Stricken language would be deleted from and underlined language would be added to present law.
*LJH194* 03/06/2025 3:05:16 PM LJH194
State of Arkansas 1
95th General Assembly A Bill 2
Regular Session, 2025 HOUSE BILL 1717 3
4
By: Representatives Gramlich, A. Collins, Springer 5
By: Senators J. Boyd, C. Tucker 6
7
For An Act To Be Entitled 8
AN ACT TO CREATE THE ARKANSAS CHILDREN AND TEENS' 9
ONLINE PRIVACY PROTECTION ACT; AND FOR OTHER 10
PURPOSES. 11
12
13
Subtitle 14
TO CREATE THE ARKANSAS CHILDREN AND 15
TEENS' ONLINE PRIVACY PROTECTION ACT. 16
17
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF ARKANSAS: 18
19
SECTION 1. Arkansas Code Title 4, Chapter 88, is amended to add an 20
additional subchapter to read as follows: 21
Subchapter 15 — Arkansas Children and Teens' Online Privacy Protection Act 22
23
4-88-1501. Title. 24
This subchapter shall be known and may be cited as the "Arkansas 25
Children and Teens' Online Privacy Protection Act". 26
27
4-88-1502. Definitions. 28
As used in this subchapter: 29
(1) "Child" means an individual twelve (12) years of age or 30
younger; 31
(2) "Connected device" means a device that is capable of 32
connecting to the Internet, directly or indirectly, or to another connected 33
device; 34
(3)(A) "Disclosure" means making personal information that is 35
collected from a child or teen by a website, online service, online 36 HB1717
2 03/06/2025 3:05:16 PM LJH194
application, or mobile application targeted toward children or teens or that 1
collect with actual knowledge the personal information from a child or teen, 2
publicly available in an identifiable form to a third party not affiliated 3
with the operator. 4
(B) "Disclosure" does not include information provided to 5
a person other than an operator who provides support for the internal 6
operations of the website, online service, online application, or mobile 7
application of the operator, excluding any activity related to individual -8
specific advertising to children or teens; 9
(4) "Internet" means collectively a system of interconnected 10
computer networks that comprise the interconnected world -wide network of 11
networks and employ without limitation the Transmission Control 12
Protocol/Internet Protocol, or any predecessor or successor protocols to such 13
protocol, or the User Datagram Protocol to communicate information of all 14
kinds by wire or radio; 15
(5) "Mobile application" means: 16
(A) A software program that runs on the operating system 17
of: 18
(i) A cellular telephone; 19
(ii) A tablet computer; or 20
(iii) A similar portable computing device that 21
transmits data over a wireless connection; and 22
(B) Includes without limitation a service or application 23
offered via a connected device; 24
(6) "Online application" means an Internet -connected software 25
program and includes without limitation a service or application offered via 26
a connected device; 27
(7) "Online contact information" means an email address or 28
another substantially similar identifier that permits direct contact with a 29
person online; 30
(8)(A)(i) "Operator" means a person who, for commercial 31
purposes, operates or provides a website on the internet, an online service, 32
an online application, or a mobile application, and who: 33
(ii)(a) Collects or maintains, either directly or 34
through a service provider, personal information from or about the users of 35
that website, service, or application; or 36 HB1717
3 03/06/2025 3:05:16 PM LJH194
(b) Allows another person to collect personal 1
information directly from users of that website, service, or application, in 2
which case, the operator is deemed to have collected the information. 3
(B) "Operator" does not include: 4
(i) Any nonprofit entity that would otherwise be 5
exempt from coverage under section 5 of the Federal Trade Commission Act, 15 6
U.S.C. § 45 et seq., as it existed on January 1, 2025; 7
(ii) An interactive gaming platform that complies 8
with the requirements of the Children's Online Privacy Act, 15 U.S.C. § 6501, 9
as it existed on January 1, 2025, and the rules, guidance, and exemptions 10
under that act, as it existed on January 1, 2025; 11
(iii) An agency, board, commission, institution, or 12
other instrumentality of the State of Arkansas or its political subdivisions; 13
or 14
(iv) A public educational entity of the State of 15
Arkansas, including without limitation a school district and an institution 16
of higher learning; 17
(9) "Parent" means a natural parent, adoptive parent, legal 18
guardian, or legal custodian of an individual who is sixteen (16) years of 19
age or younger; 20
