language: en · status: in-force · last checked: 2026-10-08

Arkansas — Student Online Personal Information Protection Act (Ark. Code Ann. §6-18-109)

Arkansas's SOPIPA, added by Act 1196 of 2015 (effective 22 July 2015 according to the Code's credit line) and amended by Act 910 of 2019. It binds the operator of an internet website, online service, online application or mobile application that knows the service is used primarily for, and was designed and marketed for, public school purposes. It prohibits targeted advertising, profiling, sale and most disclosure of covered information, and requires reasonable security and deletion at the school's request. The text here is the 2023 Arkansas Code as reproduced by Justia (see Meta).

Applicability to EdTech

Who is an operator. The owner of an internet website, online service, online application or mobile application "with actual knowledge" that it is used primarily for public school purposes and designed and marketed for them (§6-18-109(a)(2)(A)). General-audience services are outside the section (§6-18-109(i)).
Covered information names biometric and voice data. The list includes "Biometric information", "Search activity, photos, voice recordings" and "Geolocation information" (§6-18-109(a)(1)(C), items (xii), (xvii)).
Four knowing prohibitions: targeted advertising based on covered information; compiling a profile except in furtherance of public school purposes; selling covered information; and disclosure outside the listed cases (§6-18-109(b)). Disclosure to a service provider (a sub-processor) requires a contract that limits its use, prohibits onward disclosure and requires reasonable security (§6-18-109(b)(4)(C)).
Two duties: reasonable security appropriate to the covered information, and deletion "within a reasonable time frame" when the school or district asks (§6-18-109(d)).
What stays allowed: maintaining and improving the service (§6-18-109(c)), aggregated or de-identified use including to demonstrate effectiveness (§6-18-109(g)), and adaptive learning and recommendation engines (§6-18-109(h)).
A vendor under contract with an Arkansas district is also bound by the Student Data Vendor Security Act, and the SDPC Arkansas exhibit requires compliance with both.

Document	Covers
SOPIPA-AR.md	Ark. Code Ann. §6-18-109 in full (2023 Arkansas Code), with its credit lines

Key obligations at a glance

No targeted advertising, non-school profiling, sale or unpermitted disclosure — §6-18-109(b).
Reasonable security; delete on the school's request — §6-18-109(d).

Enforcement

The section names no penalty or enforcing authority.

Licence

The corpus reproduces Ark. Code Ann. §6-18-109 (2023 Arkansas Code) and its credit lines from Justia, a third-party republisher, because the official code published for the State by LexisNexis serves no text to a non-browser client. Justia's Terms of Service (justia.com/terms-of-service, read 2026-10-01 through the Internet Archive capture of 26 September 2026, as recorded for the Georgia instrument) say: "Justia claims no copyright in any works of the US Federal Government or US State Governments, including court documents, codes, and regulations." No Justia or LexisNexis annotation is reproduced.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The same Terms of Service also say "You agree not to access the Service by any means other than through the interface that is provided by Justia for use in accessing the Service" and "You agree not to reproduce, duplicate, copy, sell, trade, resell or exploit for any commercial purposes, any portion of the Service". These are contract terms with Justia, not copyright in the code. The builder reads Justia's page through the Internet Archive. Replacing the source with the official text once it is reachable would settle the question. The route is the curator's decision; it does not change the rights label.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in the fact document's {.meta} provenance line, and its Meta section describes what it changed (anchors added, standalone designations joined to their first child, nothing reworded).

Arkansas Student Data Vendor Security Act (Act 754 of 2023) — the 2023 contract-provider regime that sits alongside this section
SDPC Arkansas state terms — the NDPA exhibit that points at both statutes
California SOPIPA — the model this section follows

Sources

Arkansas Code (official, published by LexisNexis) — no machine-readable text
Justia — Ark. Code §6-18-109 (2023) — the text reproduced, read through the Internet Archive capture of 17 December 2024