| 1 | 1 | | Stricken language would be deleted from and underlined language would be added to present law. |
|---|
| 2 | 2 | | *LJH016* 01/13/2025 8:29:09 AM LJH016 |
|---|
| 3 | 3 | | State of Arkansas 1 |
|---|
| 4 | 4 | | 95th General Assembly A Bill 2 |
|---|
| 5 | 5 | | Regular Session, 2025 HOUSE BILL 1082 3 |
|---|
| 6 | 6 | | 4 |
|---|
| 7 | 7 | | By: Representatives A. Collins, Springer 5 |
|---|
| 8 | 8 | | 6 |
|---|
| 9 | 9 | | 7 |
|---|
| 10 | 10 | | For An Act To Be Entitled 8 |
|---|
| 11 | 11 | | AN ACT TO CREATE THE ARKANSAS CHILDREN AND TEENS’ 9 |
|---|
| 12 | 12 | | ONLINE PRIVACY PROTECTION ACT; AND FOR OTHER 10 |
|---|
| 13 | 13 | | PURPOSES. 11 |
|---|
| 14 | 14 | | 12 |
|---|
| 15 | 15 | | 13 |
|---|
| 16 | 16 | | Subtitle 14 |
|---|
| 17 | 17 | | TO CREATE THE ARKANSAS CHILDREN AND 15 |
|---|
| 18 | 18 | | TEENS’ ONLINE PRIVACY PROTECTION ACT. 16 |
|---|
| 19 | 19 | | 17 |
|---|
| 20 | 20 | | BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF ARKANSAS: 18 |
|---|
| 21 | 21 | | 19 |
|---|
| 22 | 22 | | SECTION 1. Arkansas Code Title 4, Chapter 88, is amended to add an 20 |
|---|
| 23 | 23 | | additional subchapter to read as follows: 21 |
|---|
| 24 | 24 | | Subchapter 15 — Arkansas Children and Teens' Online Privacy Protection Act 22 |
|---|
| 25 | 25 | | 23 |
|---|
| 26 | 26 | | 4-88-1501. Title. 24 |
|---|
| 27 | 27 | | This subchapter shall be known and may be cited as the "Arkansas 25 |
|---|
| 28 | 28 | | Children and Teens' Online Privacy Protection Act". 26 |
|---|
| 29 | 29 | | 27 |
|---|
| 30 | 30 | | 4-88-1502. Definitions. 28 |
|---|
| 31 | 31 | | As used in this subchapter: 29 |
|---|
| 32 | 32 | | (1) "Child" means an individual twelve (12) years of age or 30 |
|---|
| 33 | 33 | | younger; 31 |
|---|
| 34 | 34 | | (2) "Connected device" means a device that is capable of 32 |
|---|
| 35 | 35 | | connecting to the Internet, directly or indirectly, or to another connected 33 |
|---|
| 36 | 36 | | device; 34 |
|---|
| 37 | 37 | | (3) "Disclosure" means: 35 |
|---|
| 38 | 38 | | (A) The release of personal information collected from a 36 HB1082 |
|---|
| 39 | 39 | | |
|---|
| 40 | 40 | | 2 01/13/2025 8:29:09 AM LJH016 |
|---|
| 41 | 41 | | child or teen by an operator for any purpose, except where the personal 1 |
|---|
| 42 | 42 | | information is provided to a person other than an operator who: 2 |
|---|
| 43 | 43 | | (i) Provides support for the internal operations of 3 |
|---|
| 44 | 44 | | the website, online service, online application, or mobile application of the 4 |
|---|
| 45 | 45 | | operator, excluding any activity relating to individual -specific advertising 5 |
|---|
| 46 | 46 | | to children or teens; and 6 |
|---|
| 47 | 47 | | (ii) Does not disclose or use that personal 7 |
|---|
| 48 | 48 | | information for any other purpose; and 8 |
|---|
| 49 | 49 | | (B) Making personal information collected from a child or 9 |
|---|
| 50 | 50 | | teen by a website, online service, online application, or mobile application 10 |
|---|
| 51 | 51 | | directed to children or teens or with actual knowledge that such information 11 |
|---|
| 52 | 52 | | was collected from a child or teen, publicly available in identifiable form 12 |
|---|
| 53 | 53 | | by any means including by a public posting, through the Internet, or through: 13 |
|---|
| 54 | 54 | | (i) A homepage of a website; 14 |
|---|
| 55 | 55 | | (ii) A pen pal service; 15 |
|---|
| 56 | 56 | | (iii) An electronic mail service; 16 |
|---|
| 57 | 57 | | (iv) A message board; or 17 |
|---|
| 58 | 58 | | (v) A chat room; 18 |
|---|
| 59 | 59 | | (4)(A) "Individual-specific advertising to children or teens" 19 |
|---|
| 60 | 60 | | means advertising or any other effort to market a product or service that is 20 |
|---|
| 61 | 61 | | directed to a specific child or teen or a device that is linked or reasonably 21 |
|---|
| 62 | 62 | | linkable to a child or teen: 22 |
|---|
| 63 | 63 | | (i) Based on: 23 |
|---|
| 64 | 64 | | (a) The personal information of: 24 |
|---|
| 65 | 65 | | (1) The child or teen; or 25 |
|---|
| 66 | 66 | | (2) A group of children or teens who are 26 |
|---|
| 67 | 67 | | similar in sex, age, income level, race, or ethnicity to the specific child 27 |
|---|
| 68 | 68 | | or teen to whom the product or service is marketed; 28 |
|---|
