Shown verbatim: the complete text as captured from the official PDF posted by the Arkansas General Assembly, fetched 2026-07-23. Page and line markers are part of the official record; nothing is edited or removed. The official bill page.
Stricken language would be deleted from and underlined language would be added to present law.
1 State of Arkansas As Engrossed: S3/31/25 S4/2/25 S4/7/25
2 95th General Assembly A Bill
3 Regular Session, 2025 HOUSE BILL 1717
4
5 By: Representatives Gramlich, A. Collins, Springer, Bentley, A. Brown, Walker, Achor
6 By: Senators J. Boyd, C. Tucker
7
8 For An Act To Be Entitled
9 AN ACT TO CREATE THE ARKANSAS CHILDREN AND TEENS'
10 ONLINE PRIVACY PROTECTION ACT; AND FOR OTHER
11 PURPOSES.
12
13
14 Subtitle
15 TO CREATE THE ARKANSAS CHILDREN AND
16 TEENS' ONLINE PRIVACY PROTECTION ACT.
17
18 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF ARKANSAS:
19
20 SECTION 1. Arkansas Code Title 4, Chapter 88, is amended to add an
21 additional subchapter to read as follows:
22 Subchapter 15 -- Arkansas Children and Teens' Online Privacy Protection Act
23
24 4-88-1501. Title.
25 This subchapter shall be known and may be cited as the "Arkansas
26 Children and Teens' Online Privacy Protection Act".
27
28 4-88-1502. Definitions.
29 As used in this subchapter:
30 (1) "Child" means an individual twelve (12) years of age or
31 younger in the State of Arkansas;
32 (2) "Connected device" means a device that is capable of
33 connecting to the Internet, directly or indirectly, or to another connected
34 device;
35 (3) "Consent" means any reasonable effort, taking into
36 consideration available technology and including without limitation a request
*LJH194* 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 for authorization for future collection, use, and disclosure described in the
2 notice, to ensure that in the case of a teen, the parent of a teen or the
3 teen:
4 (A) Receives notice of the personal information
5 collection, use, and disclosure practices of the operator; and
6 (B) Before the personal information of the teen is
7 collected, freely and unambiguously authorizes, including without limitation
8 the giving of consent through an operator's terms of service or
9 acknowledgement of the operator's privacy policy:
10 (i) The collection, use, and disclosure, as
11 applicable, of the teen's personal information; and
12 (ii) Any subsequent use of the teen's personal
13 information.
14 (4)(A) "Disclosure" means making personal information that is
15 collected from a child or teen by a website, online service, online
16 application, or mobile application targeted toward children or teens or that
17 is collected with actual knowledge the personal information from a child or
18 teen publicly available in an identifiable form to a third party not
19 affiliated with the operator.
20 (B) "Disclosure" does not include personal information
21 provided to a person other than an operator who provides support for the
22 internal operations of the website, online service, online application, or
23 mobile application of the operator, including a processor; application, or
24 mobile application targeted toward children or teens or that collect with
25 actual knowledge the personal information from a child or teen, publicly
26 available in an identifiable form to a third party not affiliated with the
27 operator.
28 (C) "Disclosure" does not include information provided to
29 a person other than an operator who provides support for the internal
30 operations of the website, online service, online application, or mobile
31 application of the operator, including a processor;
32 (5) "Internet" means collectively a system of interconnected
33 computer networks that comprise the interconnected world-wide network of
34 networks and employ without limitation the Transmission Control
35 Protocol/Internet Protocol, or any predecessor or successor protocols to such
36 protocol, or the User Datagram Protocol to communicate information of all
2 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 kinds by wire or radio;
2 (6) "Mobile application" means:
3 (A) A software program that runs on the operating system
4 of:
5 (i) A cellular telephone;
6 (ii) A tablet computer; or
7 (iii) A similar portable computing device that
8 transmits data over a wireless connection; and
9 (B) Includes without limitation a service or application
10 offered via a connected device;
11 (7) "Online application" means an Internet-connected software
12 program and includes without limitation a service or application offered via
13 a connected device;
14 (8) "Online contact information" means an email address or
15 another substantially similar identifier that permits direct contact with a
16 person online;
17 (9)(A) "Operator" means a person who, for commercial purposes,
18 operates or provides a website on the internet, an online service, an online
19 application, or a mobile application, and who:
20 (i) Collects or maintains, either directly or
21 through a service provider, personal information from or about the users of
22 that website, service, or application; or
23 (ii) Allows another person to collect personal
24 information directly from users of that website, service, or application, in
25 which case, the operator is deemed to have collected the information.
