EdLaw
Arkansas — Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025)
The Arkansas Children and Teens' Online Privacy Protection Act, Act 952 of the 2025 Regular Session (HB 1717), approved 21 April 2025 and "effective on and after July 1, 2026" (Section 3). It adds a new subchapter to the Deceptive Trade Practices chapter of the Arkansas Code (Title 4, Chapter 88, Subchapter 15) that applies COPPA-style duties to an operator of a website, online service, online application or mobile application that is directed at children or teens, or that has actual knowledge it is collecting personal information from them. It covers both children (12 or younger) and teens (13 to 16). Operators may not collect personal information for targeted advertising. Collection and retention are limited to what the service needs. Operators must give notice, get consent for teens, honour deletion, correction and access requests, and keep reasonable security. The Attorney General enforces it. The text here is the enrolled act (see Meta).
Applicability to EdTech
- Commercial EdTech is in scope; schools are not. An "operator" is a person who "for commercial purposes" operates a website, online service, online application or mobile application and collects or maintains personal information from its users, directly or through a service provider (§4-88-1502(9)(A)). Public educational entities, "including without limitation a school district", are excluded, and so are state agencies and FTC-exempt nonprofits (§4-88-1502(9)(B)). The duties attach to a service "directed at children or teens", or to any operator "with actual knowledge that it is collecting personal information from children or teens" (§4-88-1503(a)(1)). A product built for K-12 classrooms is directed at children or teens.
- Teens are 13 to 16 and located in Arkansas (§4-88-1502(16)). A "child" is 12 or younger (§4-88-1502(1)). That reaches secondary-school students whom federal COPPA does not cover.
- Biometric and voice data. Personal information includes biometric identifiers used to identify an individual: "Voice prints", "Facial templates", "Iris or retina imagery scans", fingerprints, DNA and "Gait" (§4-88-1502(12)(A)(viii)). It also includes geolocation precise enough to identify a street and city ((vii)) and any "Information linked or reasonably linkable to a child or teen" ((ix)). An audio file of a child's or teen's voice is not personal information if the operator meets four conditions (§4-88-1502(12)(B)): it does not ask for personal information by voice, it gives clear notice in its privacy policy, it uses the voice "as a replacement for written words, to perform a task, or engage with" the service, and it keeps the file only as long as needed and then deletes it. That is the question any voice-driven classroom device has to answer.
- No targeted advertising, and data minimisation. It is unlawful to collect a child's or teen's personal information for targeted advertising, or to let another person collect, use, disclose or maintain it for that purpose (§4-88-1503(a)(1)(B)). Collection is unlawful unless it is consistent with the context of the service or required by law ((C)). Retention is limited to what is reasonably necessary, except for safety or integrity of the service or where law authorises it ((D)).
- Consent for teens, with service exceptions. Consent from the teen or a parent is required for collection, use or disclosure (§4-88-1503(b)(2)), except for processing to provide or maintain the specific product or service the teen requested, internal operations, security, legal claims and compliance ((A)–(H)). "Consent" can be given "through an operator's terms of service or acknowledgement of the operator's privacy policy" (§4-88-1502(3)).
- Notice, rights and security. Operators must give clear and conspicuous notice of what is collected and why, their disclosure practices, and the categories of third parties (§4-88-1503(b)(1)). Parents of children get deletion, refusal, correction and access rights ((b)(3)), and teens get the same for themselves ((b)(4)). Operators must keep "reasonable security practices" ((b)(6)).
- No age verification required. The act does not require an operator to collect age information it does not already collect, or to implement age-gating or age verification (§4-88-1505).
Contents
| Document | Covers |
|---|---|
| ACT-952-2025.md | Act 952 of 2025, Sections 1 (the new subchapter, §§4-88-1501 to 4-88-1505 as enacted), 2 (severability) and 3 (effective date), as enrolled |
Key obligations at a glance
- No collection for targeted advertising to children or teens — §4-88-1503(a)(1)(B).
- Collect only in context, and keep only as long as reasonably necessary — §4-88-1503(a)(1)(C)–(D).
- Notice of collection, purposes and third-party sharing — §4-88-1503(b)(1).
- Teen or parent consent, subject to the service exceptions — §4-88-1503(b)(2).
- Deletion, correction and access for parents of children and for teens — §4-88-1503(b)(3)–(4).
- Reasonable security practices — §4-88-1503(b)(6).
Enforcement
The Attorney General "shall have exclusive authority to enforce this subchapter" (§4-88-1504(b)(1)). The Attorney General may sue to enjoin a practice, enforce compliance, or obtain damages, restitution or other relief for residents (§4-88-1504(a)). There is no private right of action (§4-88-1504(b)(2)). A violation of the consent and child-rights duties is "treated as an unfair or deceptive act or practice" under the Deceptive Trade Practices Act, §4-88-101 et seq. (§4-88-1503(e)). No challenge to the act in court was found (web search, 2026-10-08).
Licence
The corpus reproduces Act 952 of 2025 verbatim from the enrolled act published by the Arkansas General Assembly at arkleg.state.ar.us (read 2026-10-08). The PDF carries no copyright notice (checked in full).
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."
Conditions: none attach to the act's text. The corpus still names the official source in its Sources section and in each fact document's {.meta} provenance lines. Its Meta section says what it changed: margin line numbers and page furniture dropped, line-break hyphenation rejoined, anchors added, nothing reworded.
Related
- Arkansas Student Online Personal Information Protection Act (§6-18-109) — the school-purpose operator statute; this act reaches operators directed at children or teens generally
- Arkansas Student Data Vendor Security Act (Act 754 of 2023) — contract duties for vendors to Arkansas public schools
- COPPA Rule (16 CFR Part 312) — the federal children's rule this act extends to teens