| 69 | 69 | | (b) Psychological profiling of a child or teen 29 |
|---|
| 70 | 70 | | or group of children or teens; or 30 |
|---|
| 71 | 71 | | (c) A unique identifier of the device; or 31 |
|---|
| 72 | 72 | | (ii) As a result of use by the child or teen, access 32 |
|---|
| 73 | 73 | | by any device of the child or teen, or use by a group of children or teens 33 |
|---|
| 74 | 74 | | who are similar to the specific child or teen, of more than a single: 34 |
|---|
| 75 | 75 | | (a) Website; 35 |
|---|
| 76 | 76 | | (b) Online service; 36 HB1082 |
|---|
| 77 | 77 | | |
|---|
| 78 | 78 | | 3 01/13/2025 8:29:09 AM LJH016 |
|---|
| 79 | 79 | | (c) Online application; 1 |
|---|
| 80 | 80 | | (d) Mobile application; or 2 |
|---|
| 81 | 81 | | (e) Connected device. 3 |
|---|
| 82 | 82 | | (B) "Individual-specific advertising to children or teens" 4 |
|---|
| 83 | 83 | | does not include: 5 |
|---|
| 84 | 84 | | (i) Advertising or marketing to an individual or the 6 |
|---|
| 85 | 85 | | device of an individual in response to the individual’s specific request for 7 |
|---|
| 86 | 86 | | information or feedback, such as a child or teen's current search query; 8 |
|---|
| 87 | 87 | | (ii) Contextual advertising, such as when an 9 |
|---|
| 88 | 88 | | advertisement is displayed based on the content of the website, online 10 |
|---|
| 89 | 89 | | service, online application, mobile application, or connected device in which 11 |
|---|
| 90 | 90 | | the advertisement appears and does not vary based on personal information 12 |
|---|
| 91 | 91 | | related to the viewer; or 13 |
|---|
| 92 | 92 | | (iii) Processing personal information solely for 14 |
|---|
| 93 | 93 | | measuring or reporting advertising or content performance, reach, or 15 |
|---|
| 94 | 94 | | frequency, including independent measurement. 16 |
|---|
| 95 | 95 | | (C) Nothing in subdivision (4)(A) of this section shall be 17 |
|---|
| 96 | 96 | | construed to prohibit an operator with actual knowledge or knowledge fairly 18 |
|---|
| 97 | 97 | | implied on the basis of objective circumstances that an individual is sixteen 19 |
|---|
| 98 | 98 | | (16) years of age or younger from delivering advertising or marketing that is 20 |
|---|
| 99 | 99 | | age-appropriate and intended for a child or teen audience, so long as the 21 |
|---|
| 100 | 100 | | operator does not use any personal information other than whether the user is 22 |
|---|
| 101 | 101 | | age sixteen (16) or younger; 23 |
|---|
| 102 | 102 | | (5) "Internet" means collectively a system of interconnected 24 |
|---|
| 103 | 103 | | computer networks that comprise the interconnected world -wide network of 25 |
|---|
| 104 | 104 | | networks and employ without limitation the Transmission Control 26 |
|---|
| 105 | 105 | | Protocol/Internet Protocol, or any predecessor or successor protocols to such 27 |
|---|
| 106 | 106 | | protocol, or the User Datagram Protocol to communicate information of all 28 |
|---|
| 107 | 107 | | kinds by wire or radio; 29 |
|---|
| 108 | 108 | | (6) "Mobile application" means: 30 |
|---|
| 109 | 109 | | (A) A software program that runs on the operating system 31 |
|---|
| 110 | 110 | | of: 32 |
|---|
| 111 | 111 | | (i) A cellular telephone; 33 |
|---|
| 112 | 112 | | (ii) A tablet computer; or 34 |
|---|
| 113 | 113 | | (iii) A similar portable computing device that 35 |
|---|
| 114 | 114 | | transmits data over a wireless connection; and 36 HB1082 |
|---|
| 115 | 115 | | |
|---|
| 116 | 116 | | 4 01/13/2025 8:29:09 AM LJH016 |
|---|
| 117 | 117 | | (B) Includes without limitation a service or application 1 |
|---|
| 118 | 118 | | offered via a connected device; 2 |
|---|
| 119 | 119 | | (7) "Online application" means an Internet -connected software 3 |
|---|
| 120 | 120 | | program and includes without limitation a service or application offered via 4 |
|---|
| 121 | 121 | | a connected device; 5 |
|---|
| 122 | 122 | | (8) "Online contact information" means an email address or 6 |
|---|
| 123 | 123 | | another substantially similar identifier that permits direct contact with a 7 |
|---|
| 124 | 124 | | person online; 8 |
|---|
| 125 | 125 | | (9)(A)(i) "Operator" means a person who, for commercial 9 |
|---|
| 126 | 126 | | purposes, operates or provides a website on the internet, an online service, 10 |
|---|
