Stricken language would be deleted from and underlined language would be added to present law.
*LJH016* 01/13/2025 8:29:09 AM LJH016
State of Arkansas 1
95th General Assembly A Bill 2
Regular Session, 2025 HOUSE BILL 1082 3
4
By: Representatives A. Collins, Springer 5
6
7
For An Act To Be Entitled 8
AN ACT TO CREATE THE ARKANSAS CHILDREN AND TEENS’ 9
ONLINE PRIVACY PROTECTION ACT; AND FOR OTHER 10
PURPOSES. 11
12
13
Subtitle 14
TO CREATE THE ARKANSAS CHILDREN AND 15
TEENS’ ONLINE PRIVACY PROTECTION ACT. 16
17
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF ARKANSAS: 18
19
SECTION 1. Arkansas Code Title 4, Chapter 88, is amended to add an 20
additional subchapter to read as follows: 21
Subchapter 15 — Arkansas Children and Teens' Online Privacy Protection Act 22
23
4-88-1501. Title. 24
This subchapter shall be known and may be cited as the "Arkansas 25
Children and Teens' Online Privacy Protection Act". 26
27
4-88-1502. Definitions. 28
As used in this subchapter: 29
(1) "Child" means an individual twelve (12) years of age or 30
younger; 31
(2) "Connected device" means a device that is capable of 32
connecting to the Internet, directly or indirectly, or to another connected 33
device; 34
(3) "Disclosure" means: 35
(A) The release of personal information collected from a 36 HB1082
2 01/13/2025 8:29:09 AM LJH016
child or teen by an operator for any purpose, except where the personal 1
information is provided to a person other than an operator who: 2
(i) Provides support for the internal operations of 3
the website, online service, online application, or mobile application of the 4
operator, excluding any activity relating to individual -specific advertising 5
to children or teens; and 6
(ii) Does not disclose or use that personal 7
information for any other purpose; and 8
(B) Making personal information collected from a child or 9
teen by a website, online service, online application, or mobile application 10
directed to children or teens or with actual knowledge that such information 11
was collected from a child or teen, publicly available in identifiable form 12
by any means including by a public posting, through the Internet, or through: 13
(i) A homepage of a website; 14
(ii) A pen pal service; 15
(iii) An electronic mail service; 16
(iv) A message board; or 17
(v) A chat room; 18
(4)(A) "Individual-specific advertising to children or teens" 19
means advertising or any other effort to market a product or service that is 20
directed to a specific child or teen or a device that is linked or reasonably 21
linkable to a child or teen: 22
(i) Based on: 23
(a) The personal information of: 24
(1) The child or teen; or 25
(2) A group of children or teens who are 26
similar in sex, age, income level, race, or ethnicity to the specific child 27
or teen to whom the product or service is marketed; 28
(b) Psychological profiling of a child or teen 29
or group of children or teens; or 30
(c) A unique identifier of the device; or 31
(ii) As a result of use by the child or teen, access 32
by any device of the child or teen, or use by a group of children or teens 33
who are similar to the specific child or teen, of more than a single: 34
(a) Website; 35
(b) Online service; 36 HB1082
3 01/13/2025 8:29:09 AM LJH016
(c) Online application; 1
(d) Mobile application; or 2
(e) Connected device. 3
(B) "Individual-specific advertising to children or teens" 4
does not include: 5
(i) Advertising or marketing to an individual or the 6
device of an individual in response to the individual’s specific request for 7
information or feedback, such as a child or teen's current search query; 8
(ii) Contextual advertising, such as when an 9
advertisement is displayed based on the content of the website, online 10
service, online application, mobile application, or connected device in which 11
the advertisement appears and does not vary based on personal information 12
related to the viewer; or 13
(iii) Processing personal information solely for 14
measuring or reporting advertising or content performance, reach, or 15
frequency, including independent measurement. 16
(C) Nothing in subdivision (4)(A) of this section shall be 17
construed to prohibit an operator with actual knowledge or knowledge fairly 18
implied on the basis of objective circumstances that an individual is sixteen 19
(16) years of age or younger from delivering advertising or marketing that is 20
age-appropriate and intended for a child or teen audience, so long as the 21
operator does not use any personal information other than whether the user is 22
age sixteen (16) or younger; 23
(5) "Internet" means collectively a system of interconnected 24
computer networks that comprise the interconnected world -wide network of 25
networks and employ without limitation the Transmission Control 26