(10) "Person" means any individual, partnership, corporation, 21
trust, estate, cooperative, association, or other entity; 22
(11)(A) "Personal information" means individually identifiable 23
information about an individual collected online, including without 24
limitation: 25
(i) A first and last name; 26
(ii) A home or other physical address including 27
street name and name of the city or town of residence; 28
(iii) An e-mail address; 29
(iv) A telephone number; 30
(v) A Social Security number; 31
(vi) Any other identifier that permits the physical 32
or online contacting of a specific individual; 33
(vii) Geolocation information sufficient to identify 34
a street name and a city or town; 35
(viii) Information generated from the measurement or 36 HB1717
4 03/06/2025 3:05:16 PM LJH194
technological processing of an individual's biological, physical, or 1
physiological characteristics that is used to identify an individual, 2
including without limitation: 3
(a) Fingerprints; 4
(b) Voice prints; 5
(c) Iris or retina imagery scans; 6
(d) Facial templates; 7
(e) Deoxyribonucleic acid (DNA) information; 8
or 9
(f) Gait; 10
(ix) Information linked or reasonably linkable to a 11
child or teen; or 12
(x) Information linked or reasonably linkable to a 13
child or teen or the parents of that child or teen, including without 14
limitation any unique identifier, that an operator collects online from the 15
child or teen and combines with an identifier described in this subdivision 16
(11)(A). 17
(B) "Personal information" does not include an audio file 18
that contains a child or teen’s voice so long as the operator: 19
(i) Does not request information via voice that 20
would otherwise be considered personal information under subdivision (11)(A) 21
of this section; 22
(ii) Provides clear notice of its collection and use 23
of the audio file and its deletion policy in its privacy policy; 24
(iii) Only uses the voice within the audio file 25
solely as a replacement for written words, to perform a task, or engage with 26
a website, online service, online application, or mobile application, such as 27
to perform a search or fulfill a verbal instruction or request; and 28
(iv) Only maintains the audio file long enough to 29
complete the stated purpose and then immediately deletes the audio file and 30
does not make any other use of the audio file prior to deletion; 31
(12)(A) "Social media platform" means a public or semipublic 32
Internet-based service or application that: 33
(i) Is used by a consumer in this state; 34
(ii) Is primarily intended to connect and allow 35
users to socially interact within that service or application; and 36 HB1717
5 03/06/2025 3:05:16 PM LJH194
(iii) Enables a user to: 1
(a) Construct a public or semipublic profile 2
for the purposes of signing into and using the service or application; 3
(b) Populate a public list of other users with 4
whom the user shares a social connection within that service or application; 5
and 6
(c) Create or post content that is viewable by 7
other users, including without limitation on message boards, in chat rooms, 8
or through a landing page or main feed that presents the user with content 9
that is generated by other users. 10
(B) "Social media platform" does not include a public or 11
semipublic Internet-based service or application that: 12
(i) Exclusively provides electronic mail or direct 13
messaging services; 14
(ii) Primarily consists of news, sports, 15
entertainment, interactive video games, electronic commerce, or content that 16
is preselected by the provider or for which any chat, comments, or 17
interactive functionality is incidental to, directly related to, or dependent 18
on the provision of that content; or 19
(iii) Is used by and under the direction of an 20
educational entity, including without limitation a learning management system 21
or a student engagement program; 22
(13)(A) "Targeted advertising" means displaying advertisements 23
to a consumer where the advertisement is selected based on personal data 24
obtained from that consumer's activities over time and across nonaffiliated 25
websites or online applications to predict that consumer's preferences or 26
interests. 27
(B) "Targeted advertising" does not include: 28
(i) Advertising based on activities within a 29
controller's own websites or online applications; 30
(ii) Advertising based on the context of a 31
consumer's current search query or visit to a website or online application; 32
(iii) Advertising directed to a consumer in response 33
to the consumer's request for information or feedback; or 34
(iv) Processing of personal data that is processed 35
