EdLaw
Arkansas — Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025; Ark. Code Ann. §§4-88-1501 to 4-88-1505)
Arkansas's children-and-teens privacy act: duties on an operator of a website, online service, online application or mobile application directed at children or teens, or with actual knowledge that it collects personal information from them — no collection for targeted advertising, collection and retention limits, notice, consent for teens (13 to 16), deletion, correction and access rights, and reasonable security — enforced by the Attorney General. Reproduced from the enrolled act; the section numbers are the act's own.
SECTION 1. (Subchapter 15 — Arkansas Children and Teens' Online Privacy Protection Act)
SECTION 1. Arkansas Code Title 4, Chapter 88, is amended to add an additional subchapter to read as follows: Subchapter 15 — Arkansas Children and Teens' Online Privacy Protection Act
4-88-1501. Title.
This subchapter shall be known and may be cited as the "Arkansas Children and Teens' Online Privacy Protection Act".
4-88-1502. Definitions.
As used in this subchapter:
(2) "Connected device" means a device that is capable of connecting to the Internet, directly or indirectly, or to another connected device;
(3) "Consent" means any reasonable effort, taking into consideration available technology and including without limitation a request for authorization for future collection, use, and disclosure described in the notice, to ensure that in the case of a teen, the parent of a teen or the teen:
- (A) Receives notice of the personal information collection, use, and disclosure practices of the operator; and
- (B) Before the personal information of the teen is collected, freely and unambiguously authorizes, including without limitation the giving of consent through an operator's terms of service or acknowledgement of the operator's privacy policy:
- (A) "Disclosure" means making personal information that is collected from a child or teen by a website, online service, online application, or mobile application targeted toward children or teens or that is collected with actual knowledge the personal information from a child or teen publicly available in an identifiable form to a third party not affiliated with the operator.
- (B) "Disclosure" does not include personal information provided to a person other than an operator who provides support for the internal operations of the website, online service, online application, or mobile application of the operator, including a processor; application, or mobile application targeted toward children or teens or that collect with actual knowledge the personal information from a child or teen, publicly available in an identifiable form to a third party not affiliated with the operator.
- (C) "Disclosure" does not include information provided to a person other than an operator who provides support for the internal operations of the website, online service, online application, or mobile application of the operator, including a processor;
(5) "Internet" means collectively a system of interconnected computer networks that comprise the interconnected world-wide network of networks and employ without limitation the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, or the User Datagram Protocol to communicate information of all kinds by wire or radio;
- (A) A software program that runs on the operating system of:
- (B) Includes without limitation a service or application offered via a connected device;
(7) "Online application" means an Internet-connected software program and includes without limitation a service or application offered via a connected device;
(8) "Online contact information" means an email address or another substantially similar identifier that permits direct contact with a person online;
- (A) "Operator" means a person who, for commercial purposes, operates or provides a website on the internet, an online service, an online application, or a mobile application, and who:
- (i) Collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application; or
- (ii) Allows another person to collect personal information directly from users of that website, service, or application, in which case, the operator is deemed to have collected the information.
- (B) "Operator" does not include:
- (i) Any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq.;
- (ii) An interactive gaming platform that complies with the requirements of the Children's Online Privacy Act, 15 U.S.C. § 6501, and the rules, guidance, and exemptions under that act;
- (iii) An agency, board, commission, institution, or other instrumentality of the State of Arkansas or its political subdivisions; or
- (iv) A public educational entity of the State of Arkansas, including without limitation a school district and an institution of higher learning;
(10) "Parent" means a natural parent, adoptive parent, legal guardian, or legal custodian of an individual who is sixteen (16) years of age or younger;
(11) "Person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity;
- (A) "Personal information" means individually identifiable information about an individual collected online, including without limitation:
- (i) A first and last name;
- (ii) A home or other physical address including street name and name of the city or town of residence;
- (iii) An e-mail address;
- (iv) A telephone number;
- (v) A Social Security number;
- (vi) Any other identifier that permits the physical or online contacting of a specific individual;
- (vii) Geolocation information sufficient to identify a street name and a city or town;
- (viii) Information generated from the measurement or technological processing of an individual's biological, physical, or physiological characteristics that is used to identify an individual, including without limitation:
- (ix) Information linked or reasonably linkable to a child or teen; or
- (x) Information linked or reasonably linkable to a child or teen or the parents of that child or teen, including without limitation any unique identifier, that an operator collects online from the child or teen and combines with an identifier described in this subdivision (11)(A).
