AR SB258

Creates comprehensive consumer data privacy rights for Arkansas residents, including rights to access, correct, delete, and port personal data, as well as opt out of targeted advertising, data sales, and profiling

Applies to businesses conducting business in Arkansas that process or sell personal data, excluding small businesses (except for sensitive data sales), and nonprofits with annual receipts under $15 million

Requires controllers to obtain consent before processing sensitive data (racial/ethnic origin, health diagnoses, biometric data, precise geolocation, children's data) and prohibits use of "dark patterns" to obtain consent

Establishes requirements for high-risk artificial intelligence systems, including mandatory impact assessments, risk management programs, algorithmic discrimination protections, and disclosure obligations for both developers and deployers

Grants exclusive enforcement authority to the Attorney General with violations treated as unfair and deceptive trade practices; no private right of action; effective dates staggered from January 1, 2026 through October 1, 2026