solely for measuring or reporting advertising performance, reach, or 36 HB1717
6 03/06/2025 3:05:16 PM LJH194
frequency; 1
(14) "Teen" means an individual who is: 2
(A) Thirteen (13) years of age or older; and 3
(B) Younger than seventeen (17) years of age; and 4
(15) "Verifiable consent" means any reasonable effort, including 5
without limitation a request for authorization for future collection, use, 6
and disclosure described in the notice, to ensure that, in the case of a 7
child, a parent of the child, or, in the case of a teen, the teen: 8
(A) Receives specific notice of the personal information 9
collection, use, and disclosure practices of the operator; and 10
(B) Before the personal information of the child or teen 11
is collected, freely and unambiguously authorizes: 12
(i) The collection, use, and disclosure, as 13
applicable, of that personal information; and 14
(ii) Any subsequent use of that personal 15
information. 16
17
4-88-1503. Personal information from and about children and teens — 18
Online collection and use. 19
(a)(1) Except as provided in subdivision (a)(2) of this section, it 20
is unlawful for an operator of a website, online service, online application, 21
or mobile application directed to children or for any operator of a website, 22
online service, online application, or mobile application with actual 23
knowledge that it is collecting personal information from children or teens: 24
(A) To collect personal information from a child or teen 25
in a manner that violates subsection (b) of this section; 26
(B) To collect, use, disclose to third parties, or compile 27
personal information of a child or teen for purposes of targeted advertising 28
to children or teens, or to allow another person to collect, use, disclose, 29
or compile this information for targeted advertising to children or teens; 30
(C) To collect the personal information of a child or teen 31
except when the collection of the personal information is: 32
(i) Consistent with the context of a particular 33
service or the relationship of the child or teen with the operator, including 34
without limitation collection that is necessary to fulfill a transaction or 35
provide a product or service requested by the child or teen; or 36 HB1717
7 03/06/2025 3:05:16 PM LJH194
(ii) Required or specifically authorized by law; or 1
(D) To retain the personal information of a child or teen 2
for longer that is reasonably necessary to fulfill a transaction or provide a 3
service requested by the child or teen except as required for the safety or 4
integrity of the service or specifically authorized by law. 5
(2) Neither an operator nor the operator’s agent shall be liable 6
for a disclosure made in good faith and following reasonable procedures in 7
responding to a request for disclosure of personal information under 8
subdivision (b)(3)(A) of this section to the parent of a child or to a teen 9
under subdivision (b)(4)(A) of this section. 10
(b) An operator of a website, online service, online application, or 11
mobile application that has actual knowledge that it is collecting personal 12
information from children or teens shall: 13
(1) Provide clear and conspicuous notice of: 14
(A) What information is collected from children or teens 15
by the operator; 16
(B) The purpose for processing personal data; 17
(C) The operator’s disclosure practices for such 18
information; 19
(D) The rights and opportunities available to the parent 20
of the child or teen under subdivisions (b)(3) and (b)(4) of this section; 21
(E) The categories of personal data that the controller 22
shares with third parties, if any; and 23
(F) The categories of third parties, if any, with whom the 24
controller shares personal data; 25
(2) Obtain verifiable consent for the collection, use, or 26
disclosure of personal information from a child or teen from a: 27
(A) Parent or legal guardian of a child, except to the 28
extent the processing is permitted under 15 U.S.C. 6502, as it existed on 29
January 1, 2025, and its implementing regulations; or 30
(B) A teen, except when the processing is for: 31
(i) Providing or maintaining a specific product or 32
service requested by the teen; 33
(ii) Conducting the operator's internal business 34
operations, including without limitation identifying and repairing technical 35
errors that impair existing or intended functionality; 36 HB1717
8 03/06/2025 3:05:16 PM LJH194
(iii) Protecting against malicious, fraudulent, or 1
illegal activity or detecting, responding to, or preventing security 2
incidents or threats; 3
(iv) Investigating, establishing, exercising, 4
