations implementing the health insurance portability and accountability act of 1996, 45 Code of Federal Regulations section 160.103 (2013) or a charitable fundraising foundation or nonprofit corporation whose primary purpose is to support a specified covered entity, if the charitable fundraising foundation or nonprofit corporation complies with any applicable provision of the health insurance portability and accountability act of 1996 and its implementing regulations." *A.R.S. § 18-552(N).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-agency-policy]: **A.R.S. § 18-202** — "An agency web site provided by this state shall contain a privacy policy statement to disclose the information gathering and dissemination practices related to the internet." *A.R.S. § 18-202.* <https://www.azleg.gov/ars/18/00202.htm>
+
+[^q2-gipa-notice]: **A.R.S. § 44-8002** — "Provide clear and complete information regarding the company's policies and procedures for collecting, using or disclosing genetic data by making available to a consumer both of the following: (a) A high-level privacy policy overview that includes basic, essential information about the company's collection, use or disclosure of genetic data. (b) A prominent, publicly available privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security and retention and deletion practices." *A.R.S. § 44-8002(A)(1).* <https://www.azleg.gov/ars/44/08002.htm>
+
+[^fed-ftc5-deceptive]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>
+
+[^q2-cfa-deception]: **A.R.S. § 44-1522** — "The act, use or employment by any person of any deception, deceptive or unfair act or practice, fraud, false pretense, false promise, misrepresentation, or concealment, suppression or omission of any material fact with intent that others rely on such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise whether or not any person has in fact been misled, deceived or damaged thereby, is declared to be an unlawful practice." *A.R.S. § 44-1522(A).* <https://www.azleg.gov/ars/44/01522.htm>
+
+[^q2-cfa-ftc-guide]: **A.R.S. § 44-1522** — "It is the intent of the legislature, in construing subsection A, that the courts may use as a guide interpretations given by the federal trade commission and the federal courts to 15 United States Code sections 45, 52 and 55(a)(1)." *A.R.S. § 44-1522(C).* <https://www.azleg.gov/ars/44/01522.htm>
+
+[^fed-hipaa-notice]: **HIPAA Notice of Privacy Practices** — "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information" *45 C.F.R. § 164.520(a).* <https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information>
+
+[^stat-breach-vendor]: **A.R.S. § 18-552** — "A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee." *A.R.S. § 18-552(C).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^fed-glba-safeguards]: **GLBA Safeguards Rule** — "Requiring your service providers by contract to implement and maintain such safeguards" *16 C.F.R. § 314.4(d)(2).* <https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards>
+
+[^fed-hipaa-baa]: **HIPAA Business Associate Contracts** — "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information; (E) Make available protected health information in accordance with § 164.524; (F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with § 164.526; (G) Make available the information required to provide an accounting of disclosures in accordance with § 164.528; (H) To the extent the business associate is to carry out a covered entity's obligation under this subpart, comply with the requirements of this subpart that apply to the covered entity in the performance of such obligation. (I) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary for purposes of determining the covered entity's compliance with this subpart; and (J) At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible." *45 C.F.R. § 164.504(e)(2).* <https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,destruction%20of%20the%20information%20infeasible.>
+
+[^q4-breach-investigate]: **A.R.S. § 18-552** — "If a person that conducts business in this state and that owns, maintains or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach." *A.R.S. § 18-552(A).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-breach-def]: **A.R.S. § 18-551** — "Means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals." *A.R.S. § 18-551(1)(a).* <https://www.azleg.gov/ars/18/00551.htm>
+
+[^stat-breach-timing]: **A.R.S. § 18-552** — "If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall: 1. Notify the individuals affected pursuant to subsection E of this section and subject to the needs of law enforcement as provided in subsection D of this section. 2. If the breach requires notification of more than one thousand individuals, notify both: (a) The three largest nationwide consumer reporting agencies. (b) The attorney general and the director of the Arizona department of homeland security, in writing, in a form prescribed by rule or order of the attorney general or the director of the Arizona department of homeland security or by providing the attorney general or the director of the Arizona department of homeland security with a copy of the notification provided pursuant to paragraph 1 of this subsection." *A.R.S. § 18-552(B).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-breach-contents]: **A.R.S. § 18-552** — "The notification required by subsection B, paragraph 1 of this section shall include at least the following: 1. The approximate date of the breach. 2. A brief description of the personal information included in the breach. 3. The toll-free numbers and addresses for the three largest nationwide consumer reporting agencies. 4. The toll-free number, address and website address for the federal trade commission or any federal agency that assists consumers with identity theft matters." *A.R.S. § 18-552(E).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-breach-methods]: **A.R.S. § 18-552** — "The notification required by subsection B, paragraph 1 of this section shall be provided by one of the following methods: 1. Written notice. 2. An email notice if the person has email addresses for the individuals who are subject to the notice. 3. Telephonic notice, if telephonic contact is made directly with the affected individuals and is not through a prerecorded message. 4. Substitute notice if the person demonstrates that the cost of providing notice pursuant to paragraph 1, 2 or 3 of this subsection would exceed $50,000, that the affected class of subject individuals to be notified exceeds one hundred thousand individuals or that the person does not have sufficient contact information. Substitute notice consists of all of the following: (a) A written letter to the attorney general that demonstrates the facts necessary for substitute notice. (b) Conspicuous posting of the notice for at least forty-five days on the website of the person if the person maintains one." *A.R.S. § 18-552(F).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-breach-pi-elements]: **A.R.S. § 18-551** — "7. ‘Personal information’: (a) Means any of the following: (i) An individual's first name or first initial and last name in combination with one or more specified data elements. (ii) An individual's user name or e-mail address, in combination with a password or security question and answer, that allows access to an online account. (b) Does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media. 8. ‘Prosecution agency’ means the attorney general, a county attorney or a municipal prosecutor. 9. ‘Redact’ means to alter or truncate a number so that not more than the last four digits are accessible and at least two digits have been removed. 10. ‘Security incident’ means an event that creates reasonable suspicion that a person's information systems or computerized data may have been compromised or that measures put in place to protect the person's information systems or computerized data may have failed. 11. ‘Specified data element’ means any of the following: (a) An individual's social security number. (b) The number on an individual's driver license issued pursuant to section 28-3166 or nonoperating identification license issued pursuant to section 28-3165. (c) A private key that is unique to an individual and that is used to authenticate or sign an electronic record. (d) An individual's financial account number or credit or debit card number in combination with any required security code, access code or password that would allow access to the individual's financial account. (e) An individual's health insurance identification number. (f) Information about an individual's medical or mental health treatment or diagnosis by a health care professional. (g) An individual's passport number. (h) An individual's taxpayer identification number or an identity protection personal identification number issued by the United States internal revenue service. (i) Unique biometric data generated from a measurement or analysis of human body characteristics to authenticate an individual when the individual accesses an online account." *A.R.S. § 18-551(7), (11).* <https://www.azleg.gov/ars/18/00551.htm>
+