| 127 | 127 | | an online application, or a mobile application, and who: 11 |
|---|
| 128 | 128 | | (ii)(a) Collects or maintains, either directly or 12 |
|---|
| 129 | 129 | | through a service provider, personal information from or about the users of 13 |
|---|
| 130 | 130 | | that website, service, or application; 14 |
|---|
| 131 | 131 | | (b) Allows another person to collect personal 15 |
|---|
| 132 | 132 | | information directly from users of that website, service, or application, in 16 |
|---|
| 133 | 133 | | which case, the operator is deemed to have collected the information; or 17 |
|---|
| 134 | 134 | | (c) Allows users of that website, service, or 18 |
|---|
| 135 | 135 | | application to publicly disclose personal information, in which case, the 19 |
|---|
| 136 | 136 | | operator is deemed to have collected the information. 20 |
|---|
| 137 | 137 | | (B) "Operator" does not include any nonprofit entity that 21 |
|---|
| 138 | 138 | | would otherwise be exempt from coverage under section 5 of the Federal Trade 22 |
|---|
| 139 | 139 | | Commission Act, 15 U.S.C. § 45 et seq., as it existed on January 1, 2025; 23 |
|---|
| 140 | 140 | | (10) "Parent" means a natural parent, adoptive parent, legal 24 |
|---|
| 141 | 141 | | guardian, or legal custodian of an individual who is sixteen (16) years of 25 |
|---|
| 142 | 142 | | age or younger; 26 |
|---|
| 143 | 143 | | (11) "Person" means any individual, partnership, corporation, 27 |
|---|
| 144 | 144 | | trust, estate, cooperative, association, or other entity; 28 |
|---|
| 145 | 145 | | (12)(A) "Personal information" means individually identifiable 29 |
|---|
| 146 | 146 | | information about an individual collected online, including without 30 |
|---|
| 147 | 147 | | limitation: 31 |
|---|
| 148 | 148 | | (i) A first and last name; 32 |
|---|
| 149 | 149 | | (ii) A home or other physical address including 33 |
|---|
| 150 | 150 | | street name and name of the city or town of residence; 34 |
|---|
| 151 | 151 | | (iii) An e-mail address; 35 |
|---|
| 152 | 152 | | (iv) A telephone number; 36 HB1082 |
|---|
| 153 | 153 | | |
|---|
| 154 | 154 | | 5 01/13/2025 8:29:09 AM LJH016 |
|---|
| 155 | 155 | | (v) A Social Security number; 1 |
|---|
| 156 | 156 | | (vi) Any other identifier that permits the physical 2 |
|---|
| 157 | 157 | | or online contacting of a specific individual; 3 |
|---|
| 158 | 158 | | (vii) Geolocation information sufficient to identify 4 |
|---|
| 159 | 159 | | a street name and a city or town; 5 |
|---|
| 160 | 160 | | (viii) Information generated from the measurement or 6 |
|---|
| 161 | 161 | | technological processing of an individual's biological, physical, or 7 |
|---|
| 162 | 162 | | physiological characteristics that is used to identify an individual, 8 |
|---|
| 163 | 163 | | including without limitation: 9 |
|---|
| 164 | 164 | | (a) Fingerprints; 10 |
|---|
| 165 | 165 | | (b) Voice prints; 11 |
|---|
| 166 | 166 | | (c) Iris or retina imagery scans; 12 |
|---|
| 167 | 167 | | (d) Facial templates; 13 |
|---|
| 168 | 168 | | (e) Deoxyribonucleic acid (DNA) information; 14 |
|---|
| 169 | 169 | | or 15 |
|---|
| 170 | 170 | | (f) Gait; 16 |
|---|
| 171 | 171 | | (ix) Information linked or reasonably linkable to a 17 |
|---|
| 172 | 172 | | child or teen; or 18 |
|---|
| 173 | 173 | | (x) Information linked or reasonably linkable to a 19 |
|---|
| 174 | 174 | | child or teen or the parents of that child or teen, including without 20 |
|---|
| 175 | 175 | | limitation any unique identifier, that an operator collects online from the 21 |
|---|
| 176 | 176 | | child or teen and combines with an identifier described in subdivision 22 |
|---|
| 177 | 177 | | (12)(A) of this section. 23 |
|---|
| 178 | 178 | | (B) "Personal information" does not include an audio file 24 |
|---|
| 179 | 179 | | that contains a child or teen’s voice so long as the operator: 25 |
|---|
| 180 | 180 | | (i) Does not request information via voice that 26 |
|---|
| 181 | 181 | | would otherwise be considered personal information under subdivision (12)(A) 27 |
|---|
| 182 | 182 | | of this section; 28 |
|---|
| 183 | 183 | | (ii) Provides clear notice of its collection and use 29 |
|---|
| 184 | 184 | | of the audio file and its deletion policy in its privacy policy; 30 |
|---|
| 185 | 185 | | (iii) Only uses the voice within the audio file 31 |