- (B) "Personal information" does not include an audio file that contains a child or teen’s voice so long as the operator:
- (i) Does not request information via voice that would otherwise be considered personal information under subdivision (11)(A) of this section;
- (ii) Provides clear notice of its collection and use of the audio file and its deletion policy in its privacy policy;
- (iii) Uses the voice within the audio file as a replacement for written words, to perform a task, or engage with a website, online service, online application, or mobile application, such as to perform a search or fulfill a verbal instruction or request; and
- (iv) Only maintains the audio file long enough to complete the stated purpose and improve or enhance the users' experience of the service and then deletes the audio file when it is no longer reasonably needed and does not make any other use of the audio file before deletion;
- (A) "Social media platform" means a public or semipublic Internet-based service or application that:
- (i) Is used by a consumer in this state;
- (ii) Is primarily intended to connect and allow users to socially interact within that service or application; and
- (iii) Enables a user to:
- (a) Construct a public or semipublic profile for the purposes of signing into and using the service or application;
- (b) Populate a public list of other users with whom the user shares a social connection within that service or application; and
- (c) Create or post content that is viewable by other users, including without limitation on message boards, in chat rooms, or through a landing page or main feed that presents the user with content that is generated by other users.
- (B) "Social media platform" does not include a public or semipublic Internet-based service or application that:
- (i) Exclusively provides electronic mail or direct messaging services;
- (ii) Primarily consists of news, sports, entertainment, interactive video games, electronic commerce, or content that is preselected by the provider or for which any chat, comments, or interactive functionality is incidental to, directly related to, or dependent or a student engagement program;
- (iii) Primarily provides career development opportunities, including without limitation professional networking, job skills, learning certifications, and job posting and application services; or
- (iv) Is used by and under the direction of an educational entity, including without limitation a learning management system or a student engagement program;
- (A) "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict that consumer's preferences or interests.
- (B) "Targeted advertising" does not include:
- (i) Advertising based on activities within a controller's own websites or online applications;
- (ii) Advertising based on the context of a consumer's current search query or visit to a website or online application;
- (iii) Advertising directed to a consumer in response to the consumer's request for information or feedback; or
- (iv) Processing of personal data that is processed solely for measuring or reporting advertising performance, reach, or frequency;
(17) "Third party" means a person, public authority, agency, or body other than the consumer, operator, processor, or an affiliate of the processor or the operator.
4-88-1503. Personal information from and about children and teens — Online collection and use.
- (1) Except as provided in subdivision (a)(2) of this section, it is unlawful for an operator of a website, online service, online application, or mobile application directed at children or teens or for any operator of a website, online service, online application, or mobile application with actual knowledge that it is collecting personal information from children or teens:
- (A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;
- (B) Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen personal information of a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this information for targeted advertising to children or teens;
- (C) To collect the personal information of a child or teen except when the collection of the personal information is:
- (i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or
- (ii) Required or specifically authorized by law; or
- (D) To retain the personal information of a child or teen for longer that is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law.
- (2) Neither an operator nor the operator’s agent shall be liable for a disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subdivision (b)(3)(A) of this section to the parent of a child or to a teen under subdivision (b)(4)(A) of this section.
(b) An operator of a website, online service, online application, or mobile application that has actual knowledge that it is collecting personal information from children or teens shall:
- (1) Provide clear and conspicuous notice of:
- (A) What information is collected from children or teens by the operator;
- (B) The purpose for processing personal data;
- (C) The operator’s disclosure practices for such information;
- (D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section;
- (E) The categories of personal data that the controller shares with third parties, if any; and
- (F) The categories of third parties, if any, with whom the controller shares personal data;
- (2) Obtain consent for the collection, use, or disclosure of personal information from a teen from a parent of a teen or a teen, except when the processing is for:
- (A) Providing or maintaining the specific product or service requested by the teen;
- (B) Conducting the operator's internal business operations, including without limitation identifying and repairing technical errors that impair existing or intended functionality;
- (C) Protecting against malicious, fraudulent, or illegal activity or detecting, responding to, or preventing security incidents or threats;
- (D) Investigating, establishing, exercising, preparing for, or defending legal claims;
- (E) Complying with federal, state, or local laws, rules, or regulations;
- (F) Complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or a summons by federal, state, local, or other governmental authorities;
- (G) Protecting the vital interests of a natural person; or
- (H) Providing or maintaining a specific product or service requested by the teen;
- (3) Provide:
- (A) The opportunity to:
- (i) Request at any time the deletion of the account of the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse at any time to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child; and
- (ii) Challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and
- (B) A means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child, if that information is available to the operator at the time the parent makes the request;
- (A) The opportunity to:
- (4) Provide:
- (A) The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;
- (B) The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and
- (C) A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the information is available to the operator at the time the teen makes the request;
- (5) Not require a child to disclose more personal information than is reasonably necessary to participate as a condition to participate in:
- (6) Establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and protect the personal information against unauthorized access.