+[^stat-breach-credentials]: **A.R.S. § 18-552** — "If a breach involves personal information as prescribed in section 18-551, paragraph 7, subdivision (a), item (ii) for an online account and does not involve personal information as defined in section 18-551, paragraph 7, subdivision (a), item (i), the person may comply with this section by providing the notification in an electronic or other form that directs the individual whose personal information has been breached to promptly change the individual's password and security question or answer, as applicable, or to take other steps that are appropriate to protect the online account with the person and all other online accounts for which the individual whose personal information has been breached uses the same user name and email address and password or security question or answer. If the breach of personal information as prescribed in section 18-551, paragraph 7, subdivision (a), item (ii) is for login credentials of an email account furnished by the person, the person is not required to comply with this section by providing the notification to that email address, but may comply with this section by providing notification by another method described in this subsection or by providing clear and conspicuous notification delivered to the individual online when the individual is connected to the online account from an internet protocol address or online location from which the person knows the individual customarily accesses the account. The person satisfies the notification requirement with regard to the individual's account with the person by requiring the individual to reset the individual's password or security question and answer for that account, if the person also notifies the individual to change the same password or security question and answer for all other online accounts for which the individual uses the same user name or email address and password or security question or answer." *A.R.S. § 18-552(G).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-breach-safe-harbors]: **A.R.S. § 18-552** — "A person that maintains the person's own notification procedures as part of an information security policy for the treatment of personal information and that is otherwise consistent with the requirements of this article, including the forty-five-day notification period required by subsection B of this section, is deemed to be in compliance with the notification requirements of subsection B, paragraph 1 of this section if the person notifies subject individuals in accordance with the person's policies if a security system breach occurs. I. A person that complies with the notification requirements or security system breach procedures pursuant to the rules, regulations, procedures, guidance or guidelines established by the person's primary or functional federal regulator is deemed to be in compliance with the requirements of subsection B, paragraph 1 of this section." *A.R.S. § 18-552(H)-(I).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^stat-breach-exception]: **A.R.S. § 18-552** — "A person is not required to make the notification required by subsection B of this section if the person, an independent third-party forensic auditor or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals." *A.R.S. § 18-552(J).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^q4-breach-penalty]: **A.R.S. § 18-552** — "A knowing and wilful violation of this section is an unlawful practice pursuant to section 44-1522, and only the attorney general may enforce such a violation by investigating and taking appropriate action pursuant to title 44, chapter 10, article 7. The attorney general may impose a civil penalty for a violation of this article not to exceed the lesser of $10,000 per affected individual or the total amount of economic loss sustained by affected individuals, but the maximum civil penalty from a breach or series of related breaches may not exceed $500,000. This section does not prevent the attorney general from recovering restitution for affected individuals." *A.R.S. § 18-552(L).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^gipa-company-scope]: **A.R.S. § 44-8001** — "‘Direct-to-consumer genetic testing company’ or ‘company’ means an entity that offers genetic testing products or services directly to consumers that involve collecting from a consumer of either genetic data or biological samples and from which the company derives genetic data for analysis." *A.R.S. § 44-8001(4).* <https://www.azleg.gov/ars/44/08001.htm>
+
+[^gipa-consent]: **A.R.S. § 44-8002** — "Obtain a consumer's consent for collecting, using or disclosing the consumer's genetic data, including: (a) Initial express consent that clearly describes the uses of the genetic data collected through the genetic testing product or service and that specifies who has access to test results and how the genetic data may be shared. (b) Separate express consent for any of the following: (i) Transferring or disclosing the consumer's genetic data to any person other than the company's vendors and service providers. (ii) Using genetic data beyond the primary purpose of the genetic testing product or service and inherent contextual uses. (iii) Retaining any biological sample provided by the consumer following completion of the initial testing service requested by the consumer." *A.R.S. § 44-8002(A)(2).* <https://www.azleg.gov/ars/44/08002.htm>
+
+[^gipa-insurer-ban]: **A.R.S. § 44-8002** — "Notwithstanding any other provision in this section, a direct-to-consumer genetic testing company may not disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance or to any employer of the consumer." *A.R.S. § 44-8002(B).* <https://www.azleg.gov/ars/44/08002.htm>
+
+[^genetic-confidential]: **A.R.S. § 12-2802** — "A person shall not disclose or be compelled to disclose the identity of any person on whom a genetic test is performed or the results of a genetic test in a manner that allows identification of the person tested except to the persons specified in the circumstances set forth in subsection A of this section." *A.R.S. § 12-2802(C).* <https://www.azleg.gov/ars/12/02802.htm>
+
+[^gipa-government-security]: **A.R.S. § 44-8002** — "3. Require a valid legal process for disclosing genetic data to law enforcement or any other government agency without a consumer's express written consent. 4. Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure." *A.R.S. § 44-8002(A)(3)-(4).* <https://www.azleg.gov/ars/44/08002.htm>
+
+[^gipa-process]: **A.R.S. § 44-8002** — "Provide a process for a consumer to do all of the following: (a) Access the consumer's genetic data. (b) Delete the consumer's account and genetic data. (c) Request and obtain the destruction of the consumer's biological sample." *A.R.S. § 44-8002(A)(5).* <https://www.azleg.gov/ars/44/08002.htm>
+
+[^gipa-research-marketing]: **A.R.S. § 44-8002** — "(c) Informed consent in compliance with the federal policy for the protection of human research subjects prescribed by 45 Code of Federal Regulations part 46 for transferring or disclosing the consumer's genetic data to third-party persons for research purposes or research conducted under the control of the company for the purpose of publication or generalizable knowledge. (d) Express consent for marketing to a consumer based on the consumer's genetic data or for marketing by a third-party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service. For the purposes of this subdivision, marketing does not include providing customized content or offers on websites or through applications or services provided by the direct-to-consumer genetic testing company with the first-party relationship to the consumer." *A.R.S. § 44-8002(A)(2)(c)-(d).* <https://www.azleg.gov/ars/44/08002.htm>
+
+[^gipa-exceptions]: **A.R.S. § 44-8003** — "This chapter does not apply to any of the following: 1. Protected health information that is collected by a covered entity or business associate governed by the privacy, security and breach notification rules issued by the United States department of health and human services under 45 Code of Federal Regulations parts 160 and 164. 2. Biological samples that are obtained or genetic data that is generated for the purposes of an individual's medical screening, treatment or diagnosis. 3. Genetic data that is generated by analyses or tests described in section 12-2801, paragraph 1, subdivision (b). 4. A public or private institution of higher education or an entity that is owned or operated by a public or private institution of higher education." *A.R.S. § 44-8003.* <https://www.azleg.gov/ars/44/08003.htm>
+
+[^gipa-enforcement]: **A.R.S. § 44-8004** — "The attorney general may bring an action to enforce this chapter. A person who violates this chapter is subject to: 1. A civil penalty of up to $2,500 for each violation. 2. The payment of actual damages incurred by consumers as a result of the violation. 3. Costs and reasonable attorney fees incurred by the office of the attorney general." *A.R.S. § 44-8004.* <https://www.azleg.gov/ars/44/08004.htm>
+
+[^genetic-minor-consent]: **A.R.S. § 12-2803** — "A genetic test shall not be conducted on an unemancipated minor without the consent of the parent or legal guardian of the minor except for testing under the newborn screening program pursuant to section 36-694." *A.R.S. § 12-2803(A).* <https://www.azleg.gov/ars/12/02803.htm>
+
+[^genetic-informed-consent]: **A.R.S. § 12-2803** — "Except for the circumstances prescribed in section 12-2802, subsection A, paragraph 4, 7 or 9, a health care provider shall not conduct a genetic test on a person unless the health care provider first obtains written informed consent from the person to be tested or from the person's authorized representative." *A.R.S. § 12-2803(C).* <https://www.azleg.gov/ars/12/02803.htm>
+
+[^genetic-public-records]: **A.R.S. § 12-2804** — "Information and records held by a state agency or a local health authority relating to genetic testing information are confidential and are exempt from the public copying and inspection requirements of title 39, chapter 1, article 2. B. A state agency or a local health authority shall not release or make available to the public genetic testing information and records." *A.R.S. § 12-2804.* <https://www.azleg.gov/ars/12/02804.htm>