Protocol/Internet Protocol, or any predecessor or successor protocols to such 27
protocol, or the User Datagram Protocol to communicate information of all 28
kinds by wire or radio; 29
(6) "Mobile application" means: 30
(A) A software program that runs on the operating system 31
of: 32
(i) A cellular telephone; 33
(ii) A tablet computer; or 34
(iii) A similar portable computing device that 35
transmits data over a wireless connection; and 36 HB1082
4 01/13/2025 8:29:09 AM LJH016
(B) Includes without limitation a service or application 1
offered via a connected device; 2
(7) "Online application" means an Internet -connected software 3
program and includes without limitation a service or application offered via 4
a connected device; 5
(8) "Online contact information" means an email address or 6
another substantially similar identifier that permits direct contact with a 7
person online; 8
(9)(A)(i) "Operator" means a person who, for commercial 9
purposes, operates or provides a website on the internet, an online service, 10
an online application, or a mobile application, and who: 11
(ii)(a) Collects or maintains, either directly or 12
through a service provider, personal information from or about the users of 13
that website, service, or application; 14
(b) Allows another person to collect personal 15
information directly from users of that website, service, or application, in 16
which case, the operator is deemed to have collected the information; or 17
(c) Allows users of that website, service, or 18
application to publicly disclose personal information, in which case, the 19
operator is deemed to have collected the information. 20
(B) "Operator" does not include any nonprofit entity that 21
would otherwise be exempt from coverage under section 5 of the Federal Trade 22
Commission Act, 15 U.S.C. § 45 et seq., as it existed on January 1, 2025; 23
(10) "Parent" means a natural parent, adoptive parent, legal 24
guardian, or legal custodian of an individual who is sixteen (16) years of 25
age or younger; 26
(11) "Person" means any individual, partnership, corporation, 27
trust, estate, cooperative, association, or other entity; 28
(12)(A) "Personal information" means individually identifiable 29
information about an individual collected online, including without 30
limitation: 31
(i) A first and last name; 32
(ii) A home or other physical address including 33
street name and name of the city or town of residence; 34
(iii) An e-mail address; 35
(iv) A telephone number; 36 HB1082
5 01/13/2025 8:29:09 AM LJH016
(v) A Social Security number; 1
(vi) Any other identifier that permits the physical 2
or online contacting of a specific individual; 3
(vii) Geolocation information sufficient to identify 4
a street name and a city or town; 5
(viii) Information generated from the measurement or 6
technological processing of an individual's biological, physical, or 7
physiological characteristics that is used to identify an individual, 8
including without limitation: 9
(a) Fingerprints; 10
(b) Voice prints; 11
(c) Iris or retina imagery scans; 12
(d) Facial templates; 13
(e) Deoxyribonucleic acid (DNA) information; 14
or 15
(f) Gait; 16
(ix) Information linked or reasonably linkable to a 17
child or teen; or 18
(x) Information linked or reasonably linkable to a 19
child or teen or the parents of that child or teen, including without 20
limitation any unique identifier, that an operator collects online from the 21
child or teen and combines with an identifier described in subdivision 22
(12)(A) of this section. 23
(B) "Personal information" does not include an audio file 24
that contains a child or teen’s voice so long as the operator: 25
(i) Does not request information via voice that 26
would otherwise be considered personal information under subdivision (12)(A) 27
of this section; 28
(ii) Provides clear notice of its collection and use 29
of the audio file and its deletion policy in its privacy policy; 30
(iii) Only uses the voice within the audio file 31
solely as a replacement for written words, to perform a task, or engage with 32
a website, online service, online application, or mobile application, such as 33
to perform a search or fulfill a verbal instruction or request; and 34
(iv) Only maintains the audio file long enough to 35
complete the stated purpose and then immediately deletes the audio file and 36 HB1082
6 01/13/2025 8:29:09 AM LJH016
does not make any other use of the audio file prior to deletion; 1
(13) "Teen" means an individual who is: 2
(A) Thirteen (13) years of age or older; and 3
(B) Younger than seventeen (17) years of age; 4
(14) "Verifiable consent" means any reasonable effort, including 5
without limitation a request for authorization for future collection, use, 6