26 (B) "Operator" does not include:
27 (i) Any nonprofit entity that would otherwise be
28 exempt from coverage under section 5 of the Federal Trade Commission Act, 15
29 U.S.C. � 45 et seq.;
30 (ii) An interactive gaming platform that complies
31 with the requirements of the Children's Online Privacy Act, 15 U.S.C. � 6501,
32 and the rules, guidance, and exemptions under that act;
33 (iii) An agency, board, commission, institution, or
34 other instrumentality of the State of Arkansas or its political subdivisions;
35 or
36 (iv) A public educational entity of the State of
3 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 Arkansas, including without limitation a school district and an institution
2 of higher learning;
3 (10) "Parent" means a natural parent, adoptive parent, legal
4 guardian, or legal custodian of an individual who is sixteen (16) years of
5 age or younger;
6 (11) "Person" means any individual, partnership, corporation,
7 trust, estate, cooperative, association, or other entity;
8 (12)(A) "Personal information" means individually identifiable
9 information about an individual collected online, including without
10 limitation:
11 (i) A first and last name;
12 (ii) A home or other physical address including
13 street name and name of the city or town of residence;
14 (iii) An e-mail address;
15 (iv) A telephone number;
16 (v) A Social Security number;
17 (vi) Any other identifier that permits the physical
18 or online contacting of a specific individual;
19 (vii) Geolocation information sufficient to identify
20 a street name and a city or town;
21 (viii) Information generated from the measurement or
22 technological processing of an individual's biological, physical, or
23 physiological characteristics that is used to identify an individual,
24 including without limitation:
25 (a) Fingerprints;
26 (b) Voice prints;
27 (c) Iris or retina imagery scans;
28 (d) Facial templates;
29 (e) Deoxyribonucleic acid (DNA) information;
30 or
31 (f) Gait;
32 (ix) Information linked or reasonably linkable to a
33 child or teen; or
34 (x) Information linked or reasonably linkable to a
35 child or teen or the parents of that child or teen, including without
36 limitation any unique identifier, that an operator collects online from the
4 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 child or teen and combines with an identifier described in this subdivision
2 (11)(A).
3 (B) "Personal information" does not include an audio file
4 that contains a child or teen's voice so long as the operator:
5 (i) Does not request information via voice that
6 would otherwise be considered personal information under subdivision (11)(A)
7 of this section;
8 (ii) Provides clear notice of its collection and use
9 of the audio file and its deletion policy in its privacy policy;
10 (iii) Uses the voice within the audio file as a
11 replacement for written words, to perform a task, or engage with a website,
12 online service, online application, or mobile application, such as to perform
13 a search or fulfill a verbal instruction or request; and
14 (iv) Only maintains the audio file long enough to
15 complete the stated purpose and improve or enhance the users' experience of
16 the service and then deletes the audio file when it is no longer reasonably
17 needed and does not make any other use of the audio file before deletion;
18 (13) "Processor" means a person that processes personal
19 information on behalf of an operator;
20 (14)(A) "Social media platform" means a public or semipublic
21 Internet-based service or application that:
22 (i) Is used by a consumer in this state;
23 (ii) Is primarily intended to connect and allow
24 users to socially interact within that service or application; and
25 (iii) Enables a user to:
26 (a) Construct a public or semipublic profile
27 for the purposes of signing into and using the service or application;
28 (b) Populate a public list of other users with
29 whom the user shares a social connection within that service or application;
30 and
31 (c) Create or post content that is viewable by
32 other users, including without limitation on message boards, in chat rooms,
33 or through a landing page or main feed that presents the user with content
34 that is generated by other users.