+
+[^stat-ssn-restrictions]: **A.R.S. § 44-1373** — "Except as otherwise specifically provided by law, beginning on January 1, 2005, a person or entity shall not: 1. Intentionally communicate or otherwise make an individual's social security number available to the general public. 2. Print an individual's social security number on any card required for the individual to receive products or services provided by the person or entity. 3. Require the transmission of an individual's social security number over the internet unless the connection is secure or the social security number is encrypted. 4. Require the use of an individual's social security number to access an internet web site, unless a password or unique personal identification number or other authentication device is also required to access the site. 5. Print a number that the person or entity knows to be an individual's social security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed. This paragraph does not prohibit the mailing of documents that include social security numbers sent as part of an application or enrollment process or to establish, amend or terminate an account, contract or policy or to confirm the accuracy of the social security number. In a transaction involving or otherwise relating to an individual, if a person or entity receives a number from a third party, the person or entity has no duty to inquire or otherwise determine if the number is or includes that individual's social security number. The person or entity may print that number on materials that are mailed to the individual, unless the person or entity that received the number has actual knowledge that the number is or includes the individual's social security number. This paragraph does not prohibit the mailing to the individual of any copy or reproduction of a document that includes a social security number if the social security number was included on the original document before January 1, 2005." *A.R.S. § 44-1373(A).* <https://www.azleg.gov/ars/44/01373.htm>
+
+[^stat-disposal]: **A.R.S. § 44-7601** — "An entity shall not knowingly discard or dispose of records or documents without redacting the information or destroying the records or documents if the records or documents contain an individual's first and last name or first initial and last name in combination with a corresponding complete: 1. Social security number. 2. Credit card, charge card or debit card number. 3. Retirement account number. 4. Savings, checking or securities entitlement account number. 5. Driver license number or nonoperating identification license number." *A.R.S. § 44-7601(A).* <https://www.azleg.gov/ars/44/07601.htm>
+
+[^stat-ssn-enforcement]: **A.R.S. § 44-1373** — "Only the attorney general or a county attorney, or both, may commence a legal action for a violation of this section." *A.R.S. § 44-1373(H).* <https://www.azleg.gov/ars/44/01373.htm>
+
+[^stat-disposal-enforcement]: **A.R.S. § 44-7601** — "This section may be enforced by either of the following: 1. A county attorney in the county in which the records or documents were wrongfully discarded or disposed. If a violation occurs by the same entity in multiple counties, a county attorney in a county in which records or documents were improperly discarded or disposed of, after filing a notice of intent to enforce this section, may send a copy of the notice to the county attorney in each county in which records or documents were not properly discarded or disposed of and may request that the actions be consolidated. 2. The attorney general." *A.R.S. § 44-7601(B).* <https://www.azleg.gov/ars/44/07601.htm>
+
+[^stat-disposal-penalty]: **A.R.S. § 44-7601** — "A civil penalty shall be imposed for each violation of subsection A of this section arising out of one incident. The civil penalty shall not exceed: 1. Five hundred dollars for a first violation. 2. One thousand dollars for a second violation. 3. Five thousand dollars for a third or subsequent violation." *A.R.S. § 44-7601(C).* <https://www.azleg.gov/ars/44/07601.htm>
+
+[^stat-disposal-limits]: **A.R.S. § 44-7601** — "An entity that maintains and complies with the entity's own procedures for the discarding or disposing of records or documents containing the information listed in subsection A of this section that is consistent with the requirements of this section shall be deemed to be in compliance with this section. E. This section does not apply to any of the following: 1. An entity subject to title V of the Gramm-Leach-Bliley act (P.L. 106-102; 113 Stat. 1338; 15 United States Code sections 6801 through 6809). 2. Covered entities and business associates as defined under regulations implementing the health insurance portability and accountability act, 45 Code of Federal Regulations section 160.103 (2003). 3. An entity subject to the federal fair credit reporting act (15 United States Code section 1681x). F. This section only applies to paper records and paper documents." *A.R.S. § 44-7601(D)-(F).* <https://www.azleg.gov/ars/44/07601.htm>
+
+[^q7-breach-penalty]: **A.R.S. § 18-552** — "A knowing and wilful violation of this section is an unlawful practice pursuant to section 44-1522, and only the attorney general may enforce such a violation by investigating and taking appropriate action pursuant to title 44, chapter 10, article 7. The attorney general may impose a civil penalty for a violation of this article not to exceed the lesser of $10,000 per affected individual or the total amount of economic loss sustained by affected individuals, but the maximum civil penalty from a breach or series of related breaches may not exceed $500,000. This section does not prevent the attorney general from recovering restitution for affected individuals." *A.R.S. § 18-552(L).* <https://www.azleg.gov/ars/18/00552.htm>
+
+[^q7-gipa-enforcement]: **A.R.S. § 44-8004** — "The attorney general may bring an action to enforce this chapter. A person who violates this chapter is subject to: 1. A civil penalty of up to $2,500 for each violation. 2. The payment of actual damages incurred by consumers as a result of the violation. 3. Costs and reasonable attorney fees incurred by the office of the attorney general." *A.R.S. § 44-8004.* <https://www.azleg.gov/ars/44/08004.htm>
+
+[^q7-cfa-remedies]: **A.R.S. § 44-1528** — "Following an investigation made pursuant to section 44-1524 and when it appears to the attorney general that a person has engaged in or is engaging in any practice declared to be unlawful by this article, the attorney general may seek and obtain in an action in a court of competent jurisdiction an injunction prohibiting the person from continuing the practices or engaging in the practice or doing any acts in furtherance of the practice after notice as is required by the rules of civil procedure. The court may make such orders or judgments as may be necessary to: 1. Prevent the use or employment by a person of any unlawful practices. 2. Restore to any person in interest any monies or property, real or personal, which may have been acquired by means of any practice in this article declared to be unlawful, including the appointment of a receiver. 3. Require that any profits, gain, gross receipts or other benefit obtained by means of any practice in this article declared to be unlawful be disgorged and paid to the state for deposit in the consumer remediation subaccount of the consumer restitution and remediation revolving fund established by section 44-1531.02." *A.R.S. § 44-1528(A).* <https://www.azleg.gov/ars/44/01528.htm>
+
+[^q7-cfa-penalty]: **A.R.S. § 44-1531** — "If a court finds that any person has wilfully violated section 44-1522, the attorney general upon petition to the court may recover from the person on behalf of the state a civil penalty of not more than ten thousand dollars per violation. B. For purposes of this section, a wilful violation occurs when the party committing the violation knew or should have known that his conduct was of the nature prohibited by section 44-1522." *A.R.S. § 44-1531(A)-(B).* <https://www.azleg.gov/ars/44/01531.htm>
+
+[^q7-cfa-costs]: **A.R.S. § 44-1534** — "In any action brought under the provisions of this article, the attorney general is entitled to recover costs, which in the discretion of the court may include a sum representing reasonable attorney's fees for the services rendered, for the use of the state." *A.R.S. § 44-1534.* <https://www.azleg.gov/ars/44/01534.htm>
+
+[^q7-cfa-unlawful]: **A.R.S. § 44-1522** — "The act, use or employment by any person of any deception, deceptive or unfair act or practice, fraud, false pretense, false promise, misrepresentation, or concealment, suppression or omission of any material fact with intent that others rely on such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise whether or not any person has in fact been misled, deceived or damaged thereby, is declared to be an unlawful practice." *A.R.S. § 44-1522(A).* <https://www.azleg.gov/ars/44/01522.htm>

package/skills/legal-explainers/data-privacy-law-explainer/content/arkansas.md

@@ -0,0 +1,219 @@
+---
+jurisdiction: "Arkansas"
+slug: arkansas
+countryCode: US
+snapshotAsOf: "2026-06-19"
+lastReviewed: "2026-06-12"
+canonicalUrl: https://openagreements.org/practice-guides/privacy/us/arkansas
+license: CC BY 4.0
+stale: false
+---
+
+> [!IMPORTANT]
+> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
+> provided for general information. It is not legal advice, does not create an attorney-client
+> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
+> Laws change; verify against the canonical version before relying on it.