and disclosure described in the notice, to ensure that, in the case of a 7
child, a parent of the child, or, in the case of a teen, the teen: 8
(A) Receives specific notice of the personal information 9
collection, use, and disclosure practices of the operator; and 10
(B) Before the personal information of the child or teen 11
is collected, freely and unambiguously authorizes: 12
(i) The collection, use, and disclosure, as 13
applicable, of that personal information; and 14
(ii) Any subsequent use of that personal 15
information; and 16
(15) “Website, online service, online application, or mobile 17
application directed to children” means: 18
(A)(i) A commercial website, online service, online 19
application, or mobile application that is targeted to children; or 20
(ii) That portion of a commercial website, online 21
service, online application, or mobile application that is targeted to 22
children. 23
(B) A commercial website, online service, online 24
application, or mobile application, or a portion of a commercial website, 25
online service, online application, or mobile application, shall not be 26
deemed directed to children solely for referring or linking to a commercial 27
website, online service, online application, or mobile application directed 28
to children by using information location tools, including a directory, 29
index, reference, pointer, or hypertext link. 30
31
4-88-1503. Personal information from and about children and teens — 32
Online collection and use. 33
(a)(1) Except as provided in subdivision (a)(2) of this section, it 34
is unlawful for an operator of a website, online service, online application, 35
or mobile application directed to children or for any operator of a website, 36 HB1082
7 01/13/2025 8:29:09 AM LJH016
online service, online application, or mobile application with actual 1
knowledge or knowledge fairly implied on the basis of objective 2
circumstances: 3
(A) To collect personal information from a child or teen 4
in a manner that violates subsection (b) of this section; 5
(B) To collect, use, disclose to third parties, or compile 6
personal information of a child or teen for purposes of individual -specific 7
advertising to children or teens, or to allow another person to collect, use, 8
disclose, or compile this information for individual -specific advertising to 9
children or teens; 10
(C) To collect the personal information of a child or teen 11
except when the collection of the personal information is: 12
(i) Consistent with the context of a particular 13
service or the relationship of the child or teen with the operator, including 14
without limitation collection that is necessary to fulfill a transaction or 15
provide a product or service requested by the child or teen; or 16
(ii) Required or specifically authorized by law; 17
(D) To store or transfer the personal information of a 18
child or teen of the United States unless the operator discloses to the child 19
or teen involved that his or her personal information is being stored or 20
transferred outside of the United States; or 21
(E) To retain the personal information of a child or teen 22
for longer that is reasonably necessary to fulfill a transaction or provide a 23
service requested by the child or teen except as required or specifically 24
authorized by law. 25
(2) Neither an operator nor the operator’s agent shall be liable 26
for a disclosure made in good faith and following reasonable procedures in 27
responding to a request for disclosure of personal information under 28
subdivision (b)(3)(A) of this section to the parent of a child or to a teen 29
under subdivision (b)(4)(A) of this section. 30
(b) An operator of a website, online service, online application, or 31
mobile application directed to children or that has actual knowledge or 32
knowledge fairly implied on the basis of objective circumstances that it is 33
collecting personal information from children or teens shall: 34
(1) Provide clear and conspicuous notice of: 35
(A) What information is collected from children or teens 36 HB1082
8 01/13/2025 8:29:09 AM LJH016
by the operator; 1
(B) How the operator uses such information; 2
(C) The operator’s disclosure practices for such 3
information; 4
(D) The rights and opportunities available to the parent 5
of the child or teen under subdivisions (b)(3) and (b)(4) of this section; 6
and 7
(E) The procedures or mechanisms the operator uses to 8
ensure that personal information is not collected from children or teens 9
except under subsection (b) of this section; 10
(2) Obtain verifiable consent from a parent of a child or 11
consent from a teen: 12
(A) For the collection, use, or disclosure of personal 13
information from children or teens; and 14
(B) Before using or disclosing personal information of 15