preparing for, or defending legal claims; 5
(v) Complying with federal, state, or local laws, 6
rules, or regulations; 7
(vi) Complying with a civil, criminal, or regulatory 8
inquiry, investigation, subpoena, or a summons by federal, state, local, or 9
other governmental authorities; or 10
(vii) Protecting the vital interests of a natural 11
person; 12
(3) Provide, upon request of a parent under this subsection (b) 13
whose child has provided personal information to that operator, upon proper 14
identification of that parent, to the parent: 15
(A)(i) A description of the specific categories of 16
personal information collected from the child by that operator; 17
(ii) The purposes for which the operator, collects, 18
uses, discloses, and retains the personal information; 19
(B) The opportunity to: 20
(i) Request at any time the deletion of the account 21
of the child or content or information submitted by the child to a website, 22
online service, online application, or mobile application and to refuse at 23
any time to permit the operator’s further use or maintenance in retrievable 24
form, or future online collection, of personal information from that child; 25
and 26
(ii) Challenge the accuracy of the personal 27
information and, if the parent of the child establishes the inaccuracy of the 28
personal information, to have the inaccurate personal information corrected; 29
and 30
(C) A means that is reasonable under the circumstances for 31
the parent to obtain any personal information collected from that child, if 32
that information is available to the operator at the time the parent makes 33
the request; 34
(4) Provide, upon the request of a teen under subdivision (b)(1) 35
of this section who has provided personal information to the operator and 36 HB1717
9 03/06/2025 3:05:16 PM LJH194
upon proper identification of that teen: 1
(A) A description of the specific categories of personal 2
information collected from the teen by the operator, the method by which the 3
operator obtained the personal information, and the purposes for which the 4
operator collects, uses, discloses, and retains the personal information; 5
(B) The opportunity at any time to delete personal 6
information collected from the teen or content or information submitted by 7
the teen to a website, online service, online application, or mobile 8
application; 9
(C) The opportunity to challenge the accuracy of the 10
personal information and, if the teen establishes the inaccuracy of the 11
personal information, to have the inaccurate personal information corrected; 12
and 13
(D) A means that is reasonable under the circumstances for 14
the teen to obtain any personal information collected from the teen, if the 15
information is available to the operator at the time the teen makes the 16
request; 17
(5) Not require a child to disclose more personal information 18
than is reasonably necessary to participate as a condition to participate in: 19
(A) A game; 20
(B) The offering of a prize; or 21
(C) Another activity; and 22
(6) Establish, implement, and maintain reasonable security 23
practices to protect the confidentiality, integrity, and accessibility of 24
personal information of children or teens collected by the operator, and 25
protect the personal information against unauthorized access. 26
(c) Verifiable consent under subdivision (b)(2)(A) of this section is 27
not required in the case of: 28
(1) Online contact information collected from a child or teen 29
that is used only to respond directly on a one -time basis to a specific 30
request from the child or teen and is not used to recontact the child or teen 31
or to contact another child or teen and is not maintained in retrievable form 32
by the operator; 33
(2) A request for the name or online contact information of a 34
parent or teen that is used for the sole purpose of obtaining verifiable 35
consent or providing notice under this section and where such information is 36 HB1717
10 03/06/2025 3:05:16 PM LJH194
not maintained in retrievable form by the operator if verifiable consent is 1
not obtained after a reasonable time; 2
(3) Online contact information collected from a child or teen 3
that is used only to respond more than once directly to a specific request 4
from the child or teen and is not used to recontact the child or teen beyond 5
the scope of that request if, before any additional response after the 6
initial response to the child or teen, the operator uses reasonable efforts 7
to provide a parent or teen notice of the online contact information 8
collected from the child or teen, the purposes for which it is to be used, 9