|---|
| 186 | 186 | | solely as a replacement for written words, to perform a task, or engage with 32 |
|---|
| 187 | 187 | | a website, online service, online application, or mobile application, such as 33 |
|---|
| 188 | 188 | | to perform a search or fulfill a verbal instruction or request; and 34 |
|---|
| 189 | 189 | | (iv) Only maintains the audio file long enough to 35 |
|---|
| 190 | 190 | | complete the stated purpose and then immediately deletes the audio file and 36 HB1082 |
|---|
| 191 | 191 | | |
|---|
| 192 | 192 | | 6 01/13/2025 8:29:09 AM LJH016 |
|---|
| 193 | 193 | | does not make any other use of the audio file prior to deletion; 1 |
|---|
| 194 | 194 | | (13) "Teen" means an individual who is: 2 |
|---|
| 195 | 195 | | (A) Thirteen (13) years of age or older; and 3 |
|---|
| 196 | 196 | | (B) Younger than seventeen (17) years of age; 4 |
|---|
| 197 | 197 | | (14) "Verifiable consent" means any reasonable effort, including 5 |
|---|
| 198 | 198 | | without limitation a request for authorization for future collection, use, 6 |
|---|
| 199 | 199 | | and disclosure described in the notice, to ensure that, in the case of a 7 |
|---|
| 200 | 200 | | child, a parent of the child, or, in the case of a teen, the teen: 8 |
|---|
| 201 | 201 | | (A) Receives specific notice of the personal information 9 |
|---|
| 202 | 202 | | collection, use, and disclosure practices of the operator; and 10 |
|---|
| 203 | 203 | | (B) Before the personal information of the child or teen 11 |
|---|
| 204 | 204 | | is collected, freely and unambiguously authorizes: 12 |
|---|
| 205 | 205 | | (i) The collection, use, and disclosure, as 13 |
|---|
| 206 | 206 | | applicable, of that personal information; and 14 |
|---|
| 207 | 207 | | (ii) Any subsequent use of that personal 15 |
|---|
| 208 | 208 | | information; and 16 |
|---|
| 209 | 209 | | (15) “Website, online service, online application, or mobile 17 |
|---|
| 210 | 210 | | application directed to children” means: 18 |
|---|
| 211 | 211 | | (A)(i) A commercial website, online service, online 19 |
|---|
| 212 | 212 | | application, or mobile application that is targeted to children; or 20 |
|---|
| 213 | 213 | | (ii) That portion of a commercial website, online 21 |
|---|
| 214 | 214 | | service, online application, or mobile application that is targeted to 22 |
|---|
| 215 | 215 | | children. 23 |
|---|
| 216 | 216 | | (B) A commercial website, online service, online 24 |
|---|
| 217 | 217 | | application, or mobile application, or a portion of a commercial website, 25 |
|---|
| 218 | 218 | | online service, online application, or mobile application, shall not be 26 |
|---|
| 219 | 219 | | deemed directed to children solely for referring or linking to a commercial 27 |
|---|
| 220 | 220 | | website, online service, online application, or mobile application directed 28 |
|---|
| 221 | 221 | | to children by using information location tools, including a directory, 29 |
|---|
| 222 | 222 | | index, reference, pointer, or hypertext link. 30 |
|---|
| 223 | 223 | | 31 |
|---|
| 224 | 224 | | 4-88-1503. Personal information from and about children and teens — 32 |
|---|
| 225 | 225 | | Online collection and use. 33 |
|---|
| 226 | 226 | | (a)(1) Except as provided in subdivision (a)(2) of this section, it 34 |
|---|
| 227 | 227 | | is unlawful for an operator of a website, online service, online application, 35 |
|---|
| 228 | 228 | | or mobile application directed to children or for any operator of a website, 36 HB1082 |
|---|
| 229 | 229 | | |
|---|
| 230 | 230 | | 7 01/13/2025 8:29:09 AM LJH016 |
|---|
| 231 | 231 | | online service, online application, or mobile application with actual 1 |
|---|
| 232 | 232 | | knowledge or knowledge fairly implied on the basis of objective 2 |
|---|
| 233 | 233 | | circumstances: 3 |
|---|
| 234 | 234 | | (A) To collect personal information from a child or teen 4 |
|---|
| 235 | 235 | | in a manner that violates subsection (b) of this section; 5 |
|---|
| 236 | 236 | | (B) To collect, use, disclose to third parties, or compile 6 |
|---|
| 237 | 237 | | personal information of a child or teen for purposes of individual -specific 7 |
|---|
| 238 | 238 | | advertising to children or teens, or to allow another person to collect, use, 8 |
|---|