the child or teen for any purpose that is a material change from the original 16
purposes and disclosure practices specified to the parent of the child or the 17
teen under subdivisions (b)(3) and (b)(4) of this section; 18
(3) Provide, upon request of a parent under this subsection (b) 19
whose child has provided personal information to that operator, upon proper 20
identification of that parent, to the parent: 21
(A)(i) A description of the specific types of personal 22
information collected from the child by that operator; 23
(ii) The method by which the operator obtained the 24
personal information; and 25
(iii) The purposes for which the operator, collects, 26
uses, discloses, and retains the personal information; and 27
(B) The opportunity to: 28
(i) Delete at any time personal information 29
collected from the child or content or information submitted by the child to 30
a website, online service, online application, or mobile application and to 31
refuse at any time to permit the operator’s further use or maintenance in 32
retrievable form, or future online collection, of personal information from 33
that child; and 34
(ii) Challenge the accuracy of the personal 35
information and, if the parent of the child establishes the inaccuracy of the 36 HB1082
9 01/13/2025 8:29:09 AM LJH016
personal information, to have the inaccurate personal information corrected; 1
and 2
(C) A means that is reasonable under the circumstances for 3
the parent to obtain any personal information collected from that child, if 4
that information is available to the operator at the time the parent makes 5
the request; 6
(4) Provide, upon the request of a teen under subdivision (b)(1) 7
of this section who has provided personal information to the operator and 8
upon proper identification of that teen: 9
(A) A description of the specific types of personal 10
information collected from the teen by the operator, the method by which the 11
operator obtained the personal information, and the purposes for which the 12
operator collects, uses, discloses, and retains the personal information; 13
(B) The opportunity at any time to delete personal 14
information collected from the teen or content or information submitted by 15
the teen to a website, online service, online application, or mobile 16
application and to refuse further use or collection of personal information 17
from the teen; 18
(C) The opportunity to challenge the accuracy of the 19
personal information and, if the teen establishes the inaccuracy of the 20
personal information, to have the inaccurate personal information corrected; 21
and 22
(D) A means that is reasonable under the circumstances for 23
the teen to obtain any personal information collected from the teen, if the 24
information is available to the operator at the time the teen makes the 25
request; 26
(5) Not require a child to disclose more personal information 27
than is reasonably necessary to participate as a condition to participate in: 28
(A) A game; 29
(B) The offering of a prize; or 30
(C) Another activity; and 31
(6) Establish, implement, and maintain reasonable security 32
practices to protect the confidentiality, integrity, and accessibility of 33
personal information of children or teens collected by the operator, and 34
protect the personal information against unauthorized access. 35
(c) Verifiable consent under subdivision (b)(2)(A) of this section is 36 HB1082
10 01/13/2025 8:29:09 AM LJH016
not required in the case of: 1
(1) Online contact information collected from a child or teen 2
that is used only to respond directly on a one -time basis to a specific 3
request from the child or teen and is not used to recontact the child or teen 4
or to contact another child or teen and is not maintained in retrievable form 5
by the operator; 6
(2) A request for the name or online contact information of a 7
parent or teen that is used for the sole purpose of obtaining verifiable 8
consent or providing notice under this section and where such information is 9
not maintained in retrievable form by the operator if verifiable consent is 10
not obtained after a reasonable time; 11
(3) Online contact information collected from a child or teen 12
that is used only to respond more than once directly to a specific request 13
from the child or teen and is not used to recontact the child or teen beyond 14
the scope of that request if, before any additional response after the 15
initial response to the child or teen, the operator uses reasonable efforts 16
to provide a parent or teen notice of the online contact information 17
collected from the child or teen, the purposes for which it is to be used, 18
and an opportunity for the parent or teen to request that the operator make 19
no further use of the information and that it not be maintained in 20