+>
+> **Canonical:** https://openagreements.org/practice-guides/privacy/us/arkansas · **Snapshot as of:** 2026-06-19 · License: CC BY 4.0 · © openagreements.org
+
+# Arkansas Consumer Privacy Law[^about]
+
+Arkansas has no comprehensive consumer-privacy statute. The Personal Information Protection Act governs safeguards, disposal, and breach notice, enforced solely by the Attorney General; a children-and-teens online privacy law takes effect July 1, 2026.
+
+
+## At a glance
+
+| Question | Arkansas |
+| --- | --- |
+| **Law coverage** | Specific data types only |
+| **Summary** | Arkansas has not enacted a comprehensive consumer-privacy law, so there are no general data-rights, consent, or processor-contract duties under state law today. The operative statute is the Personal Information Protection Act, which requires reasonable security, secure disposal, and breach notification — including Attorney General notice for breaches affecting more than 1,000 people — and is enforced exclusively by the Attorney General through the Deceptive Trade Practices Act, with no private right of action. The big change is imminent — the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025) takes effect July 1, 2026, banning targeted advertising to children and teens, imposing data-minimization, notice, consent, deletion, and security duties on covered operators, and giving the Attorney General exclusive enforcement authority. |
+| **Main law** | Personal Information Protection Act, Ark. Code Ann. §§ 4-110-101 to 4-110-108 — Arkansas has no comprehensive consumer-privacy law; PIPA (safeguards, disposal, breach notice) plus the Deceptive Trade Practices Act and the federal overlay is the operative framework, with the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025) effective July 1, 2026 |
+| **Privacy policy required?** | No Arkansas statute mandates a general consumer privacy policy or fixes its contents; whatever is posted must be true under the ADTPA catch-all and FTC Act § 5, and from July 1, 2026 covered operators must give clear and conspicuous notice with six required elements for children's and teens' data |
+| **Who does it cover?** | Any person or business — however organized, for profit or not, expressly including state agencies — that acquires, owns, or licenses personal information about Arkansas residents; no revenue or consumer-volume threshold. From July 1, 2026, for-profit operators of websites, online services, or apps directed at children or teens, or with actual knowledge of collecting their data, are also covered |
+| **Can consumers sue?** | No |
+| **Privacy policy rule** | Policy required only for specific data |
+| **Consent for sensitive data?** | Only for certain data types |
+| **Browser opt-out signals?** | Not required |
+| **Lawsuit detail** | Not under PIPA — every violation is punishable by action of the Attorney General under the ADTPA; the ADTPA's own private remedy requires actual financial loss caused by individual reliance and bans private class actions, and Act 952 of 2025 expressly disclaims any private right of action |
+| **Who enforces it?** | Arkansas Attorney General |
+
+## Which privacy laws apply to your business in Arkansas? {#which-privacy-laws-apply}
+
+**Short answer.** There is no comprehensive Arkansas consumer-privacy law. The operative state statute is the Personal Information Protection Act (PIPA) [^pipa-title], a 2005 law whose stated purpose is to encourage individuals, businesses, and state agencies that hold personal information about Arkansans to provide reasonable security for it [^pipa-purpose]. PIPA imposes three duties — reasonable security [^pipa-security], secure destruction of records no longer retained [^pipa-disposal], and breach notification — and every violation is punishable by action of the Attorney General under the Deceptive Trade Practices Act [^pipa-adtpa-bridge]. The second pillar arrives on July 1, 2026, when the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025) takes effect [^act952-effective].
+
+Arkansas residents have no general state-law rights to access, delete, correct, or port their personal data, no right to opt out of its sale, and businesses face no state notice-at-collection, consent, data-protection-assessment, universal-opt-out, or processor-contract duties. No comprehensive consumer-privacy act has been enacted in Arkansas, so any compliance materials premised on one would describe a statute that does not exist. PIPA applies broadly within its narrower lane: any person or business that acquires, owns, or licenses personal information about an Arkansas resident is covered, with no revenue or volume threshold, and the statutory definition of a business expressly includes state agencies. Entities regulated by a state or federal law that provides greater protection and at least as thorough breach-disclosure requirements are exempt, and compliance with that law is deemed compliance with PIPA [^pipa-regulated-exemption].
+
+The rest of an Arkansas privacy program rides the federal and sectoral overlay. Section 5 of the FTC Act reaches deceptive or unfair privacy practices nationwide [^ftc5-overlay]; the Gramm-Leach-Bliley Act governs financial institutions; HIPAA governs covered health entities and their business associates; and the Children's Online Privacy Protection Act governs services directed to children under 13. Arkansas has also enacted a cluster of social-media statutes aimed at minors — Acts 689 of 2023, 900 of 2025, and 901 of 2025 — but those statutes are tied up in federal constitutional litigation and none imposes operative duties as of this review. Act 952 — covered in depth in its own section below — is the one Arkansas minors-privacy law on track to take effect, three weeks from now.
+
+## What must your Arkansas privacy policy contain? {#privacy-policy-contents}
+
+**Short answer.** No Arkansas statute requires a general commercial business to post a consumer privacy policy or fixes what it must say — today. The enforceable rule is that whatever you publish has to be true: the Deceptive Trade Practices Act's catch-all prohibits any other unconscionable, false, or deceptive act or practice in business, commerce, or trade [^q2-adtpa-catchall], and Section 5 of the FTC Act reaches a policy that misstates actual practices [^q2-ftc5]. That changes on July 1, 2026 for operators covered by Act 952 of 2025, which requires an operator with actual knowledge that it is collecting personal information from children or teens to provide clear and conspicuous notice [^q2-act952-notice] of six elements — what is collected, the purpose for processing, disclosure practices, the rights available to parents and teens, the categories of personal data shared with third parties, and the categories of those third parties [^q2-act952-notice-elements].
+
+For most businesses, the drafting question in Arkansas is less what must be included and more whether the policy matches actual practice. Where a sectoral regime applies, that regime supplies the contents — a HIPAA covered entity, for example, must give individuals a notice of the uses and disclosures of their protected health information and of their rights and the entity's duties [^q2-hipaa-notice] — and GLBA privacy-notice rules govern financial institutions, with COPPA notices for services directed to children under 13.
+
+For operators in Act 952's scope, the privacy policy is about to do double duty. The act's consent definition lets a teen or a teen's parent authorize collection through an operator's terms of service or acknowledgement of the operator's privacy policy [^q2-act952-consent-policy] — which makes the policy text itself a consent instrument. A covered operator drafting for July 1, 2026 should fold the six notice elements into the policy now and write them precisely, because an inaccurate or incomplete notice is both an Act 952 problem and, like any false policy statement, exposure under the ADTPA catch-all [^q2-adtpa-catchall].