| 239 | 239 | | disclose, or compile this information for individual -specific advertising to 9 |
|---|
| 240 | 240 | | children or teens; 10 |
|---|
| 241 | 241 | | (C) To collect the personal information of a child or teen 11 |
|---|
| 242 | 242 | | except when the collection of the personal information is: 12 |
|---|
| 243 | 243 | | (i) Consistent with the context of a particular 13 |
|---|
| 244 | 244 | | service or the relationship of the child or teen with the operator, including 14 |
|---|
| 245 | 245 | | without limitation collection that is necessary to fulfill a transaction or 15 |
|---|
| 246 | 246 | | provide a product or service requested by the child or teen; or 16 |
|---|
| 247 | 247 | | (ii) Required or specifically authorized by law; 17 |
|---|
| 248 | 248 | | (D) To store or transfer the personal information of a 18 |
|---|
| 249 | 249 | | child or teen of the United States unless the operator discloses to the child 19 |
|---|
| 250 | 250 | | or teen involved that his or her personal information is being stored or 20 |
|---|
| 251 | 251 | | transferred outside of the United States; or 21 |
|---|
| 252 | 252 | | (E) To retain the personal information of a child or teen 22 |
|---|
| 253 | 253 | | for longer that is reasonably necessary to fulfill a transaction or provide a 23 |
|---|
| 254 | 254 | | service requested by the child or teen except as required or specifically 24 |
|---|
| 255 | 255 | | authorized by law. 25 |
|---|
| 256 | 256 | | (2) Neither an operator nor the operator’s agent shall be liable 26 |
|---|
| 257 | 257 | | for a disclosure made in good faith and following reasonable procedures in 27 |
|---|
| 258 | 258 | | responding to a request for disclosure of personal information under 28 |
|---|
| 259 | 259 | | subdivision (b)(3)(A) of this section to the parent of a child or to a teen 29 |
|---|
| 260 | 260 | | under subdivision (b)(4)(A) of this section. 30 |
|---|
| 261 | 261 | | (b) An operator of a website, online service, online application, or 31 |
|---|
| 262 | 262 | | mobile application directed to children or that has actual knowledge or 32 |
|---|
| 263 | 263 | | knowledge fairly implied on the basis of objective circumstances that it is 33 |
|---|
| 264 | 264 | | collecting personal information from children or teens shall: 34 |
|---|
| 265 | 265 | | (1) Provide clear and conspicuous notice of: 35 |
|---|
| 266 | 266 | | (A) What information is collected from children or teens 36 HB1082 |
|---|
| 267 | 267 | | |
|---|
| 268 | 268 | | 8 01/13/2025 8:29:09 AM LJH016 |
|---|
| 269 | 269 | | by the operator; 1 |
|---|
| 270 | 270 | | (B) How the operator uses such information; 2 |
|---|
| 271 | 271 | | (C) The operator’s disclosure practices for such 3 |
|---|
| 272 | 272 | | information; 4 |
|---|
| 273 | 273 | | (D) The rights and opportunities available to the parent 5 |
|---|
| 274 | 274 | | of the child or teen under subdivisions (b)(3) and (b)(4) of this section; 6 |
|---|
| 275 | 275 | | and 7 |
|---|
| 276 | 276 | | (E) The procedures or mechanisms the operator uses to 8 |
|---|
| 277 | 277 | | ensure that personal information is not collected from children or teens 9 |
|---|
| 278 | 278 | | except under subsection (b) of this section; 10 |
|---|
| 279 | 279 | | (2) Obtain verifiable consent from a parent of a child or 11 |
|---|
| 280 | 280 | | consent from a teen: 12 |
|---|
| 281 | 281 | | (A) For the collection, use, or disclosure of personal 13 |
|---|
| 282 | 282 | | information from children or teens; and 14 |
|---|
| 283 | 283 | | (B) Before using or disclosing personal information of 15 |
|---|
| 284 | 284 | | the child or teen for any purpose that is a material change from the original 16 |
|---|
| 285 | 285 | | purposes and disclosure practices specified to the parent of the child or the 17 |
|---|
| 286 | 286 | | teen under subdivisions (b)(3) and (b)(4) of this section; 18 |
|---|
| 287 | 287 | | (3) Provide, upon request of a parent under this subsection (b) 19 |
|---|
| 288 | 288 | | whose child has provided personal information to that operator, upon proper 20 |
|---|
| 289 | 289 | | identification of that parent, to the parent: 21 |
|---|
| 290 | 290 | | (A)(i) A description of the specific types of personal 22 |
|---|
| 291 | 291 | | information collected from the child by that operator; 23 |
|---|