- (1) Online contact information collected from a child or teen that is used only to respond directly on a one-time basis to a specific request from the child or teen and is not used to recontact the child or teen or to contact another child or teen and is not maintained in retrievable form by the operator;
- (2) A request for the name or online contact information of a parent or teen that is used for the sole purpose of obtaining verifiable consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if verifiable consent is not obtained after a reasonable time;
- (3) Online contact information collected from a child or teen that is used only to respond more than once directly to a specific request from the child or teen and is not used to recontact the child or teen beyond the scope of that request if, before any additional response after the initial response to the child or teen, the operator uses reasonable efforts to provide a parent or teen notice of the online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form; and
- (4) The name of the child or teen and online contact information, to the extent reasonably necessary to protect the safety of a child or teen participant on the site:
- (A) Used only for the purpose of protecting such safety;
- (B) Not used to recontact the child or teen or for any other purpose; and
- (C) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent or teen notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form; or
- (5) The collection, use, or dissemination of such information by the operator necessary to:
- (A) Protect the security or integrity of its website;
- (B) Take precautions against liability;
- (C) Respond to judicial process;
- (D) Protect the security or safety of the user on the service; or
- (E) Provide information to law enforcement agencies or for an investigation on a matter related to public safety.
- (1) An operator may terminate service provided to a child whose parent has refused or a teen who has refused under subdivision (b)(2) of this section to permit the operator's further use or maintenance in retrievable form or future online collection of personal information from that child or teen.
- (2) An operator shall not discontinue service provided to a child or teen on the basis of a request by the parent or the child or by the teen under subdivision (b)(3)(B)(i) of this section to delete personal information collected from the child or teen, to the extent that the operator is capable of providing this service without the personal information.
- (3) A request made under subdivisions (b)(3)(B)(i) of this section to delete personal information of a child or teen shall not be construed to:
- (A) Limit the authority of a law enforcement agency to obtain any content or information from an operator under a lawfully executed warrant or an order of a court of competent jurisdiction;
- (B) Require an operator or third party to delete information that:
- (i) Another law requires the operator or third party to maintain; or
- (ii) Was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including without limitation content or information submitted by the user that was republished or resubmitted by another person; and
- (C) Prohibit an operator from:
- (i) Retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made under subsection (b) of this section;
- (ii) Preventing, detecting, protecting against, or responding to a security incident, identity theft, fraud, or the reporting of a person responsible for a security incident, identity theft, or fraud;
- (iii) Protecting the integrity or security of a website, online service, online application, or mobile application; or
- (iv) Ensuring that the child or teen's personal information remains deleted.
(e) Except as provided under § 4-88-1503 and § 4-88-1505, a violation of subdivisions (b)(2) and (b)(3) of this section shall be treated as an unfair or deceptive act or practice prescribed under the Deceptive Trade Practices Act, § 4-88-101 et seq.
4-88-1504. Enforcement.
(a) In a case in which the Attorney General has reason to believe that an interest of the residents of the state has been or is threatened or adversely affected by the engagement of any person in a practice that violates the provisions of this subchapter, the Attorney General may bring a civil action on behalf of the residents of the state in a court of competent jurisdiction to:
- (1) Enjoin that practice;
- (2) Enforce compliance with the rule;
- (3) Obtain damages, restitution, or other compensation on behalf of residents of the state; or
- (4) Obtain other relief that the court finds appropriate.
- (1) The Attorney General shall have exclusive authority to enforce this subchapter.
- (2) Nothing in this subchapter provides the basis for, or subjects an operator, processor, or person to a private right of action for a violation of this subchapter or any other law.
4-88-1505. Construction.
This subchapter shall not be construed to require an operator to:
(1) Affirmatively collect any personal information regarding the age of a child or teen that an operator is not already collecting in the normal course of business; or
SECTION 2. DO NOT CODIFY. SEVERABILITY CLAUSE.
If any provision of this act or the application of this act to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of this act which can be given effect without the invalid provision or application, and to this end, the provisions of this act are declared severable.
SECTION 3. DO NOT CODIFY. EFFECTIVE DATE.
This act shall be effective on and after July 1, 2026.
Sources
- Arkansas General Assembly — Act 952 of the 2025 Regular Session (HB 1717) — PDF SHA-256
ff3a8d0a130d6e3ef2e2cc0316634778942e658c1d22f228b8f867d1d9f2d5cf - Extracted-text SHA-256:
6bb675ddeae6608b69c74db7f5a72a367ced5a58db822b23dbbe555ee66779ff