+
+## What does Arkansas's children and teens online privacy law require starting July 1, 2026? {#children-teens-online-privacy}
+
+**Short answer.** Act 952 of 2025 — the Arkansas Children and Teens' Online Privacy Protection Act, enacted as H.B. 1717 [^q3-act952-title] — takes effect July 1, 2026 [^q3-act952-effective]. It extends COPPA-style protections beyond children (twelve and younger [^q3-act952-child]) to teens — Arkansans thirteen through sixteen [^q3-act952-teen] — and its prohibitions reach an operator of a website, online service, online application, or mobile application directed at children or teens, as well as any operator with actual knowledge that it is collecting personal information from children or teens [^q3-act952-scope]; an operator is anyone who, for commercial purposes, runs such a service and collects or maintains personal information from or about its users [^q3-act952-operator]. Covered operators may not collect a child's or teen's personal information for targeted advertising or let anyone else use it for that purpose [^q3-act952-targeted-ads], must limit collection to what is consistent with the context of the service [^q3-act952-minimization], and may not retain the data longer than reasonably necessary [^q3-act952-retention].
+
+The act's duty structure turns on whether the service is directed at children or teens or the operator has actual knowledge that it collects their personal information. Operators with actual knowledge must give the six-element notice covered in the privacy-policy section, and must obtain consent for the collection, use, or disclosure of a teen's personal information from a parent of a teen or a teen — either suffices — subject to enumerated processing exceptions such as providing the requested service, internal operations, security, legal claims, and legal compliance [^q3-act952-teen-consent]. Teens hold their own rights: the operator must provide the opportunity at any time to delete personal information collected from the teen or content the teen submitted [^q3-act952-teen-deletion], the opportunity to challenge the accuracy of that information and have inaccuracies corrected [^q3-act952-teen-correction], and a reasonable means for the teen to obtain the personal information the operator holds [^q3-act952-teen-access]. For children, those rights run to the parent, who may request at any time the deletion of the child's account or submitted content [^q3-act952-parent-deletion]. Operators must also establish, implement, and maintain reasonable security practices for children's and teens' personal information [^q3-act952-security], and may not condition a child's participation in a game, prize offering, or other activity on disclosing more data than reasonably necessary.
+
+Two design choices matter for compliance planning. First, the act expressly disclaims any age-verification mandate: it is not to be construed to require an operator to affirmatively collect age information it does not already collect or to implement age-gating or age-verification functionality [^q3-act952-no-age-verification]. That distinguishes it from Arkansas's social-media statutes, which were built on age verification and are not operative because of federal constitutional litigation. Second, the act sits on top of the federal baseline: COPPA already makes it unlawful for an operator directed to children, or with actual knowledge, to collect a child's personal information in violation of the FTC's rules [^q3-coppa-baseline], so the genuinely new state-law ground is the teen layer and the targeted-advertising and retention limits. Enforcement is exclusively by the Attorney General, with no private right of action — detailed in the lawsuit and enforcement sections below.
+
+One citation note for legal teams: the enrolled act assigns the new subchapter section numbers that collided with a different 2025 act, and the codified numbering may differ from early summaries. Until the official code supplement settles the placement, the reliable way to cite the law is by act and bill number — Act 952 of 2025, H.B. 1717 — rather than a code section.
+
+## What must your contracts with vendors say? {#vendor-contracts}
+
+**Short answer.** Arkansas has no omnibus data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for general private-sector contracts. The one Arkansas rule that directly touches the vendor relationship is PIPA's maintainer duty: a person or business that maintains computerized personal information it does not own must notify the owner or licensee immediately following discovery of a breach [^q4-pipa-maintainer-notice].
+
+Where a federal or sectoral regime is in scope, it supplies the contracting obligations: the GLBA Safeguards Rule requires financial institutions to oversee service providers by contract and to require them to implement appropriate safeguards [^q4-glba-safeguards], and HIPAA requires a business-associate agreement with mandatory data-protection, breach-reporting, and downstream-subcontractor terms before sharing protected health information [^q4-hipaa-baa]. Outside those verticals, the prudent move is to carry the same protections forward as contract best practice — processing limited to documented instructions, confidentiality, reasonable security, breach notification back to your business on a defined clock, and return or deletion of data at the end of the engagement — even though no Arkansas statute compels them. The PIPA maintainer duty is the floor worth tightening by contract: *immediately following discovery* is the statutory standard, so a well-drafted vendor agreement should define discovery, set a notice deadline in hours, and require the cooperation needed for the owner to make its own notice and Attorney General deadlines, which remain the owner's problem under the statute [^q4-pipa-maintainer-notice].
+
+## When must you notify people of a data breach in Arkansas? {#breach-notification}
+
+**Short answer.** Any person or business that acquires, owns, or licenses computerized personal information must disclose a breach to any Arkansas resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person [^q5-pipa-notice-duty]. The disclosure must be made in the most expedient time and manner possible and without unreasonable delay — Arkansas sets no numeric deadline for individual notice [^q5-pipa-timing]. If a breach affects the personal information of more than 1,000 individuals, the Attorney General must also be notified, at the same time as individual disclosure or within 45 days after determining a reasonable likelihood of harm to customers, whichever occurs first [^q5-pipa-ag-notice]. Notification is excused only if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to customers [^q5-pipa-offramp] — and that determination must be put in writing and retained for five years [^q5-pipa-determination-retention].
+
+The trigger is acquisition-based: a breach is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information, with a good-faith-employee carve-out [^q5-pipa-breach-def]. The data elements are broader than in many states without comprehensive laws: personal information means a first name or initial plus last name combined with an unencrypted, unredacted Social Security number, driver's license or Arkansas ID number, financial-account or card number with its access code, medical information, or biometric data [^q5-pipa-pi-def]. Medical information covers any individually identifiable information — in electronic or physical form — about medical history, treatment, or diagnosis [^q5-pipa-medical-def], and biometric data means data generated by automatic measurements of biological characteristics, with fingerprints, faceprints, retinal or iris scans, hand geometry, voiceprint analysis, and DNA expressly listed [^q5-pipa-biometric-def]. Encryption and redaction function as safe harbors, since the definition only reaches data where the name or the data element is unencrypted and unredacted.
+
+The mechanics reward preparation. Notice may be written or by e-mail, and substitute notice — e-mail where held, conspicuous website posting, and statewide media — is available when the cost of notice would exceed 250,000 dollars, the affected class exceeds 500,000 people, or contact information is insufficient [^q5-pipa-substitute-notice]. Notice may be delayed when law enforcement determines it would impede a criminal investigation [^q5-pipa-law-enforcement]. A business that follows the notification procedures of its own information-security policy, consistent with the statute's timing requirements, is deemed compliant [^q5-pipa-own-policy] — a concrete reason to maintain a written incident-response plan. The most overlooked duty is the paper trail: even an incident resolved as no-notice under the risk-of-harm off-ramp requires a written determination kept for five years [^q5-pipa-determination-retention], and the Attorney General can demand a copy, which must be produced within 30 days of the request [^q5-pipa-determination-production].
+
+## Can a consumer sue your business in Arkansas over privacy? {#consumer-lawsuit}
+
+**Short answer.** Not under PIPA. The statute's entire enforcement section says any violation is punishable by action of the Attorney General under the Deceptive Trade Practices Act [^q6-pipa-ag-only] — there is no private right of action, no statutory damages, and no cumulative-remedies clause. The ADTPA itself does have a private remedy, but it was sharply narrowed in 2017: a plaintiff may sue only for an actual financial loss caused by his or her reliance on the unlawful practice [^q6-adtpa-private-suit], must prove that loss and reliance individually [^q6-adtpa-reliance-proof], and cannot bring a private class action — the statute prohibits them outside a narrow constitutional-usury exception [^q6-adtpa-class-ban]. Act 952 of 2025 is even more explicit: the Attorney General has exclusive enforcement authority, and nothing in the act provides the basis for a private right of action for a violation of the act or any other law [^q6-act952-no-pra].