| 292 | 292 | | (ii) The method by which the operator obtained the 24 |
|---|
| 293 | 293 | | personal information; and 25 |
|---|
| 294 | 294 | | (iii) The purposes for which the operator, collects, 26 |
|---|
| 295 | 295 | | uses, discloses, and retains the personal information; and 27 |
|---|
| 296 | 296 | | (B) The opportunity to: 28 |
|---|
| 297 | 297 | | (i) Delete at any time personal information 29 |
|---|
| 298 | 298 | | collected from the child or content or information submitted by the child to 30 |
|---|
| 299 | 299 | | a website, online service, online application, or mobile application and to 31 |
|---|
| 300 | 300 | | refuse at any time to permit the operator’s further use or maintenance in 32 |
|---|
| 301 | 301 | | retrievable form, or future online collection, of personal information from 33 |
|---|
| 302 | 302 | | that child; and 34 |
|---|
| 303 | 303 | | (ii) Challenge the accuracy of the personal 35 |
|---|
| 304 | 304 | | information and, if the parent of the child establishes the inaccuracy of the 36 HB1082 |
|---|
| 305 | 305 | | |
|---|
| 306 | 306 | | 9 01/13/2025 8:29:09 AM LJH016 |
|---|
| 307 | 307 | | personal information, to have the inaccurate personal information corrected; 1 |
|---|
| 308 | 308 | | and 2 |
|---|
| 309 | 309 | | (C) A means that is reasonable under the circumstances for 3 |
|---|
| 310 | 310 | | the parent to obtain any personal information collected from that child, if 4 |
|---|
| 311 | 311 | | that information is available to the operator at the time the parent makes 5 |
|---|
| 312 | 312 | | the request; 6 |
|---|
| 313 | 313 | | (4) Provide, upon the request of a teen under subdivision (b)(1) 7 |
|---|
| 314 | 314 | | of this section who has provided personal information to the operator and 8 |
|---|
| 315 | 315 | | upon proper identification of that teen: 9 |
|---|
| 316 | 316 | | (A) A description of the specific types of personal 10 |
|---|
| 317 | 317 | | information collected from the teen by the operator, the method by which the 11 |
|---|
| 318 | 318 | | operator obtained the personal information, and the purposes for which the 12 |
|---|
| 319 | 319 | | operator collects, uses, discloses, and retains the personal information; 13 |
|---|
| 320 | 320 | | (B) The opportunity at any time to delete personal 14 |
|---|
| 321 | 321 | | information collected from the teen or content or information submitted by 15 |
|---|
| 322 | 322 | | the teen to a website, online service, online application, or mobile 16 |
|---|
| 323 | 323 | | application and to refuse further use or collection of personal information 17 |
|---|
| 324 | 324 | | from the teen; 18 |
|---|
| 325 | 325 | | (C) The opportunity to challenge the accuracy of the 19 |
|---|
| 326 | 326 | | personal information and, if the teen establishes the inaccuracy of the 20 |
|---|
| 327 | 327 | | personal information, to have the inaccurate personal information corrected; 21 |
|---|
| 328 | 328 | | and 22 |
|---|
| 329 | 329 | | (D) A means that is reasonable under the circumstances for 23 |
|---|
| 330 | 330 | | the teen to obtain any personal information collected from the teen, if the 24 |
|---|
| 331 | 331 | | information is available to the operator at the time the teen makes the 25 |
|---|
| 332 | 332 | | request; 26 |
|---|
| 333 | 333 | | (5) Not require a child to disclose more personal information 27 |
|---|
| 334 | 334 | | than is reasonably necessary to participate as a condition to participate in: 28 |
|---|
| 335 | 335 | | (A) A game; 29 |
|---|
| 336 | 336 | | (B) The offering of a prize; or 30 |
|---|
| 337 | 337 | | (C) Another activity; and 31 |
|---|
| 338 | 338 | | (6) Establish, implement, and maintain reasonable security 32 |
|---|
| 339 | 339 | | practices to protect the confidentiality, integrity, and accessibility of 33 |
|---|
| 340 | 340 | | personal information of children or teens collected by the operator, and 34 |
|---|
| 341 | 341 | | protect the personal information against unauthorized access. 35 |
|---|
| 342 | 342 | | (c) Verifiable consent under subdivision (b)(2)(A) of this section is 36 HB1082 |
|---|
| 343 | 343 | | |
|---|
| 344 | 344 | | 10 01/13/2025 8:29:09 AM LJH016 |
|---|
| 345 | 345 | | not required in the case of: 1 |
|---|
| 346 | 346 | | (1) Online contact information collected from a child or teen 2 |
|---|