35 (B) "Social media platform" does not include a public or
36 semipublic Internet-based service or application that:
5 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 (i) Exclusively provides electronic mail or direct
2 messaging services;
3 (ii) Primarily consists of news, sports,
4 entertainment, interactive video games, electronic commerce, or content that
5 is preselected by the provider or for which any chat, comments, or
6 interactive functionality is incidental to, directly related to, or dependent
7 or a student engagement program;
8 (iii) Primarily provides career development
9 opportunities, including without limitation professional networking, job
10 skills, learning certifications, and job posting and application services; or
11 (iv) Is used by and under the direction of an
12 educational entity, including without limitation a learning management system
13 or a student engagement program;
14 (15)(A) "Targeted advertising" means displaying advertisements
15 to a consumer where the advertisement is selected based on personal data
16 obtained from that consumer's activities over time and across nonaffiliated
17 websites or online applications to predict that consumer's preferences or
18 interests.
19 (B) "Targeted advertising" does not include:
20 (i) Advertising based on activities within a
21 controller's own websites or online applications;
22 (ii) Advertising based on the context of a
23 consumer's current search query or visit to a website or online application;
24 (iii) Advertising directed to a consumer in response
25 to the consumer's request for information or feedback; or
26 (iv) Processing of personal data that is processed
27 solely for measuring or reporting advertising performance, reach, or
28 frequency;
29 (16) "Teen" means an individual located in the State of Arkansas
30 who is:
31 (A) Thirteen (13) years of age or older; and
32 (B) Younger than seventeen (17) years of age; and
33 (17) "Third party" means a person, public authority, agency, or
34 body other than the consumer, operator, processor, or an affiliate of the
35 processor or the operator.
36
6 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 4-88-1503. Personal information from and about children and teens --
2 Online collection and use.
3 (a)(1) Except as provided in subdivision (a)(2) of this section, it
4 is unlawful for an operator of a website, online service, online application,
5 or mobile application directed at children or teens or for any operator of a
6 website, online service, online application, or mobile application with
7 actual knowledge that it is collecting personal information from children or
8 teens:
9 (A) To collect personal information from a child or teen
10 in a manner that violates subsection (b) of this section;
11 (B) Except as provided in subdivisions (a)(1)(C) and (D)
12 of this section, to collect personal information from a child or teen
13 personal information of a child or teen for purposes of targeted advertising
14 to children or teens, or to allow another person to collect, use, disclose,
15 or maintain this information for targeted advertising to children or teens;
16 (C) To collect the personal information of a child or teen
17 except when the collection of the personal information is:
18 (i) Consistent with the context of a particular
19 service or the relationship of the child or teen with the operator, including
20 without limitation collection that is necessary to fulfill a transaction or
21 provide a product or service requested by the child or teen or parent of the
22 child or teen; or
23 (ii) Required or specifically authorized by law; or
24 (D) To retain the personal information of a child or teen
25 for longer that is reasonably necessary to fulfill a transaction or provide a
26 service requested by the child or teen except as required for the safety or
27 integrity of the service or specifically authorized by law.
28 (2) Neither an operator nor the operator's agent shall be liable
29 for a disclosure made in good faith and following reasonable procedures in
30 responding to a request for disclosure of personal information under
31 subdivision (b)(3)(A) of this section to the parent of a child or to a teen
32 under subdivision (b)(4)(A) of this section.
