Each one links to its
LexLint note, which carries what it requires and what it flags on.
PIPA requires an individual, business, or state agency that acquires, owns, or licenses personal information of an Arkansas resident to implement and maintain reasonable security procedures, dispose of records properly, and notify affected Arkansas residents of a breach of security without unreasonable delay.
If a breach affects more than 1,000 individuals, the person or business must also notify the Attorney General, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever is first.
Biometric data, including faceprint and voiceprint, is one of the data elements that makes information personal information for these purposes, named with no exclusion for data derived from a photograph or recording, but PIPA imposes no separate capture-consent, retention, or destruction duty on biometric data as such.
PIPA violations are enforced by the Attorney General under the Arkansas Deceptive Trade Practices Act; whether that Act's own private-suit provision, section 4-88-113, also arms a private plaintiff for a PIPA violation specifically was not confirmed from primary text in this research pass and is left as an open question rather than a decided finding.
What it asks of an app →
Amends the Social Media Safety Act to lower the covered minor age from 18 to 16, prohibit addictive design features, require default privacy settings, and disable non-essential notifications between 10 PM and 6 AM. Signed April 21, 2025; most provisions took effect August 5, 2025, while the addictive design and notification duties in Section 2 carried a delayed effective date of April 21, 2026, one year after enactment.
Note and primary source →
Creates a private right of action against a social media platform whose design, algorithm, or feature causes a minor to suffer harm such as an eating disorder, suicide or attempted suicide, or platform addiction. Signed April 21, 2025 and effective August 5, 2025 with no separate effective date clause.
Note and primary source →