+
+The practical consequence is that Arkansas is among the more defendant-favorable states for private data litigation. A breach victim suing under the ADTPA must clear three screens at once — an *actual financial loss* (lost time, anxiety, or the cost of precautionary credit monitoring fit awkwardly), *reliance* on the unlawful practice (hard to articulate for a security failure the consumer never saw), and individual proof with no class vehicle. The reliance element fits affirmative misrepresentation better than omission, so the live private theory is not a privacy-statute cause of action at all: it is a hard-to-plead consumer who read a privacy or security promise, relied on it, and lost money when it proved false. Plaintiffs can still plead common-law negligence or contract theories after a breach, but they face the same damages and standing hurdles that screen those claims elsewhere, without a state statutory hook.
+
+Two boundary notes. First, businesses cannot buy their way out of the public regime: any waiver of a PIPA provision is contrary to public policy, void, and unenforceable [^q6-pipa-anti-waiver], so a terms-of-service clause purporting to waive breach-notice rights is a nullity. Second, the only true privacy-adjacent private rights of action Arkansas has enacted sit in the social-media statutes (Acts 900 and 901 of 2025), and those provisions are not operative because of federal constitutional litigation — if they ever take effect, the private-suit posture would change for social platforms specifically, so platform operators should watch that litigation.
+
+## How is privacy law enforced in Arkansas? {#ag-enforcement}
+
+**Short answer.** By the Attorney General, through the Deceptive Trade Practices Act. PIPA routes every violation to the Attorney General under the ADTPA [^q7-pipa-adtpa-bridge], and in an ADTPA civil-enforcement proceeding the court may assess penalties of up to 10,000 dollars per violation [^q7-adtpa-penalties], order restoration of money or property to purchasers who suffered ascertainable loss [^q7-adtpa-restitution], and even suspend or forfeit corporate charters, franchises, and licenses to do business in the state [^q7-adtpa-charter]. From July 1, 2026, the Attorney General will also enforce Act 952, with express authority to enjoin a practice, enforce compliance, and obtain damages, restitution, or other compensation on behalf of Arkansas residents [^q7-act952-ag-remedies].
+
+The ADTPA chassis has real teeth beyond the headline penalty. Controlling persons — partners, officers, and directors — and those who knowingly facilitate a violation are jointly and severally liable for penalties and monetary judgments if they knew or reasonably should have known the operative facts [^q7-adtpa-joint-liability], and when judgment is rendered for the state the Attorney General is entitled to the expenses reasonably incurred in investigating and prosecuting the suit — including expert-witness expenses — plus attorney's fees and costs [^q7-adtpa-fees]. For privacy matters specifically, the enforcement theories stack: a breach-notice failure or unreasonable-security lapse is a PIPA violation prosecuted as a deceptive trade practice, a false privacy-policy statement runs through the ADTPA catch-all directly, and once Act 952 is effective, violations of its consent and parent-and-teen-rights duties are themselves treated as unfair or deceptive acts under the Deceptive Trade Practices Act [^q7-act952-adtpa-bridge].
+
+Operationally, that means the Arkansas regulator-relations file is a single file: the Attorney General is the breach-notice recipient for incidents over 1,000 residents, the holder of the written-determination demand power, and the exclusive enforcer of both PIPA and the children-and-teens act. Businesses planning for July 1, 2026 should expect first-mover enforcement attention on the targeted-advertising ban and the six-element notice, since those are the act's most visible, audit-friendly duties.
+
+[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-06-12. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Arkansas. This article synthesizes Arkansas primary law and is not legal advice from a Arkansas-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.
+
+[^pipa-title]: **Ark. Code Ann. § 4-110-101** — "This chapter shall be known and cited as the ‘Personal Information Protection Act’." *Ark. Code Ann. § 4-110-101.* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-101/#:~:text=This%20chapter%20shall%20be%20known,the%20%22Personal%20Information%20Protection%20Act%22.>
+
+[^pipa-purpose]: **Ark. Code Ann. § 4-110-102** — "To that end, the purpose of this chapter is to encourage individuals, businesses, and state agencies that acquire, own, or license personal information about the citizens of the State of Arkansas to provide reasonable security for the information." *Ark. Code Ann. § 4-110-102(b).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-102/#:~:text=To%20that%20end%2C%20the%20purpose,reasonable%20security%20for%20the%20information.>
+
+[^pipa-security]: **Ark. Code Ann. § 4-110-104** — "A person or business that acquires, owns, or licenses personal information about an Arkansas resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure." *Ark. Code Ann. § 4-110-104(b).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-104/#:~:text=A%20person%20or%20business%20that,destruction%2C%20use%2C%20modification%2C%20or%20disclosure.>
+
+[^pipa-disposal]: **Ark. Code Ann. § 4-110-104** — "A person or business shall take all reasonable steps to destroy or arrange for the destruction of a customer's records within its custody or control containing personal information that is no longer to be retained by the person or business by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means." *Ark. Code Ann. § 4-110-104(a).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-104/#:~:text=A%20person%20or%20business%20shall,or%20undecipherable%20through%20any%20means.>
+
+[^pipa-adtpa-bridge]: **Ark. Code Ann. § 4-110-108** — "Any violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq." *Ark. Code Ann. § 4-110-108.* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/#:~:text=Any%20violation%20of%20this%20chapter,of%20%C2%A7%204%2D88%2D101%20et%20seq.>
+
+[^act952-effective]: **H.B. 1717 (Act 952 of 2025)** — "This act shall be effective on and after July 1, 2026." *Act 952, 2025 Ark. Acts (H.B. 1717), § 3.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^pipa-regulated-exemption]: **Ark. Code Ann. § 4-110-106** — "The provisions of this chapter do not apply to a person or business that is regulated by a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breaches of the security of personal information than that provided by this chapter." *Ark. Code Ann. § 4-110-106(a)(1).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-106/#:~:text=The%20provisions%20of%20this%20chapter,that%20provided%20by%20this%20chapter.>
+
+[^ftc5-overlay]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>
+
+[^q2-adtpa-catchall]: **Ark. Code Ann. § 4-88-107** — "Engaging in any other unconscionable, false, or deceptive act or practice in business, commerce, or trade;" *Ark. Code Ann. § 4-88-107(a)(10).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-107/#:~:text=Engaging%20in%20any%20other%20unconscionable%2C,in%20business%2C%20commerce%2C%20or%20trade%3B>
+
+[^q2-ftc5]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>
+
+[^q2-act952-notice]: **H.B. 1717 (Act 952 of 2025)** — "An operator of a website, online service, online application, or mobile application that has actual knowledge that it is collecting personal information from children or teens shall: (1) Provide clear and conspicuous notice of:" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q2-act952-notice-elements]: **H.B. 1717 (Act 952 of 2025)** — "What information is collected from children or teens by the operator; (B) The purpose for processing personal data; (C) The operator’s disclosure practices for such information; (D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section; (E) The categories of personal data that the controller shares with third parties, if any; and (F) The categories of third parties, if any, with whom the controller shares personal data;" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q2-hipaa-notice]: **HIPAA Notice of Privacy Practices** — "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information" *45 C.F.R. § 164.520.* <https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information>
+