33 (b) An operator of a website, online service, online application, or
34 mobile application that has actual knowledge that it is collecting personal
35 information from children or teens shall:
36 (1) Provide clear and conspicuous notice of:
7 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 (A) What information is collected from children or teens
2 by the operator;
3 (B) The purpose for processing personal data;
4 (C) The operator's disclosure practices for such
5 information;
6 (D) The rights and opportunities available to the parent
7 of the child or teen under subdivisions (b)(3) and (b)(4) of this section;
8 (E) The categories of personal data that the controller
9 shares with third parties, if any; and
10 (F) The categories of third parties, if any, with whom the
11 controller shares personal data;
12 (2) Obtain consent for the collection, use, or disclosure of
13 personal information from a teen from a parent of a teen or a teen, except
14 when the processing is for:
15 (A) Providing or maintaining the specific product or
16 service requested by the teen;
17 (B) Conducting the operator's internal business
18 operations, including without limitation identifying and repairing technical
19 errors that impair existing or intended functionality;
20 (C) Protecting against malicious, fraudulent, or illegal
21 activity or detecting, responding to, or preventing security incidents or
22 threats;
23 (D) Investigating, establishing, exercising, preparing
24 for, or defending legal claims;
25 (E) Complying with federal, state, or local laws, rules,
26 or regulations;
27 (F) Complying with a civil, criminal, or regulatory
28 inquiry, investigation, subpoena, or a summons by federal, state, local, or
29 other governmental authorities;
30 (G) Protecting the vital interests of a natural person; or
31 (H) Providing or maintaining a specific product or service
32 requested by the teen;
33 (3) Provide:
34 (A) The opportunity to:
35 (i) Request at any time the deletion of the account
36 of the child or content or information submitted by the child to a website,
8 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 online service, online application, or mobile application and to refuse at
2 any time to permit the operator's further use or maintenance in retrievable
3 form, or future online collection, of personal information from that child;
4 and
5 (ii) Challenge the accuracy of the personal
6 information and, if the parent of the child establishes the inaccuracy of the
7 personal information, to have the inaccurate personal information corrected;
8 and
9 (B) A means that is reasonable under the circumstances for
10 the parent to obtain any personal information collected from that child, if
11 that information is available to the operator at the time the parent makes
12 the request;
13 (4) Provide:
14 (A) The opportunity at any time to delete personal
15 information collected from the teen or content or information submitted by
16 the teen to a website, online service, online application, or mobile
17 application;
18 (B) The opportunity to challenge the accuracy of the
19 personal information and, if the teen establishes the inaccuracy of the
20 personal information, to have the inaccurate personal information corrected;
21 and
22 (C) A means that is reasonable under the circumstances for
23 the teen to obtain any personal information collected from the teen, if the
24 information is available to the operator at the time the teen makes the
25 request;
26 (5) Not require a child to disclose more personal information
27 than is reasonably necessary to participate as a condition to participate in:
28 (A) A game;
29 (B) The offering of a prize; or
30 (C) Another activity; and
31 (6) Establish, implement, and maintain reasonable security
32 practices to protect the confidentiality, integrity, and accessibility of
33 personal information of children or teens collected by the operator, and
34 protect the personal information against unauthorized access.
35 (c) Verifiable consent under subdivision (b)(2)(A) of this section is
36 not required in the case of:
9 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 (1) Online contact information collected from a child or teen
2 that is used only to respond directly on a one-time basis to a specific
3 request from the child or teen and is not used to recontact the child or teen
4 or to contact another child or teen and is not maintained in retrievable form
5 by the operator;
6 (2) A request for the name or online contact information of a
7 parent or teen that is used for the sole purpose of obtaining verifiable
8 consent or providing notice under this section and where such information is
9 not maintained in retrievable form by the operator if verifiable consent is
10 not obtained after a reasonable time;
11 (3) Online contact information collected from a child or teen
12 that is used only to respond more than once directly to a specific request
13 from the child or teen and is not used to recontact the child or teen beyond
14 the scope of that request if, before any additional response after the
15 initial response to the child or teen, the operator uses reasonable efforts
16 to provide a parent or teen notice of the online contact information
17 collected from the child or teen, the purposes for which it is to be used,
18 and an opportunity for the parent or teen to request that the operator make
19 no further use of the information and that it not be maintained in
20 retrievable form; and
21 (4) The name of the child or teen and online contact
22 information, to the extent reasonably necessary to protect the safety of a
23 child or teen participant on the site:
24 (A) Used only for the purpose of protecting such safety;
25 (B) Not used to recontact the child or teen or for any
26 other purpose; and
27 (C) Not disclosed on the site, if the operator uses
28 reasonable efforts to provide a parent or teen notice of the name and online
29 contact information collected from the child or teen, the purposes for which
30 it is to be used, and an opportunity for the parent or teen to request that
31 the operator make no further use of the information and that it not be
32 maintained in retrievable form; or
33 (5) The collection, use, or dissemination of such information by
34 the operator necessary to:
35 (A) Protect the security or integrity of its website;
36 (B) Take precautions against liability;
10 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 (C) Respond to judicial process;
2 (D) Protect the security or safety of the user on the
3 service; or
4 (E) Provide information to law enforcement agencies or for
5 an investigation on a matter related to public safety.