| 347 | 347 | | that is used only to respond directly on a one -time basis to a specific 3 |
|---|
| 348 | 348 | | request from the child or teen and is not used to recontact the child or teen 4 |
|---|
| 349 | 349 | | or to contact another child or teen and is not maintained in retrievable form 5 |
|---|
| 350 | 350 | | by the operator; 6 |
|---|
| 351 | 351 | | (2) A request for the name or online contact information of a 7 |
|---|
| 352 | 352 | | parent or teen that is used for the sole purpose of obtaining verifiable 8 |
|---|
| 353 | 353 | | consent or providing notice under this section and where such information is 9 |
|---|
| 354 | 354 | | not maintained in retrievable form by the operator if verifiable consent is 10 |
|---|
| 355 | 355 | | not obtained after a reasonable time; 11 |
|---|
| 356 | 356 | | (3) Online contact information collected from a child or teen 12 |
|---|
| 357 | 357 | | that is used only to respond more than once directly to a specific request 13 |
|---|
| 358 | 358 | | from the child or teen and is not used to recontact the child or teen beyond 14 |
|---|
| 359 | 359 | | the scope of that request if, before any additional response after the 15 |
|---|
| 360 | 360 | | initial response to the child or teen, the operator uses reasonable efforts 16 |
|---|
| 361 | 361 | | to provide a parent or teen notice of the online contact information 17 |
|---|
| 362 | 362 | | collected from the child or teen, the purposes for which it is to be used, 18 |
|---|
| 363 | 363 | | and an opportunity for the parent or teen to request that the operator make 19 |
|---|
| 364 | 364 | | no further use of the information and that it not be maintained in 20 |
|---|
| 365 | 365 | | retrievable form; and 21 |
|---|
| 366 | 366 | | (4) The name of the child or teen and online contact 22 |
|---|
| 367 | 367 | | information, to the extent reasonably necessary to protect the safety of a 23 |
|---|
| 368 | 368 | | child or teen participant on the site: 24 |
|---|
| 369 | 369 | | (i) Used only for the purpose of protecting such safety; 25 |
|---|
| 370 | 370 | | (ii) Not used to recontact the child or teen or for any 26 |
|---|
| 371 | 371 | | other purpose; and 27 |
|---|
| 372 | 372 | | (iii) Not disclosed on the site, if the operator uses 28 |
|---|
| 373 | 373 | | reasonable efforts to provide a parent or teen notice of the name and online 29 |
|---|
| 374 | 374 | | contact information collected from the child or teen, the purposes for which 30 |
|---|
| 375 | 375 | | it is to be used, and an opportunity for the parent or teen to request that 31 |
|---|
| 376 | 376 | | the operator make no further use of the information and that it not be 32 |
|---|
| 377 | 377 | | maintained in retrievable form; or 33 |
|---|
| 378 | 378 | | (E) The collection, use, or dissemination of such information by 34 |
|---|
| 379 | 379 | | the operator necessary to: 35 |
|---|
| 380 | 380 | | (i) Protect the security or integrity of its website; 36 HB1082 |
|---|
| 381 | 381 | | |
|---|
| 382 | 382 | | 11 01/13/2025 8:29:09 AM LJH016 |
|---|
| 383 | 383 | | (ii) Take precautions against liability; 1 |
|---|
| 384 | 384 | | (iii) Respond to judicial process; or 2 |
|---|
| 385 | 385 | | (iv) Provide information to law enforcement agencies 3 |
|---|
| 386 | 386 | | or for an investigation on a matter related to public safety. 4 |
|---|
| 387 | 387 | | (d)(1) An operator may terminate service provided to a child whose 5 |
|---|
| 388 | 388 | | parent has refused or a teen who has refused under subdivision (b)(2) of this 6 |
|---|
| 389 | 389 | | section to permit the operator's further use or maintenance in retrievable 7 |
|---|
| 390 | 390 | | form or future online collection of personal information from that child or 8 |
|---|
| 391 | 391 | | teen. 9 |
|---|
| 392 | 392 | | (2) An operator shall not discontinue service provided to a 10 |
|---|
| 393 | 393 | | child or teen on the basis of a request by the parent or the child or by the 11 |
|---|
| 394 | 394 | | teen under subdivision (b)(3)(B)(i) of this section to delete personal 12 |
|---|
| 395 | 395 | | information collected from the child or teen, to the extent that the operator 13 |
|---|
| 396 | 396 | | is capable of providing this service without the personal information. 14 |
|---|
| 397 | 397 | | (3) A request made under subdivisions (b)(3)(B)(i) of this 15 |