+[^q2-act952-consent-policy]: **H.B. 1717 (Act 952 of 2025)** — "Before the personal information of the teen is collected, freely and unambiguously authorizes, including without limitation the giving of consent through an operator's terms of service or acknowledgement of the operator's privacy policy:" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-title]: **H.B. 1717 (Act 952 of 2025)** — "This subchapter shall be known and may be cited as the ‘Arkansas Children and Teens' Online Privacy Protection Act’." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-effective]: **H.B. 1717 (Act 952 of 2025)** — "This act shall be effective on and after July 1, 2026." *Act 952, 2025 Ark. Acts (H.B. 1717), § 3.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-child]: **H.B. 1717 (Act 952 of 2025)** — "‘Child’ means an individual twelve (12) years of age or younger in the State of Arkansas;" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-teen]: **H.B. 1717 (Act 952 of 2025)** — "‘Teen’ means an individual located in the State of Arkansas who is: (A) Thirteen (13) years of age or older; and (B) Younger than seventeen (17) years of age; and" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-scope]: **H.B. 1717 (Act 952 of 2025)** — "Except as provided in subdivision (a)(2) of this section, it is unlawful for an operator of a website, online service, online application, or mobile application directed at children or teens or for any operator of a website, online service, online application, or mobile application with actual knowledge that it is collecting personal information from children or teens: (A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-operator]: **H.B. 1717 (Act 952 of 2025)** — "‘Operator’ means a person who, for commercial purposes, operates or provides a website on the internet, an online service, an online application, or a mobile application, and who: (i) Collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application; or (ii) Allows another person to collect personal information directly from users of that website, service, or application, in which case, the operator is deemed to have collected the information." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-targeted-ads]: **H.B. 1717 (Act 952 of 2025)** — "Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen personal information of a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this information for targeted advertising to children or teens;" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-minimization]: **H.B. 1717 (Act 952 of 2025)** — "To collect the personal information of a child or teen except when the collection of the personal information is: (i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or (ii) Required or specifically authorized by law" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-retention]: **H.B. 1717 (Act 952 of 2025)** — "To retain the personal information of a child or teen for longer that is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-teen-consent]: **H.B. 1717 (Act 952 of 2025)** — "Obtain consent for the collection, use, or disclosure of personal information from a teen from a parent of a teen or a teen, except when the processing is for:" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-teen-deletion]: **H.B. 1717 (Act 952 of 2025)** — "The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-teen-correction]: **H.B. 1717 (Act 952 of 2025)** — "The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-teen-access]: **H.B. 1717 (Act 952 of 2025)** — "A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the information is available to the operator at the time the teen makes the request;" *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-parent-deletion]: **H.B. 1717 (Act 952 of 2025)** — "Request at any time the deletion of the account of the child or content or information submitted by the child to a website," *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-security]: **H.B. 1717 (Act 952 of 2025)** — "Establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and protect the personal information against unauthorized access." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-act952-no-age-verification]: **H.B. 1717 (Act 952 of 2025)** — "This subchapter shall not be construed to require an operator to: (1) Affirmatively collect any personal information regarding the age of a child or teen that an operator is not already collecting in the normal course of business; or (2) Implement an age-gating or age verification functionality." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q3-coppa-baseline]: **COPPA** — "It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b)." *15 U.S.C. § 6502(a)(1).* <https://www.law.cornell.edu/uscode/text/15/6502#:~:text=It%20is%20unlawful%20for%20an,regulations%20prescribed%20under%20subsection%20(b).>
+
+[^q4-pipa-maintainer-notice]: **Ark. Code Ann. § 4-110-105** — "A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee that there has been a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person." *Ark. Code Ann. § 4-110-105(b)(1).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=A%20person%20or%20business%20that,acquired%20by%20an%20unauthorized%20person.>
+
+[^q4-glba-safeguards]: **GLBA Safeguards Rule** — "Requiring your service providers by contract to implement and maintain such safeguards" *16 C.F.R. § 314.4(f)(2).* <https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards>
+
+[^q4-hipaa-baa]: **HIPAA Business Associate Contracts** — "A contract between the covered entity and a business associate must" *45 C.F.R. § 164.504(e)(2).* <https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,and%20a%20business%20associate%20must>
+
+[^q5-pipa-notice-duty]: **Ark. Code Ann. § 4-110-105** — "Any person or business that acquires, owns, or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of Arkansas whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person." *Ark. Code Ann. § 4-110-105(a)(1).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Any%20person%20or%20business%20that,acquired%20by%20an%20unauthorized%20person.>
+
+[^q5-pipa-timing]: **Ark. Code Ann. § 4-110-105** — "The disclosure shall be made in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, or any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system." *Ark. Code Ann. § 4-110-105(a)(2).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=The%20disclosure%20shall%20be%20made,integrity%20of%20the%20data%20system.>
+
+[^q5-pipa-ag-notice]: **Ark. Code Ann. § 4-110-105** — "If a breach of the security of a system affects the personal information of more than one thousand (1,000) individuals, the person or business required to make a disclosure of the security breach under subdivision (b)(1) of this section shall, at the same time the security breach is disclosed to an affected individual or within forty-five (45) days after the person or business determines that there is a reasonable likelihood of harm to customers, whichever occurs first, disclose the security breach to the Attorney General." *Ark. Code Ann. § 4-110-105(b)(2).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=If%20a%20breach%20of%20the,breach%20to%20the%20Attorney%20General.>
+
+[^q5-pipa-offramp]: **Ark. Code Ann. § 4-110-105** — "Notification under this section is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers." *Ark. Code Ann. § 4-110-105(d).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Notification%20under%20this%20section%20is,likelihood%20of%20harm%20to%20customers.>
+
+[^q5-pipa-determination-retention]: **Ark. Code Ann. § 4-110-105** — "A person or business shall retain a copy of the written determination of a breach of the security of the system and supporting documentation for five (5) years from the date of determination of the breach of the security of the system." *Ark. Code Ann. § 4-110-105(g)(1).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=A%20person%20or%20business%20shall,the%20security%20of%20the%20system.>
+
+[^q5-pipa-breach-def]: **Ark. Code Ann. § 4-110-103** — "‘Breach of the security of the system’ means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business." *Ark. Code Ann. § 4-110-103(1)(A).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22Breach%20of%20the%20security%20of,by%20a%20person%20or%20business.>
+
+[^q5-pipa-pi-def]: **Ark. Code Ann. § 4-110-103** — "‘Personal information’ means an individual's first name or first initial and his or her last name in combination with any one (1) or more of the following data elements when either the name or the data element is not encrypted or redacted:" *Ark. Code Ann. § 4-110-103(7).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22Personal%20information%22%20means%20an%20individual's,is%20not%20encrypted%20or%20redacted%3A>
+
+[^q5-pipa-medical-def]: **Ark. Code Ann. § 4-110-103** — "‘Medical information’ means any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a healthcare professional;" *Ark. Code Ann. § 4-110-103(5).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22Medical%20information%22%20means%20any%20individually,diagnosis%20by%20a%20healthcare%20professional%3B>
+