6 (d)(1) An operator may terminate service provided to a child whose
7 parent has refused or a teen who has refused under subdivision (b)(2) of this
8 section to permit the operator's further use or maintenance in retrievable
9 form or future online collection of personal information from that child or
10 teen.
11 (2) An operator shall not discontinue service provided to a
12 child or teen on the basis of a request by the parent or the child or by the
13 teen under subdivision (b)(3)(B)(i) of this section to delete personal
14 information collected from the child or teen, to the extent that the operator
15 is capable of providing this service without the personal information.
16 (3) A request made under subdivisions (b)(3)(B)(i) of this
17 section to delete personal information of a child or teen shall not be
18 construed to:
19 (A) Limit the authority of a law enforcement agency to
20 obtain any content or information from an operator under a lawfully executed
21 warrant or an order of a court of competent jurisdiction;
22 (B) Require an operator or third party to delete
23 information that:
24 (i) Another law requires the operator or third party
25 to maintain; or
26 (ii) Was submitted to the website, online service,
27 online application, or mobile application of the operator by any person other
28 than the user who is attempting to erase or otherwise eliminate the content
29 or information, including without limitation content or information submitted
30 by the user that was republished or resubmitted by another person; and
31 (C) Prohibit an operator from:
32 (i) Retaining a record of the deletion request and
33 the minimum information necessary for the purposes of ensuring compliance
34 with a request made under subsection (b) of this section;
35 (ii) Preventing, detecting, protecting against, or
36 responding to a security incident, identity theft, fraud, or the reporting of
11 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 a person responsible for a security incident, identity theft, or fraud;
2 (iii) Protecting the integrity or security of a
3 website, online service, online application, or mobile application; or
4 (iv) Ensuring that the child or teen's personal
5 information remains deleted.
6 (e) Except as provided under � 4-88-1503 and � 4-88-1505, a violation
7 of subdivisions (b)(2) and (b)(3) of this section shall be treated as an
8 unfair or deceptive act or practice prescribed under the Deceptive Trade
9 Practices Act, � 4-88-101 et seq.
10
11 4-88-1504. Enforcement.
12 (a) In a case in which the Attorney General has reason to believe that
13 an interest of the residents of the state has been or is threatened or
14 adversely affected by the engagement of any person in a practice that
15 violates the provisions of this subchapter, the Attorney General may bring a
16 civil action on behalf of the residents of the state in a court of competent
17 jurisdiction to:
18 (1) Enjoin that practice;
19 (2) Enforce compliance with the rule;
20 (3) Obtain damages, restitution, or other compensation on behalf
21 of residents of the state; or
22 (4) Obtain other relief that the court finds appropriate.
23 (b)(1) The Attorney General shall have exclusive authority to enforce
24 this subchapter.
25 (2) Nothing in this subchapter provides the basis for, or
26 subjects an operator, processor, or person to a private right of action for a
27 violation of this subchapter or any other law.
28
29 4-88-1505. Construction.
30 This subchapter shall not be construed to require an operator to:
31 (1) Affirmatively collect any personal information regarding the
32 age of a child or teen that an operator is not already collecting in the
33 normal course of business; or
34 (2) Implement an age-gating or age verification functionality.
35
36 SECTION 2. DO NOT CODIFY. SEVERABILITY CLAUSE.
12 04-07-2025 14:27:20 LJH194
As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
1 If any provision of this act or the application of this act to any
2 person or circumstance is held invalid, the invalidity shall not affect other
3 provisions or applications of this act which can be given effect without the
4 invalid provision or application, and to this end, the provisions of this act
5 are declared severable.
6
7 SECTION 3. DO NOT CODIFY. EFFECTIVE DATE.
8 This act shall be effective on and after July 1, 2026.
9
10 /s/Gramlich
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
13 04-07-2025 14:27:20 LJH194Every fact on this page links to its source, starting with the official bill record.