and an opportunity for the parent or teen to request that the operator make 10
no further use of the information and that it not be maintained in 11
retrievable form; and 12
(4) The name of the child or teen and online contact 13
information, to the extent reasonably necessary to protect the safety of a 14
child or teen participant on the site: 15
(A) Used only for the purpose of protecting such safety; 16
(B) Not used to recontact the child or teen or for any 17
other purpose; and 18
(C) Not disclosed on the site, if the operator uses 19
reasonable efforts to provide a parent or teen notice of the name and online 20
contact information collected from the child or teen, the purposes for which 21
it is to be used, and an opportunity for the parent or teen to request that 22
the operator make no further use of the information and that it not be 23
maintained in retrievable form; or 24
(5) The collection, use, or dissemination of such information by 25
the operator necessary to: 26
(A) Protect the security or integrity of its website; 27
(B) Take precautions against liability; 28
(C) Respond to judicial process; 29
(D) Protect the security or safety of the user on the 30
service; or 31
(E) Provide information to law enforcement agencies or for 32
an investigation on a matter related to public safety. 33
(d)(1) An operator may terminate service provided to a child whose 34
parent has refused or a teen who has refused under subdivision (b)(2) of this 35
section to permit the operator's further use or maintenance in retrievable 36 HB1717
11 03/06/2025 3:05:16 PM LJH194
form or future online collection of personal information from that child or 1
teen. 2
(2) An operator shall not discontinue service provided to a 3
child or teen on the basis of a request by the parent or the child or by the 4
teen under subdivision (b)(3)(B)(i) of this section to delete personal 5
information collected from the child or teen, to the extent that the operator 6
is capable of providing this service without the personal information. 7
(3) A request made under subdivisions (b)(3)(B)(i) of this 8
section to delete personal information of a child or teen shall not be 9
construed to: 10
(A) Limit the authority of a law enforcement agency to 11
obtain any content or information from an operator under a lawfully executed 12
warrant or an order of a court of competent jurisdiction; and 13
(B) Require an operator or third party to delete 14
information that: 15
(i) Another law requires the operator or third party 16
to maintain; 17
(ii) Was submitted to the website, online service, 18
online application, or mobile application of the operator by any person other 19
than the user who is attempting to erase or otherwise eliminate the content 20
or information, including without limitation content or information submitted 21
by the user that was republished or resubmitted by another person; or 22
(iii) Prohibit an operator from retaining a record 23
of the deletion request and the minimum information necessary for the 24
purposes of ensuring compliance with a request made under subsection (b) of 25
this section or ensuring that the child or teen's information remains 26
deleted. 27
(e) Except as provided under § 4 -88-1503 and § 4-88-1505, a violation 28
of subdivisions (b)(2) and (b)(3) of this section shall be treated as an 29
unfair or deceptive act or practice prescribed under the Deceptive Trade 30
Practices Act, § 4-88-101 et seq. 31
32
4-88-1504. Enforcement. 33
In a case in which the Attorney General has reason to believe that an 34
interest of the residents of the state has been or is threatened or adversely 35
affected by the engagement of any person in a practice that violates the 36 HB1717
12 03/06/2025 3:05:16 PM LJH194
provisions of this subchapter, the Attorney General may bring a civil action 1
on behalf of the residents of the state in a court of competent jurisdiction 2
to: 3
(1) Enjoin that practice; 4
(2) Enforce compliance with the rule; 5
(3) Obtain damages, restitution, or other compensation on behalf 6
of residents of the state; or 7
(4) Obtain such other relief as the court finds appropriate. 8
9
4-88-1505. Construction. 10
This subchapter shall not be construed to require an operator to: 11
(1) Affirmatively collect any personal information regarding the 12
age of a child or teen that an operator is not already collecting in the 13
normal course of business; or 14
(2) Implement an age -gating or age verification functionality. 15
16
SECTION 2. DO NOT CODIFY. EFFECTIVE DATE. 17
This act shall be effective on and after July 1, 2026. 18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36