|---|
| 398 | 398 | | section to delete personal information of a child or teen shall not be 16 |
|---|
| 399 | 399 | | construed to: 17 |
|---|
| 400 | 400 | | (A) Limit the authority of a law enforcement agency to 18 |
|---|
| 401 | 401 | | obtain any content or information from an operator under a lawfully executed 19 |
|---|
| 402 | 402 | | warrant or an order of a court of competent jurisdiction; and 20 |
|---|
| 403 | 403 | | (B) Require an operator or third party to delete 21 |
|---|
| 404 | 404 | | information that: 22 |
|---|
| 405 | 405 | | (i) Another law requires the operator or third party 23 |
|---|
| 406 | 406 | | to maintain; 24 |
|---|
| 407 | 407 | | (ii) Was submitted to the website, online service, 25 |
|---|
| 408 | 408 | | online application, or mobile application of the operator by any person other 26 |
|---|
| 409 | 409 | | than the user who is attempting to erase or otherwise eliminate the content 27 |
|---|
| 410 | 410 | | or information, including without limitation content or information submitted 28 |
|---|
| 411 | 411 | | by the user that was republished or resubmitted by another person; or 29 |
|---|
| 412 | 412 | | (iii) Prohibit an operator from retaining a record 30 |
|---|
| 413 | 413 | | of the deletion request and the minimum information necessary for the 31 |
|---|
| 414 | 414 | | purposes of ensuring compliance with a request made under subsection (b) of 32 |
|---|
| 415 | 415 | | this section or ensuring that the child or teen's information remains 33 |
|---|
| 416 | 416 | | deleted. 34 |
|---|
| 417 | 417 | | (e) Except as provided under § 4 -88-1503 and § 4-88-1505, a violation 35 |
|---|
| 418 | 418 | | of subdivisions (b)(2) and (b)(3) of this section shall be treated as an 36 HB1082 |
|---|
| 419 | 419 | | |
|---|
| 420 | 420 | | 12 01/13/2025 8:29:09 AM LJH016 |
|---|
| 421 | 421 | | unfair or deceptive act or practice prescribed under the Deceptive Trade 1 |
|---|
| 422 | 422 | | Practices Act, § 4-88-101 et seq. 2 |
|---|
| 423 | 423 | | 3 |
|---|
| 424 | 424 | | 4-88-1504. Enforcement. 4 |
|---|
| 425 | 425 | | In a case in which the Attorney General has reason to believe that an 5 |
|---|
| 426 | 426 | | interest of the residents of the state has been or is threatened or adversely 6 |
|---|
| 427 | 427 | | affected by the engagement of any person in a practice that violates the 7 |
|---|
| 428 | 428 | | provisions of this subchapter, the Attorney General may bring a civil action 8 |
|---|
| 429 | 429 | | on behalf of the residents of the state in a court of competent jurisdiction 9 |
|---|
| 430 | 430 | | to: 10 |
|---|
| 431 | 431 | | (1) Enjoin that practice; 11 |
|---|
| 432 | 432 | | (2) Enforce compliance with the rule; 12 |
|---|
| 433 | 433 | | (3) Obtain damages, restitution, or other compensation on behalf 13 |
|---|
| 434 | 434 | | of residents of the state; or 14 |
|---|
| 435 | 435 | | (4) Obtain such other relief as the court finds appropriate. 15 |
|---|
| 436 | 436 | | 16 |
|---|
| 437 | 437 | | 4-88-1505. Construction. 17 |
|---|
| 438 | 438 | | (1) For purposes of enforcing this subchapter, in making a 18 |
|---|
| 439 | 439 | | determination as to whether an operator has knowledge fairly implied on the 19 |
|---|
| 440 | 440 | | basis of objective circumstances that a user is a child or teen, the Attorney 20 |
|---|
| 441 | 441 | | General shall rely on competent and reliable empirical evidence, taking into 21 |
|---|
| 442 | 442 | | account the totality of the circumstances, including without limitation 22 |
|---|
| 443 | 443 | | consideration of whether the operator, using available technology, exercised 23 |
|---|
| 444 | 444 | | reasonable care. 24 |
|---|
| 445 | 445 | | (2) Nothing in this subchapter shall be construed to require an 25 |
|---|
| 446 | 446 | | operator to: 26 |
|---|
| 447 | 447 | | (A) Affirmatively collect any personal information regarding the 27 |
|---|
| 448 | 448 | | age of a child or teen that an operator is not already collecting in the 28 |
|---|
| 449 | 449 | | normal course of business; or 29 |
|---|
| 450 | 450 | | (B) Implement an age gating or age verification functionality. 30 |
|---|
| 451 | 451 | | 31 |
|---|
| 452 | 452 | | 32 |
|---|
| 453 | 453 | | 33 |
|---|
| 454 | 454 | | 34 |
|---|
| 455 | 455 | | 35 |
|---|
| 456 | 456 | | 36 |
|---|