retrievable form; and 21
(4) The name of the child or teen and online contact 22
information, to the extent reasonably necessary to protect the safety of a 23
child or teen participant on the site: 24
(i) Used only for the purpose of protecting such safety; 25
(ii) Not used to recontact the child or teen or for any 26
other purpose; and 27
(iii) Not disclosed on the site, if the operator uses 28
reasonable efforts to provide a parent or teen notice of the name and online 29
contact information collected from the child or teen, the purposes for which 30
it is to be used, and an opportunity for the parent or teen to request that 31
the operator make no further use of the information and that it not be 32
maintained in retrievable form; or 33
(E) The collection, use, or dissemination of such information by 34
the operator necessary to: 35
(i) Protect the security or integrity of its website; 36 HB1082
11 01/13/2025 8:29:09 AM LJH016
(ii) Take precautions against liability; 1
(iii) Respond to judicial process; or 2
(iv) Provide information to law enforcement agencies 3
or for an investigation on a matter related to public safety. 4
(d)(1) An operator may terminate service provided to a child whose 5
parent has refused or a teen who has refused under subdivision (b)(2) of this 6
section to permit the operator's further use or maintenance in retrievable 7
form or future online collection of personal information from that child or 8
teen. 9
(2) An operator shall not discontinue service provided to a 10
child or teen on the basis of a request by the parent or the child or by the 11
teen under subdivision (b)(3)(B)(i) of this section to delete personal 12
information collected from the child or teen, to the extent that the operator 13
is capable of providing this service without the personal information. 14
(3) A request made under subdivisions (b)(3)(B)(i) of this 15
section to delete personal information of a child or teen shall not be 16
construed to: 17
(A) Limit the authority of a law enforcement agency to 18
obtain any content or information from an operator under a lawfully executed 19
warrant or an order of a court of competent jurisdiction; and 20
(B) Require an operator or third party to delete 21
information that: 22
(i) Another law requires the operator or third party 23
to maintain; 24
(ii) Was submitted to the website, online service, 25
online application, or mobile application of the operator by any person other 26
than the user who is attempting to erase or otherwise eliminate the content 27
or information, including without limitation content or information submitted 28
by the user that was republished or resubmitted by another person; or 29
(iii) Prohibit an operator from retaining a record 30
of the deletion request and the minimum information necessary for the 31
purposes of ensuring compliance with a request made under subsection (b) of 32
this section or ensuring that the child or teen's information remains 33
deleted. 34
(e) Except as provided under § 4 -88-1503 and § 4-88-1505, a violation 35
of subdivisions (b)(2) and (b)(3) of this section shall be treated as an 36 HB1082
12 01/13/2025 8:29:09 AM LJH016
unfair or deceptive act or practice prescribed under the Deceptive Trade 1
Practices Act, § 4-88-101 et seq. 2
3
4-88-1504. Enforcement. 4
In a case in which the Attorney General has reason to believe that an 5
interest of the residents of the state has been or is threatened or adversely 6
affected by the engagement of any person in a practice that violates the 7
provisions of this subchapter, the Attorney General may bring a civil action 8
on behalf of the residents of the state in a court of competent jurisdiction 9
to: 10
(1) Enjoin that practice; 11
(2) Enforce compliance with the rule; 12
(3) Obtain damages, restitution, or other compensation on behalf 13
of residents of the state; or 14
(4) Obtain such other relief as the court finds appropriate. 15
16
4-88-1505. Construction. 17
(1) For purposes of enforcing this subchapter, in making a 18
determination as to whether an operator has knowledge fairly implied on the 19
basis of objective circumstances that a user is a child or teen, the Attorney 20
General shall rely on competent and reliable empirical evidence, taking into 21
account the totality of the circumstances, including without limitation 22
consideration of whether the operator, using available technology, exercised 23
reasonable care. 24
(2) Nothing in this subchapter shall be construed to require an 25
operator to: 26
(A) Affirmatively collect any personal information regarding the 27
age of a child or teen that an operator is not already collecting in the 28
normal course of business; or 29
(B) Implement an age gating or age verification functionality. 30
31
32
33
34
35
36