+[^q5-pipa-biometric-def]: **Ark. Code Ann. § 4-110-103** — "‘biometric data’ means data generated by automatic measurements of an individual's biological characteristics, including without limitation:" *Ark. Code Ann. § 4-110-103(7)(E)(ii).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-103/#:~:text=%22biometric%20data%22%20means%20data%20generated,biological%20characteristics%2C%20including%20without%20limitation%3A>
+
+[^q5-pipa-substitute-notice]: **Ark. Code Ann. § 4-110-105** — "Substitute notice if the person or business demonstrates that: - (i) The cost of providing notice would exceed two hundred fifty thousand dollars ($250,000); - (ii) The affected class of persons to be notified exceeds five hundred thousand (500,000); or - (iii) The person or business does not have sufficient contact information." *Ark. Code Ann. § 4-110-105(e)(3)(A).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Substitute%20notice%20if%20the%20person,not%20have%20sufficient%20contact%20information.>
+
+[^q5-pipa-law-enforcement]: **Ark. Code Ann. § 4-110-105** — "The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation." *Ark. Code Ann. § 4-110-105(c)(1).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=The%20notification%20required%20by%20this,will%20impede%20a%20criminal%20investigation.>
+
+[^q5-pipa-own-policy]: **Ark. Code Ann. § 4-110-105** — "Notwithstanding subsection (e) of this section, a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies affected persons in accordance with its policies in the event of a breach of the security of the system." *Ark. Code Ann. § 4-110-105(f).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=Notwithstanding%20subsection%20(e)%20of%20this,the%20security%20of%20the%20system.>
+
+[^q5-pipa-determination-production]: **Ark. Code Ann. § 4-110-105** — "If the Attorney General submits a written request for the written determination of the breach of the security of the system, the person or business shall send a copy of the written determination of the breach of the security of the system and supporting documentation to the Attorney General no later than thirty (30) days after the date of receipt of the request." *Ark. Code Ann. § 4-110-105(g)(2).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-105/#:~:text=If%20the%20Attorney%20General%20submits,of%20receipt%20of%20the%20request.>
+
+[^q6-pipa-ag-only]: **Ark. Code Ann. § 4-110-108** — "Any violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq." *Ark. Code Ann. § 4-110-108.* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/#:~:text=Any%20violation%20of%20this%20chapter,of%20%C2%A7%204%2D88%2D101%20et%20seq.>
+
+[^q6-adtpa-private-suit]: **Ark. Code Ann. § 4-88-113** — "A person who suffers an actual financial loss as a result of his or her reliance on the use of a practice declared unlawful by this chapter may bring an action to recover his or her actual financial loss proximately caused by the offense or violation, as defined in this chapter." *Ark. Code Ann. § 4-88-113(f)(1)(A).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=A%20person%20who%20suffers%20an,as%20defined%20in%20this%20chapter.>
+
+[^q6-adtpa-reliance-proof]: **Ark. Code Ann. § 4-88-113** — "To prevail on a claim brought under this subsection, a claimant must prove individually that he or she suffered an actual financial loss proximately caused by his or her reliance on the use of a practice declared unlawful under this chapter." *Ark. Code Ann. § 4-88-113(f)(2).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=To%20prevail%20on%20a%20claim,declared%20unlawful%20under%20this%20chapter.>
+
+[^q6-adtpa-class-ban]: **Ark. Code Ann. § 4-88-113** — "A private class action under this subsection is prohibited unless the claim is being asserted for a violation of Arkansas Constitution, Amendment 89." *Ark. Code Ann. § 4-88-113(f)(1)(B).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=A%20private%20class%20action%20under,of%20Arkansas%20Constitution%2C%20Amendment%2089.>
+
+[^q6-act952-no-pra]: **H.B. 1717 (Act 952 of 2025)** — "The Attorney General shall have exclusive authority to enforce this subchapter. (2) Nothing in this subchapter provides the basis for, or subjects an operator, processor, or person to a private right of action for a violation of this subchapter or any other law." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q6-pipa-anti-waiver]: **Ark. Code Ann. § 4-110-107** — "Any waiver of a provision of this chapter is contrary to public policy, void, and unenforceable." *Ark. Code Ann. § 4-110-107.* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-107/#:~:text=Any%20waiver%20of%20a%20provision,public%20policy%2C%20void%2C%20and%20unenforceable.>
+
+[^q7-pipa-adtpa-bridge]: **Ark. Code Ann. § 4-110-108** — "Any violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq." *Ark. Code Ann. § 4-110-108.* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-110/section-4-110-108/#:~:text=Any%20violation%20of%20this%20chapter,of%20%C2%A7%204%2D88%2D101%20et%20seq.>
+
+[^q7-adtpa-penalties]: **Ark. Code Ann. § 4-88-113** — "Assess penalties to be paid to the state, not to exceed ten thousand dollars ($10,000) per violation, against persons found to have violated this chapter." *Ark. Code Ann. § 4-88-113(a)(3).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Assess%20penalties%20to%20be%20paid,to%20have%20violated%20this%20chapter.>
+
+[^q7-adtpa-restitution]: **Ark. Code Ann. § 4-88-113** — "Restore to any purchaser who has suffered any ascertainable loss by reason of the use or employment of the prohibited practices any moneys or real or personal property which may have been acquired by means of any practice declared to be unlawful by this chapter, together with other damages sustained." *Ark. Code Ann. § 4-88-113(a)(2)(A).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Restore%20to%20any%20purchaser%20who,together%20with%20other%20damages%20sustained.>
+
+[^q7-adtpa-charter]: **Ark. Code Ann. § 4-88-113** — "Upon petition of the Attorney General, the court may order the suspension or forfeiture of franchises, corporate charters, or other licenses or permits or authorization to do business in this state." *Ark. Code Ann. § 4-88-113(b).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Upon%20petition%20of%20the%20Attorney,do%20business%20in%20this%20state.>
+
+[^q7-act952-ag-remedies]: **H.B. 1717 (Act 952 of 2025)** — "In a case in which the Attorney General has reason to believe that an interest of the residents of the state has been or is threatened or adversely affected by the engagement of any person in a practice that violates the provisions of this subchapter, the Attorney General may bring a civil action on behalf of the residents of the state in a court of competent jurisdiction to: (1) Enjoin that practice; (2) Enforce compliance with the rule; (3) Obtain damages, restitution, or other compensation on behalf of residents of the state; or (4) Obtain other relief that the court finds appropriate." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>
+
+[^q7-adtpa-joint-liability]: **Ark. Code Ann. § 4-88-113** — "Every person, or every partner, officer, or director of another person who directly or indirectly controls another person or who is in violation of or liable under this chapter or every person who directly or indirectly facilitates, assists, acts as intermediary for, or in any way aids another person who is in violation of or liable under this chapter in the operation or continuance of the act or practice for which the violations or liability exists shall be jointly and severally liable for any penalties assessed and any monetary judgments awarded in any proceeding for civil enforcement of this chapter, if the persons to be held jointly and severally liable knew or reasonably should have known of the existence of the facts by reason of which the violation or liability exists." *Ark. Code Ann. § 4-88-113(d)(1).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=Every%20person%2C%20or%20every%20partner%2C,the%20violation%20or%20liability%20exists.>
+
+[^q7-adtpa-fees]: **Ark. Code Ann. § 4-88-113** — "As compensation for his or her services under this chapter, the Attorney General shall be entitled to all expenses reasonably incurred in the investigation and prosecution of suits, including, but not limited to, expenses for expert witnesses, to be paid by the defendant when judgment is rendered for the state, and, in addition, shall recover attorney's fees and costs." *Ark. Code Ann. § 4-88-113(e).* <https://law.justia.com/codes/arkansas/2024/title-4/subtitle-7/chapter-88/subchapter-1/section-4-88-113/#:~:text=As%20compensation%20for%20his%20or,recover%20attorney's%20fees%20and%20costs.>
+
+[^q7-act952-adtpa-bridge]: **H.B. 1717 (Act 952 of 2025)** — "a violation of subdivisions (b)(2) and (b)(3) of this section shall be treated as an unfair or deceptive act or practice prescribed under the Deceptive Trade Practices Act, § 4-88-101 et seq." *Act 952, 2025 Ark. Acts (H.B. 1717), § 1.* <https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf>