Arkansas 2025 Regular Session

Arkansas House Bill HB1717 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1		Stricken language would be deleted from and underlined language would be added to present law.
2		-	Act 952 of the Regular Session
3		-	LJH194 04-07-2025 14:27:20 LJH194
4		-
5		-	State of Arkansas As Engrossed: S3/31/25 S4/2/25 S4/7/25 1
	2	+	LJH194 03/06/2025 3:05:16 PM LJH194
	3	+	State of Arkansas 1
6	4		95th General Assembly A Bill 2
7	5		Regular Session, 2025 HOUSE BILL 1717 3
8	6		4
9		-	By: Representatives Gramlich, A. Collins, Springer~~, Bentley, A. Brown, Walker, Achor~~ 5
	7	+	By: Representatives Gramlich, A. Collins, Springer 5
10	8		By: Senators J. Boyd, C. Tucker 6
11	9		7
12	10		For An Act To Be Entitled 8
13	11		AN ACT TO CREATE THE ARKANSAS CHILDREN AND TEENS' 9
14	12		ONLINE PRIVACY PROTECTION ACT; AND FOR OTHER 10
15	13		PURPOSES. 11
16	14		12
17	15		13
18	16		Subtitle 14
19	17		TO CREATE THE ARKANSAS CHILDREN AND 15
20	18		TEENS' ONLINE PRIVACY PROTECTION ACT. 16
21	19		17
22	20		BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF ARKANSAS: 18
23	21		19
24	22		SECTION 1. Arkansas Code Title 4, Chapter 88, is amended to add an 20
25	23		additional subchapter to read as follows: 21
26	24		Subchapter 15 — Arkansas Children and Teens' Online Privacy Protection Act 22
27	25		23
28	26		4-88-1501. Title. 24
29	27		This subchapter shall be known and may be cited as the "Arkansas 25
30	28		Children and Teens' Online Privacy Protection Act". 26
31	29		27
32	30		4-88-1502. Definitions. 28
33	31		As used in this subchapter: 29
34	32		(1) "Child" means an individual twelve (12) years of age or 30
35		-	younger ~~in the State of Arkansas~~; 31
	33	+	younger; 31
36	34		(2) "Connected device" means a device that is capable of 32
37	35		connecting to the Internet, directly or indirectly, or to another connected 33
38	36		device; 34
39		-	(3) "~~Consent~~" means ~~any reasonable effort,~~ ~~taking into~~ 35
40		-	~~consideration available technology and including without limitation~~ a ~~request~~ 36 ~~As Engrossed: S3/31/25 S4/2/25 S4/7/25~~ HB1717
	37	+	(3)(A) "Disclosure" means making personal information that is 35
	38	+	collected from a child or teen by a website, online service, online 36 HB1717
41	39
42		-	2 04-07-2025 14:27:20 LJH194
	40	+	2 03/06/2025 3:05:16 PM LJH194
	41	+	application, or mobile application targeted toward children or teens or that 1
	42	+	collect with actual knowledge the personal information from a child or teen, 2
	43	+	publicly available in an identifiable form to a third party not affiliated 3
	44	+	with the operator. 4
	45	+	(B) "Disclosure" does not include information provided to 5
	46	+	a person other than an operator who provides support for the internal 6
	47	+	operations of the website, online service, online application, or mobile 7
	48	+	application of the operator, excluding any activity related to individual -8
	49	+	specific advertising to children or teens; 9
	50	+	(4) "Internet" means collectively a system of interconnected 10
	51	+	computer networks that comprise the interconnected world -wide network of 11
	52	+	networks and employ without limitation the Transmission Control 12
	53	+	Protocol/Internet Protocol, or any predecessor or successor protocols to such 13
	54	+	protocol, or the User Datagram Protocol to communicate information of all 14
	55	+	kinds by wire or radio; 15
	56	+	(5) "Mobile application" means: 16
	57	+	(A) A software program that runs on the operating system 17
	58	+	of: 18
	59	+	(i) A cellular telephone; 19
	60	+	(ii) A tablet computer; or 20
	61	+	(iii) A similar portable computing device that 21
	62	+	transmits data over a wireless connection; and 22
	63	+	(B) Includes without limitation a service or application 23
	64	+	offered via a connected device; 24
	65	+	(6) "Online application" means an Internet -connected software 25
	66	+	program and includes without limitation a service or application offered via 26
	67	+	a connected device; 27
	68	+	(7) "Online contact information" means an email address or 28
	69	+	another substantially similar identifier that permits direct contact with a 29
	70	+	person online; 30
	71	+	(8)(A)(i) "Operator" means a person who, for commercial 31
	72	+	purposes, operates or provides a website on the internet, an online service, 32
	73	+	an online application, or a mobile application, and who: 33
	74	+	(ii)(a) Collects or maintains, either directly or 34
	75	+	through a service provider, personal information from or about the users of 35
	76	+	that website, service, or application; or 36 HB1717
43	77
	78	+	3 03/06/2025 3:05:16 PM LJH194
	79	+	(b) Allows another person to collect personal 1
	80	+	information directly from users of that website, service, or application, in 2
	81	+	which case, the operator is deemed to have collected the information. 3
	82	+	(B) "Operator" does not include: 4
	83	+	(i) Any nonprofit entity that would otherwise be 5
	84	+	exempt from coverage under section 5 of the Federal Trade Commission Act, 15 6
	85	+	U.S.C. § 45 et seq., as it existed on January 1, 2025; 7
	86	+	(ii) An interactive gaming platform that complies 8
	87	+	with the requirements of the Children's Online Privacy Act, 15 U.S.C. § 6501, 9
	88	+	as it existed on January 1, 2025, and the rules, guidance, and exemptions 10
	89	+	under that act, as it existed on January 1, 2025; 11
	90	+	(iii) An agency, board, commission, institution, or 12
	91	+	other instrumentality of the State of Arkansas or its political subdivisions; 13
	92	+	or 14
	93	+	(iv) A public educational entity of the State of 15
	94	+	Arkansas, including without limitation a school district and an institution 16
	95	+	of higher learning; 17
	96	+	(9) "Parent" means a natural parent, adoptive parent, legal 18
	97	+	guardian, or legal custodian of an individual who is sixteen (16) years of 19
	98	+	age or younger; 20
	99	+	(10) "Person" means any individual, partnership, corporation, 21
	100	+	trust, estate, cooperative, association, or other entity; 22
	101	+	(11)(A) "Personal information" means individually identifiable 23
	102	+	information about an individual collected online, including without 24
	103	+	limitation: 25
	104	+	(i) A first and last name; 26
	105	+	(ii) A home or other physical address including 27
	106	+	street name and name of the city or town of residence; 28
	107	+	(iii) An e-mail address; 29
	108	+	(iv) A telephone number; 30
	109	+	(v) A Social Security number; 31
	110	+	(vi) Any other identifier that permits the physical 32
	111	+	or online contacting of a specific individual; 33
	112	+	(vii) Geolocation information sufficient to identify 34
	113	+	a street name and a city or town; 35
	114	+	(viii) Information generated from the measurement or 36 HB1717
44	115
45		-	for authorization for future collection, use, and disclosure described in the 1
46		-	notice, to ensure that in the case of a teen, the parent of a teen or the 2
47		-	teen: 3
48		-	(A) Receives notice of the personal information 4
49		-	collection, use, and disclosure practices of the operator; and 5
50		-	(B) Before the personal information of the teen is 6
51		-	collected, freely and unambiguously authorizes, including without limitation 7
52		-	the giving of consent through an operator's terms of service or 8
53		-	acknowledgement of the operator's privacy policy: 9
54		-	(i) The collection, use, and disclosure, as 10
55		-	applicable, of the teen's personal information; and 11
56		-	(ii) Any subsequent use of the teen's personal 12
57		-	information. 13
58		-	(4)(A) "Disclosure" means making personal information that is 14
59		-	collected from a child or teen by a website, online service, online 15
60		-	application, or mobile application targeted toward children or teens or that 16
61		-	is collected with actual knowledge the personal information from a child or 17
62		-	teen publicly available in an identifiable form to a third party not 18
63		-	affiliated with the operator. 19
64		-	(B) "Disclosure" does not include personal information 20
65		-	provided to a person other than an operator who provides support for the 21
66		-	internal operations of the website, online service, online application, or 22
67		-	mobile application of the operator, including a processor; application, or 23
68		-	mobile application targeted toward children or teens or that collect with 24
69		-	actual knowledge the personal information from a child or teen, publicly 25
70		-	available in an identifiable form to a third party not affiliated with the 26
71		-	operator. 27
72		-	(C) "Disclosure" does not include information provided to 28
73		-	a person other than an operator who provides support for the internal 29
74		-	operations of the website, online service, online application, or mobile 30
75		-	application of the operator, including a processor; 31
76		-	(5) "Internet" means collectively a system of interconnected 32
77		-	computer networks that comprise the interconnected world -wide network of 33
78		-	networks and employ without limitation the Transmission Control 34
79		-	Protocol/Internet Protocol, or any predecessor or successor protocols to such 35
80		-	protocol, or the User Datagram Protocol to communicate information of all 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
	116	+	4 03/06/2025 3:05:16 PM LJH194
	117	+	technological processing of an individual's biological, physical, or 1
	118	+	physiological characteristics that is used to identify an individual, 2
	119	+	including without limitation: 3
	120	+	(a) Fingerprints; 4
	121	+	(b) Voice prints; 5
	122	+	(c) Iris or retina imagery scans; 6
	123	+	(d) Facial templates; 7
	124	+	(e) Deoxyribonucleic acid (DNA) information; 8
	125	+	or 9
	126	+	(f) Gait; 10
	127	+	(ix) Information linked or reasonably linkable to a 11
	128	+	child or teen; or 12
	129	+	(x) Information linked or reasonably linkable to a 13
	130	+	child or teen or the parents of that child or teen, including without 14
	131	+	limitation any unique identifier, that an operator collects online from the 15
	132	+	child or teen and combines with an identifier described in this subdivision 16
	133	+	(11)(A). 17
	134	+	(B) "Personal information" does not include an audio file 18
	135	+	that contains a child or teen’s voice so long as the operator: 19
	136	+	(i) Does not request information via voice that 20
	137	+	would otherwise be considered personal information under subdivision (11)(A) 21
	138	+	of this section; 22
	139	+	(ii) Provides clear notice of its collection and use 23
	140	+	of the audio file and its deletion policy in its privacy policy; 24
	141	+	(iii) Only uses the voice within the audio file 25
	142	+	solely as a replacement for written words, to perform a task, or engage with 26
	143	+	a website, online service, online application, or mobile application, such as 27
	144	+	to perform a search or fulfill a verbal instruction or request; and 28
	145	+	(iv) Only maintains the audio file long enough to 29
	146	+	complete the stated purpose and then immediately deletes the audio file and 30
	147	+	does not make any other use of the audio file prior to deletion; 31
	148	+	(12)(A) "Social media platform" means a public or semipublic 32
	149	+	Internet-based service or application that: 33
	150	+	(i) Is used by a consumer in this state; 34
	151	+	(ii) Is primarily intended to connect and allow 35
	152	+	users to socially interact within that service or application; and 36 HB1717
81	153
82		-	3 04-07-2025 14:27:20 LJH194
	154	+	5 03/06/2025 3:05:16 PM LJH194
	155	+	(iii) Enables a user to: 1
	156	+	(a) Construct a public or semipublic profile 2
	157	+	for the purposes of signing into and using the service or application; 3
	158	+	(b) Populate a public list of other users with 4
	159	+	whom the user shares a social connection within that service or application; 5
	160	+	and 6
	161	+	(c) Create or post content that is viewable by 7
	162	+	other users, including without limitation on message boards, in chat rooms, 8
	163	+	or through a landing page or main feed that presents the user with content 9
	164	+	that is generated by other users. 10
	165	+	(B) "Social media platform" does not include a public or 11
	166	+	semipublic Internet-based service or application that: 12
	167	+	(i) Exclusively provides electronic mail or direct 13
	168	+	messaging services; 14
	169	+	(ii) Primarily consists of news, sports, 15
	170	+	entertainment, interactive video games, electronic commerce, or content that 16
	171	+	is preselected by the provider or for which any chat, comments, or 17
	172	+	interactive functionality is incidental to, directly related to, or dependent 18
	173	+	on the provision of that content; or 19
	174	+	(iii) Is used by and under the direction of an 20
	175	+	educational entity, including without limitation a learning management system 21
	176	+	or a student engagement program; 22
	177	+	(13)(A) "Targeted advertising" means displaying advertisements 23
	178	+	to a consumer where the advertisement is selected based on personal data 24
	179	+	obtained from that consumer's activities over time and across nonaffiliated 25
	180	+	websites or online applications to predict that consumer's preferences or 26
	181	+	interests. 27
	182	+	(B) "Targeted advertising" does not include: 28
	183	+	(i) Advertising based on activities within a 29
	184	+	controller's own websites or online applications; 30
	185	+	(ii) Advertising based on the context of a 31
	186	+	consumer's current search query or visit to a website or online application; 32
	187	+	(iii) Advertising directed to a consumer in response 33
	188	+	to the consumer's request for information or feedback; or 34
	189	+	(iv) Processing of personal data that is processed 35
	190	+	solely for measuring or reporting advertising performance, reach, or 36 HB1717
83	191
	192	+	6 03/06/2025 3:05:16 PM LJH194
	193	+	frequency; 1
	194	+	(14) "Teen" means an individual who is: 2
	195	+	(A) Thirteen (13) years of age or older; and 3
	196	+	(B) Younger than seventeen (17) years of age; and 4
	197	+	(15) "Verifiable consent" means any reasonable effort, including 5
	198	+	without limitation a request for authorization for future collection, use, 6
	199	+	and disclosure described in the notice, to ensure that, in the case of a 7
	200	+	child, a parent of the child, or, in the case of a teen, the teen: 8
	201	+	(A) Receives specific notice of the personal information 9
	202	+	collection, use, and disclosure practices of the operator; and 10
	203	+	(B) Before the personal information of the child or teen 11
	204	+	is collected, freely and unambiguously authorizes: 12
	205	+	(i) The collection, use, and disclosure, as 13
	206	+	applicable, of that personal information; and 14
	207	+	(ii) Any subsequent use of that personal 15
	208	+	information. 16
	209	+	17
	210	+	4-88-1503. Personal information from and about children and teens — 18
	211	+	Online collection and use. 19
	212	+	(a)(1) Except as provided in subdivision (a)(2) of this section, it 20
	213	+	is unlawful for an operator of a website, online service, online application, 21
	214	+	or mobile application directed to children or for any operator of a website, 22
	215	+	online service, online application, or mobile application with actual 23
	216	+	knowledge that it is collecting personal information from children or teens: 24
	217	+	(A) To collect personal information from a child or teen 25
	218	+	in a manner that violates subsection (b) of this section; 26
	219	+	(B) To collect, use, disclose to third parties, or compile 27
	220	+	personal information of a child or teen for purposes of targeted advertising 28
	221	+	to children or teens, or to allow another person to collect, use, disclose, 29
	222	+	or compile this information for targeted advertising to children or teens; 30
	223	+	(C) To collect the personal information of a child or teen 31
	224	+	except when the collection of the personal information is: 32
	225	+	(i) Consistent with the context of a particular 33
	226	+	service or the relationship of the child or teen with the operator, including 34
	227	+	without limitation collection that is necessary to fulfill a transaction or 35
	228	+	provide a product or service requested by the child or teen; or 36 HB1717
84	229
85		-	kinds by wire or radio; 1
86		-	(6) "Mobile application" means: 2
87		-	(A) A software program that runs on the operating system 3
88		-	of: 4
89		-	(i) A cellular telephone; 5
90		-	(ii) A tablet computer; or 6
91		-	(iii) A similar portable computing device that 7
92		-	transmits data over a wireless connection; and 8
93		-	(B) Includes without limitation a service or application 9
94		-	offered via a connected device; 10
95		-	(7) "Online application" means an Internet -connected software 11
96		-	program and includes without limitation a service or application offered via 12
97		-	a connected device; 13
98		-	(8) "Online contact information" means an email address or 14
99		-	another substantially similar identifier that permits direct contact with a 15
100		-	person online; 16
101		-	(9)(A) "Operator" means a person who, for commercial purposes, 17
102		-	operates or provides a website on the internet, an online service, an online 18
103		-	application, or a mobile application, and who: 19
104		-	(i) Collects or maintains, either directly or 20
105		-	through a service provider, personal information from or about the users of 21
106		-	that website, service, or application; or 22
107		-	(ii) Allows another person to collect personal 23
108		-	information directly from users of that website, service, or application, in 24
109		-	which case, the operator is deemed to have collected the information. 25
110		-	(B) "Operator" does not include: 26
111		-	(i) Any nonprofit entity that would otherwise be 27
112		-	exempt from coverage under section 5 of the Federal Trade Commission Act, 15 28
113		-	U.S.C. § 45 et seq.; 29
114		-	(ii) An interactive gaming platform that complies 30
115		-	with the requirements of the Children's Online Privacy Act, 15 U.S.C. § 6501, 31
116		-	and the rules, guidance, and exemptions under that act; 32
117		-	(iii) An agency, board, commission, institution, or 33
118		-	other instrumentality of the State of Arkansas or its political subdivisions; 34
119		-	or 35
120		-	(iv) A public educational entity of the State of 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
	230	+	7 03/06/2025 3:05:16 PM LJH194
	231	+	(ii) Required or specifically authorized by law; or 1
	232	+	(D) To retain the personal information of a child or teen 2
	233	+	for longer that is reasonably necessary to fulfill a transaction or provide a 3
	234	+	service requested by the child or teen except as required for the safety or 4
	235	+	integrity of the service or specifically authorized by law. 5
	236	+	(2) Neither an operator nor the operator’s agent shall be liable 6
	237	+	for a disclosure made in good faith and following reasonable procedures in 7
	238	+	responding to a request for disclosure of personal information under 8
	239	+	subdivision (b)(3)(A) of this section to the parent of a child or to a teen 9
	240	+	under subdivision (b)(4)(A) of this section. 10
	241	+	(b) An operator of a website, online service, online application, or 11
	242	+	mobile application that has actual knowledge that it is collecting personal 12
	243	+	information from children or teens shall: 13
	244	+	(1) Provide clear and conspicuous notice of: 14
	245	+	(A) What information is collected from children or teens 15
	246	+	by the operator; 16
	247	+	(B) The purpose for processing personal data; 17
	248	+	(C) The operator’s disclosure practices for such 18
	249	+	information; 19
	250	+	(D) The rights and opportunities available to the parent 20
	251	+	of the child or teen under subdivisions (b)(3) and (b)(4) of this section; 21
	252	+	(E) The categories of personal data that the controller 22
	253	+	shares with third parties, if any; and 23
	254	+	(F) The categories of third parties, if any, with whom the 24
	255	+	controller shares personal data; 25
	256	+	(2) Obtain verifiable consent for the collection, use, or 26
	257	+	disclosure of personal information from a child or teen from a: 27
	258	+	(A) Parent or legal guardian of a child, except to the 28
	259	+	extent the processing is permitted under 15 U.S.C. 6502, as it existed on 29
	260	+	January 1, 2025, and its implementing regulations; or 30
	261	+	(B) A teen, except when the processing is for: 31
	262	+	(i) Providing or maintaining a specific product or 32
	263	+	service requested by the teen; 33
	264	+	(ii) Conducting the operator's internal business 34
	265	+	operations, including without limitation identifying and repairing technical 35
	266	+	errors that impair existing or intended functionality; 36 HB1717
121	267
122		-	4 04-07-2025 14:27:20 LJH194
	268	+	8 03/06/2025 3:05:16 PM LJH194
	269	+	(iii) Protecting against malicious, fraudulent, or 1
	270	+	illegal activity or detecting, responding to, or preventing security 2
	271	+	incidents or threats; 3
	272	+	(iv) Investigating, establishing, exercising, 4
	273	+	preparing for, or defending legal claims; 5
	274	+	(v) Complying with federal, state, or local laws, 6
	275	+	rules, or regulations; 7
	276	+	(vi) Complying with a civil, criminal, or regulatory 8
	277	+	inquiry, investigation, subpoena, or a summons by federal, state, local, or 9
	278	+	other governmental authorities; or 10
	279	+	(vii) Protecting the vital interests of a natural 11
	280	+	person; 12
	281	+	(3) Provide, upon request of a parent under this subsection (b) 13
	282	+	whose child has provided personal information to that operator, upon proper 14
	283	+	identification of that parent, to the parent: 15
	284	+	(A)(i) A description of the specific categories of 16
	285	+	personal information collected from the child by that operator; 17
	286	+	(ii) The purposes for which the operator, collects, 18
	287	+	uses, discloses, and retains the personal information; 19
	288	+	(B) The opportunity to: 20
	289	+	(i) Request at any time the deletion of the account 21
	290	+	of the child or content or information submitted by the child to a website, 22
	291	+	online service, online application, or mobile application and to refuse at 23
	292	+	any time to permit the operator’s further use or maintenance in retrievable 24
	293	+	form, or future online collection, of personal information from that child; 25
	294	+	and 26
	295	+	(ii) Challenge the accuracy of the personal 27
	296	+	information and, if the parent of the child establishes the inaccuracy of the 28
	297	+	personal information, to have the inaccurate personal information corrected; 29
	298	+	and 30
	299	+	(C) A means that is reasonable under the circumstances for 31
	300	+	the parent to obtain any personal information collected from that child, if 32
	301	+	that information is available to the operator at the time the parent makes 33
	302	+	the request; 34
	303	+	(4) Provide, upon the request of a teen under subdivision (b)(1) 35
	304	+	of this section who has provided personal information to the operator and 36 HB1717
123	305
	306	+	9 03/06/2025 3:05:16 PM LJH194
	307	+	upon proper identification of that teen: 1
	308	+	(A) A description of the specific categories of personal 2
	309	+	information collected from the teen by the operator, the method by which the 3
	310	+	operator obtained the personal information, and the purposes for which the 4
	311	+	operator collects, uses, discloses, and retains the personal information; 5
	312	+	(B) The opportunity at any time to delete personal 6
	313	+	information collected from the teen or content or information submitted by 7
	314	+	the teen to a website, online service, online application, or mobile 8
	315	+	application; 9
	316	+	(C) The opportunity to challenge the accuracy of the 10
	317	+	personal information and, if the teen establishes the inaccuracy of the 11
	318	+	personal information, to have the inaccurate personal information corrected; 12
	319	+	and 13
	320	+	(D) A means that is reasonable under the circumstances for 14
	321	+	the teen to obtain any personal information collected from the teen, if the 15
	322	+	information is available to the operator at the time the teen makes the 16
	323	+	request; 17
	324	+	(5) Not require a child to disclose more personal information 18
	325	+	than is reasonably necessary to participate as a condition to participate in: 19
	326	+	(A) A game; 20
	327	+	(B) The offering of a prize; or 21
	328	+	(C) Another activity; and 22
	329	+	(6) Establish, implement, and maintain reasonable security 23
	330	+	practices to protect the confidentiality, integrity, and accessibility of 24
	331	+	personal information of children or teens collected by the operator, and 25
	332	+	protect the personal information against unauthorized access. 26
	333	+	(c) Verifiable consent under subdivision (b)(2)(A) of this section is 27
	334	+	not required in the case of: 28
	335	+	(1) Online contact information collected from a child or teen 29
	336	+	that is used only to respond directly on a one -time basis to a specific 30
	337	+	request from the child or teen and is not used to recontact the child or teen 31
	338	+	or to contact another child or teen and is not maintained in retrievable form 32
	339	+	by the operator; 33
	340	+	(2) A request for the name or online contact information of a 34
	341	+	parent or teen that is used for the sole purpose of obtaining verifiable 35
	342	+	consent or providing notice under this section and where such information is 36 HB1717
124	343
125		-	Arkansas, including without limitation a school district and an institution 1
126		-	of higher learning; 2
127		-	(10) "Parent" means a natural parent, adoptive parent, legal 3
128		-	guardian, or legal custodian of an individual who is sixteen (16) years of 4
129		-	age or younger; 5
130		-	(11) "Person" means any individual, partnership, corporation, 6
131		-	trust, estate, cooperative, association, or other entity; 7
132		-	(12)(A) "Personal information" means individually identifiable 8
133		-	information about an individual collected online, including without 9
134		-	limitation: 10
135		-	(i) A first and last name; 11
136		-	(ii) A home or other physical address including 12
137		-	street name and name of the city or town of residence; 13
138		-	(iii) An e-mail address; 14
139		-	(iv) A telephone number; 15
140		-	(v) A Social Security number; 16
141		-	(vi) Any other identifier that permits the physical 17
142		-	or online contacting of a specific individual; 18
143		-	(vii) Geolocation information sufficient to identify 19
144		-	a street name and a city or town; 20
145		-	(viii) Information generated from the measurement or 21
146		-	technological processing of an individual's biological, physical, or 22
147		-	physiological characteristics that is used to identify an individual, 23
148		-	including without limitation: 24
149		-	(a) Fingerprints; 25
150		-	(b) Voice prints; 26
151		-	(c) Iris or retina imagery scans; 27
152		-	(d) Facial templates; 28
153		-	(e) Deoxyribonucleic acid (DNA) information; 29
154		-	or 30
155		-	(f) Gait; 31
156		-	(ix) Information linked or reasonably linkable to a 32
157		-	child or teen; or 33
158		-	(x) Information linked or reasonably linkable to a 34
159		-	child or teen or the parents of that child or teen, including without 35
160		-	limitation any unique identifier, that an operator collects online from the 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
	344	+	10 03/06/2025 3:05:16 PM LJH194
	345	+	not maintained in retrievable form by the operator if verifiable consent is 1
	346	+	not obtained after a reasonable time; 2
	347	+	(3) Online contact information collected from a child or teen 3
	348	+	that is used only to respond more than once directly to a specific request 4
	349	+	from the child or teen and is not used to recontact the child or teen beyond 5
	350	+	the scope of that request if, before any additional response after the 6
	351	+	initial response to the child or teen, the operator uses reasonable efforts 7
	352	+	to provide a parent or teen notice of the online contact information 8
	353	+	collected from the child or teen, the purposes for which it is to be used, 9
	354	+	and an opportunity for the parent or teen to request that the operator make 10
	355	+	no further use of the information and that it not be maintained in 11
	356	+	retrievable form; and 12
	357	+	(4) The name of the child or teen and online contact 13
	358	+	information, to the extent reasonably necessary to protect the safety of a 14
	359	+	child or teen participant on the site: 15
	360	+	(A) Used only for the purpose of protecting such safety; 16
	361	+	(B) Not used to recontact the child or teen or for any 17
	362	+	other purpose; and 18
	363	+	(C) Not disclosed on the site, if the operator uses 19
	364	+	reasonable efforts to provide a parent or teen notice of the name and online 20
	365	+	contact information collected from the child or teen, the purposes for which 21
	366	+	it is to be used, and an opportunity for the parent or teen to request that 22
	367	+	the operator make no further use of the information and that it not be 23
	368	+	maintained in retrievable form; or 24
	369	+	(5) The collection, use, or dissemination of such information by 25
	370	+	the operator necessary to: 26
	371	+	(A) Protect the security or integrity of its website; 27
	372	+	(B) Take precautions against liability; 28
	373	+	(C) Respond to judicial process; 29
	374	+	(D) Protect the security or safety of the user on the 30
	375	+	service; or 31
	376	+	(E) Provide information to law enforcement agencies or for 32
	377	+	an investigation on a matter related to public safety. 33
	378	+	(d)(1) An operator may terminate service provided to a child whose 34
	379	+	parent has refused or a teen who has refused under subdivision (b)(2) of this 35
	380	+	section to permit the operator's further use or maintenance in retrievable 36 HB1717
161	381
162		-	5 04-07-2025 14:27:20 LJH194
	382	+	11 03/06/2025 3:05:16 PM LJH194
	383	+	form or future online collection of personal information from that child or 1
	384	+	teen. 2
	385	+	(2) An operator shall not discontinue service provided to a 3
	386	+	child or teen on the basis of a request by the parent or the child or by the 4
	387	+	teen under subdivision (b)(3)(B)(i) of this section to delete personal 5
	388	+	information collected from the child or teen, to the extent that the operator 6
	389	+	is capable of providing this service without the personal information. 7
	390	+	(3) A request made under subdivisions (b)(3)(B)(i) of this 8
	391	+	section to delete personal information of a child or teen shall not be 9
	392	+	construed to: 10
	393	+	(A) Limit the authority of a law enforcement agency to 11
	394	+	obtain any content or information from an operator under a lawfully executed 12
	395	+	warrant or an order of a court of competent jurisdiction; and 13
	396	+	(B) Require an operator or third party to delete 14
	397	+	information that: 15
	398	+	(i) Another law requires the operator or third party 16
	399	+	to maintain; 17
	400	+	(ii) Was submitted to the website, online service, 18
	401	+	online application, or mobile application of the operator by any person other 19
	402	+	than the user who is attempting to erase or otherwise eliminate the content 20
	403	+	or information, including without limitation content or information submitted 21
	404	+	by the user that was republished or resubmitted by another person; or 22
	405	+	(iii) Prohibit an operator from retaining a record 23
	406	+	of the deletion request and the minimum information necessary for the 24
	407	+	purposes of ensuring compliance with a request made under subsection (b) of 25
	408	+	this section or ensuring that the child or teen's information remains 26
	409	+	deleted. 27
	410	+	(e) Except as provided under § 4 -88-1503 and § 4-88-1505, a violation 28
	411	+	of subdivisions (b)(2) and (b)(3) of this section shall be treated as an 29
	412	+	unfair or deceptive act or practice prescribed under the Deceptive Trade 30
	413	+	Practices Act, § 4-88-101 et seq. 31
	414	+	32
	415	+	4-88-1504. Enforcement. 33
	416	+	In a case in which the Attorney General has reason to believe that an 34
	417	+	interest of the residents of the state has been or is threatened or adversely 35
	418	+	affected by the engagement of any person in a practice that violates the 36 HB1717
163	419
164		-
165		-	child or teen and combines with an identifier described in this subdivision 1
166		-	(11)(A). 2
167		-	(B) "Personal information" does not include an audio file 3
168		-	that contains a child or teen’s voice so long as the operator: 4
169		-	(i) Does not request information via voice that 5
170		-	would otherwise be considered personal information under subdivision (11)(A) 6
171		-	of this section; 7
172		-	(ii) Provides clear notice of its collection and use 8
173		-	of the audio file and its deletion policy in its privacy policy; 9
174		-	(iii) Uses the voice within the audio file as a 10
175		-	replacement for written words, to perform a task, or engage with a website, 11
176		-	online service, online application, or mobile application, such as to perform 12
177		-	a search or fulfill a verbal instruction or request; and 13
178		-	(iv) Only maintains the audio file long enough to 14
179		-	complete the stated purpose and improve or enhance the users' experience of 15
180		-	the service and then deletes the audio file when it is no longer reasonably 16
181		-	needed and does not make any other use of the audio file before deletion; 17
182		-	(13) "Processor" means a person that processes personal 18
183		-	information on behalf of an operator; 19
184		-	(14)(A) "Social media platform" means a public or semipublic 20
185		-	Internet-based service or application that: 21
186		-	(i) Is used by a consumer in this state; 22
187		-	(ii) Is primarily intended to connect and allow 23
188		-	users to socially interact within that service or application; and 24
189		-	(iii) Enables a user to: 25
190		-	(a) Construct a public or semipublic profile 26
191		-	for the purposes of signing into and using the service or application; 27
192		-	(b) Populate a public list of other users with 28
193		-	whom the user shares a social connection within that service or application; 29
194		-	and 30
195		-	(c) Create or post content that is viewable by 31
196		-	other users, including without limitation on message boards, in chat rooms, 32
197		-	or through a landing page or main feed that presents the user with content 33
198		-	that is generated by other users. 34
199		-	(B) "Social media platform" does not include a public or 35
200		-	semipublic Internet-based service or application that: 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
201		-
202		-	6 04-07-2025 14:27:20 LJH194
203		-
204		-
205		-	(i) Exclusively provides electronic mail or direct 1
206		-	messaging services; 2
207		-	(ii) Primarily consists of news, sports, 3
208		-	entertainment, interactive video games, electronic commerce, or content that 4
209		-	is preselected by the provider or for which any chat, comments, or 5
210		-	interactive functionality is incidental to, directly related to, or dependent 6
211		-	or a student engagement program ; 7
212		-	(iii) Primarily provides career development 8
213		-	opportunities, including without limitation professional networking, job 9
214		-	skills, learning certifications, and job posting and application services ; or 10
215		-	(iv) Is used by and under the direction of an 11
216		-	educational entity, including without limitation a learning management system 12
217		-	or a student engagement program; 13
218		-	(15)(A) "Targeted advertising" means displaying advertisements 14
219		-	to a consumer where the advertisement is selected based on personal data 15
220		-	obtained from that consumer's activities over time and across nonaffiliated 16
221		-	websites or online applications to predict that consumer's preferences or 17
222		-	interests. 18
223		-	(B) "Targeted advertising" does not include: 19
224		-	(i) Advertising based on activities within a 20
225		-	controller's own websites or online applications; 21
226		-	(ii) Advertising based on the context of a 22
227		-	consumer's current search query or visit to a website or online application; 23
228		-	(iii) Advertising directed to a consumer in response 24
229		-	to the consumer's request for information or feedback; or 25
230		-	(iv) Processing of personal data that is processed 26
231		-	solely for measuring or reporting advertising performance, reach, or 27
232		-	frequency; 28
233		-	(16) "Teen" means an individual located in the State of Arkansas 29
234		-	who is: 30
235		-	(A) Thirteen (13) years of age or older; and 31
236		-	(B) Younger than seventeen (17) years of age; and 32
237		-	(17) "Third party" means a person, public authority, agency, or 33
238		-	body other than the consumer, operator, processor, or an affiliate of the 34
239		-	processor or the operator . 35
240		-	36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
241		-
242		-	7 04-07-2025 14:27:20 LJH194
243		-
244		-
245		-	4-88-1503. Personal information from and about children and teens — 1
246		-	Online collection and use. 2
247		-	(a)(1) Except as provided in subdivision (a)(2) of this section, it 3
248		-	is unlawful for an operator of a website, online service, online application, 4
249		-	or mobile application directed at children or teens or for any operator of a 5
250		-	website, online service, online application, or mobile application with 6
251		-	actual knowledge that it is collecting personal information from children or 7
252		-	teens: 8
253		-	(A) To collect personal information from a child or teen 9
254		-	in a manner that violates subsection (b) of this section; 10
255		-	(B) Except as provided in subdivisions (a)(1)(C) and (D) 11
256		-	of this section, to collect personal information from a child or teen 12
257		-	personal information of a child or teen for purposes of targeted advertising 13
258		-	to children or teens, or to allow another person to collect, use, disclose, 14
259		-	or maintain this information for targeted advertising to children or teens; 15
260		-	(C) To collect the personal information of a child or teen 16
261		-	except when the collection of the personal information is: 17
262		-	(i) Consistent with the context of a particular 18
263		-	service or the relationship of the child or teen with the operator, including 19
264		-	without limitation collection that is necessary to fulfill a transaction or 20
265		-	provide a product or service requested by the child or teen or parent of the 21
266		-	child or teen; or 22
267		-	(ii) Required or specifically authorized by law; or 23
268		-	(D) To retain the personal information of a child or teen 24
269		-	for longer that is reasonably necessary to fulfill a transaction or provide a 25
270		-	service requested by the child or teen except as required for the safety or 26
271		-	integrity of the service or specifically authorized by law. 27
272		-	(2) Neither an operator nor the operator’s agent shall be liable 28
273		-	for a disclosure made in good faith and following reasonable procedures in 29
274		-	responding to a request for disclosure of personal information under 30
275		-	subdivision (b)(3)(A) of this section to the parent of a child or to a teen 31
276		-	under subdivision (b)(4)(A) of this section. 32
277		-	(b) An operator of a website, online service, online application, or 33
278		-	mobile application that has actual knowledge that it is collecting personal 34
279		-	information from children or teens shall: 35
280		-	(1) Provide clear and conspicuous notice of: 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
281		-
282		-	8 04-07-2025 14:27:20 LJH194
283		-
284		-
285		-	(A) What information is collected from children or teens 1
286		-	by the operator; 2
287		-	(B) The purpose for processing personal data; 3
288		-	(C) The operator’s disclosure practices for such 4
289		-	information; 5
290		-	(D) The rights and opportunities available to the parent 6
291		-	of the child or teen under subdivisions (b)(3) and (b)(4) of this section; 7
292		-	(E) The categories of personal data that the controller 8
293		-	shares with third parties, if any; and 9
294		-	(F) The categories of third parties, if any, with whom the 10
295		-	controller shares personal data; 11
296		-	(2) Obtain consent for the collection, use, or disclosure of 12
297		-	personal information from a teen from a parent of a teen or a teen, except 13
298		-	when the processing is for: 14
299		-	(A) Providing or maintaining the specific product or 15
300		-	service requested by the teen; 16
301		-	(B) Conducting the operator's internal business 17
302		-	operations, including without limitation identifying and repairing technical 18
303		-	errors that impair existing or intended functionality; 19
304		-	(C) Protecting against malicious, fraudulent, or illegal 20
305		-	activity or detecting, responding to, or preventing security incidents or 21
306		-	threats; 22
307		-	(D) Investigating, establishing, exercising, preparing 23
308		-	for, or defending legal claims; 24
309		-	(E) Complying with federal, state, or local laws, rules, 25
310		-	or regulations; 26
311		-	(F) Complying with a civil, criminal, or regulatory 27
312		-	inquiry, investigation, subpoena, or a summons by federal, state, local, or 28
313		-	other governmental authorities; 29
314		-	(G) Protecting the vital interests of a natural person ; or 30
315		-	(H) Providing or maintaining a specific product or service 31
316		-	requested by the teen; 32
317		-	(3) Provide: 33
318		-	(A) The opportunity to: 34
319		-	(i) Request at any time the deletion of the account 35
320		-	of the child or content or information submitted by the child to a website, 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
321		-
322		-	9 04-07-2025 14:27:20 LJH194
323		-
324		-
325		-	online service, online application, or mobile application and to refuse at 1
326		-	any time to permit the operator’s further use or maintenance in retrievable 2
327		-	form, or future online collection, of personal information from that child; 3
328		-	and 4
329		-	(ii) Challenge the accuracy of the personal 5
330		-	information and, if the parent of the child establishes the inaccuracy of the 6
331		-	personal information, to have the inaccurate personal information corrected; 7
332		-	and 8
333		-	(B) A means that is reasonable under the circumstances for 9
334		-	the parent to obtain any personal information collected from that child, if 10
335		-	that information is available to the operator at the time the parent makes 11
336		-	the request; 12
337		-	(4) Provide: 13
338		-	(A) The opportunity at any time to delete personal 14
339		-	information collected from the teen or content or information submitted by 15
340		-	the teen to a website, online service, online application, or mobile 16
341		-	application; 17
342		-	(B) The opportunity to challenge the accuracy of the 18
343		-	personal information and, if the teen establishes the inaccuracy of the 19
344		-	personal information, to have the inaccurate personal information corrected; 20
345		-	and 21
346		-	(C) A means that is reasonable under the circumstances for 22
347		-	the teen to obtain any personal information collected from the teen, if the 23
348		-	information is available to the operator at the time the teen makes the 24
349		-	request; 25
350		-	(5) Not require a child to disclose more personal information 26
351		-	than is reasonably necessary to participate as a condition to participate in: 27
352		-	(A) A game; 28
353		-	(B) The offering of a prize; or 29
354		-	(C) Another activity; and 30
355		-	(6) Establish, implement, and maintain reasonable security 31
356		-	practices to protect the confidentiality, integrity, and accessibility of 32
357		-	personal information of children or teens collected by the operator, and 33
358		-	protect the personal information against unauthorized access. 34
359		-	(c) Verifiable consent under subdivision (b)(2)(A) of this section is 35
360		-	not required in the case of: 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
361		-
362		-	10 04-07-2025 14:27:20 LJH194
363		-
364		-
365		-	(1) Online contact information collected from a child or teen 1
366		-	that is used only to respond directly on a one -time basis to a specific 2
367		-	request from the child or teen and is not used to recontact the child or teen 3
368		-	or to contact another child or teen and is not maintained in retrievable form 4
369		-	by the operator; 5
370		-	(2) A request for the name or online contact information of a 6
371		-	parent or teen that is used for the sole purpose of obtaining verifiable 7
372		-	consent or providing notice under this section and where such information is 8
373		-	not maintained in retrievable form by the operator if verifiable consent is 9
374		-	not obtained after a reasonable time; 10
375		-	(3) Online contact information collected from a child or teen 11
376		-	that is used only to respond more than once directly to a specific request 12
377		-	from the child or teen and is not used to recontact the child or teen beyond 13
378		-	the scope of that request if, before any additional response after the 14
379		-	initial response to the child or teen, the operator uses reasonable efforts 15
380		-	to provide a parent or teen notice of the online contact information 16
381		-	collected from the child or teen, the purposes for which it is to be used, 17
382		-	and an opportunity for the parent or teen to request that the operator make 18
383		-	no further use of the information and that it not be maintained in 19
384		-	retrievable form; and 20
385		-	(4) The name of the child or teen and online contact 21
386		-	information, to the extent reasonably necessary to protect the safety of a 22
387		-	child or teen participant on the site: 23
388		-	(A) Used only for the purpose of protecting such safety; 24
389		-	(B) Not used to recontact the child or teen or for any 25
390		-	other purpose; and 26
391		-	(C) Not disclosed on the site, if the operator uses 27
392		-	reasonable efforts to provide a parent or teen notice of the name and online 28
393		-	contact information collected from the child or teen, the purposes for which 29
394		-	it is to be used, and an opportunity for the parent or teen to request that 30
395		-	the operator make no further use of the information and that it not be 31
396		-	maintained in retrievable form; or 32
397		-	(5) The collection, use, or dissemination of such information by 33
398		-	the operator necessary to: 34
399		-	(A) Protect the security or integrity of its website; 35
400		-	(B) Take precautions against liability; 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
401		-
402		-	11 04-07-2025 14:27:20 LJH194
403		-
404		-
405		-	(C) Respond to judicial process; 1
406		-	(D) Protect the security or safety of the user on the 2
407		-	service; or 3
408		-	(E) Provide information to law enforcement agencies or for 4
409		-	an investigation on a matter related to public safety. 5
410		-	(d)(1) An operator may terminate service provided to a child whose 6
411		-	parent has refused or a teen who has refused under subdivision (b)(2) of this 7
412		-	section to permit the operator's further use or maintenance in retrievable 8
413		-	form or future online collection of personal information from that child or 9
414		-	teen. 10
415		-	(2) An operator shall not discontinue service provided to a 11
416		-	child or teen on the basis of a request by the parent or the child or by the 12
417		-	teen under subdivision (b)(3)(B)(i) of this section to delete personal 13
418		-	information collected from the child or teen, to the extent that the operator 14
419		-	is capable of providing this service without the personal information. 15
420		-	(3) A request made under subdivisions (b)(3)(B)(i) of this 16
421		-	section to delete personal information of a child or teen shall not be 17
422		-	construed to: 18
423		-	(A) Limit the authority of a law enforcement agency to 19
424		-	obtain any content or information from an operator under a lawfully executed 20
425		-	warrant or an order of a court of competent jurisdiction ; 21
426		-	(B) Require an operator or third party to delete 22
427		-	information that: 23
428		-	(i) Another law requires the operator or third party 24
429		-	to maintain; or 25
430		-	(ii) Was submitted to the website, online service, 26
431		-	online application, or mobile application of the operator by any person other 27
432		-	than the user who is attempting to erase or otherwise eliminate the content 28
433		-	or information, including without limitation content or information submitted 29
434		-	by the user that was republished or resubmitted by another person ; and 30
435		-	(C) Prohibit an operator from: 31
436		-	(i) Retaining a record of the deletion request and 32
437		-	the minimum information necessary for the purposes of ensuring compliance 33
438		-	with a request made under subsection (b) of this section; 34
439		-	(ii) Preventing, detecting, protecting against, or 35
440		-	responding to a security incident, identity theft, fraud, or the reporting of 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
441		-
442		-	12 04-07-2025 14:27:20 LJH194
443		-
444		-
445		-	a person responsible for a security incident, identity theft, or fraud; 1
446		-	(iii) Protecting the integrity or security of a 2
447		-	website, online service, online application, or mobile application; or 3
448		-	(iv) Ensuring that the child or teen's personal 4
449		-	information remains deleted. 5
450		-	(e) Except as provided under § 4 -88-1503 and § 4-88-1505, a violation 6
451		-	of subdivisions (b)(2) and (b)(3) of this section shall be treated as an 7
452		-	unfair or deceptive act or practice prescribed under the Deceptive Trade 8
453		-	Practices Act, § 4-88-101 et seq. 9
454		-	10
455		-	4-88-1504. Enforcement. 11
456		-	(a) In a case in which the Attorney General has reason to believe that 12
457		-	an interest of the residents of the state has been or is threatened or 13
458		-	adversely affected by the engagement of any person in a practice that 14
459		-	violates the provisions of this subchapter, the Attorney General may bring a 15
460		-	civil action on behalf of the residents of the state in a court of competent 16
461		-	jurisdiction to: 17
462		-	(1) Enjoin that practice; 18
463		-	(2) Enforce compliance with the rule; 19
464		-	(3) Obtain damages, restitution, or other compensation on behalf 20
465		-	of residents of the state; or 21
466		-	(4) Obtain other relief that the court finds appropriate. 22
467		-	(b)(1) The Attorney General shall have exclusive authority to enforce 23
468		-	this subchapter. 24
469		-	(2) Nothing in this subchapter provides the basis for, or 25
470		-	subjects an operator, processor, or person to a private right of action for a 26
471		-	violation of this subchapter or any other law. 27
472		-	28
473		-	4-88-1505. Construction. 29
474		-	This subchapter shall not be construed to require an operator to: 30
475		-	(1) Affirmatively collect any personal information regarding the 31
476		-	age of a child or teen that an operator is not already collecting in the 32
477		-	normal course of business; or 33
478		-	(2) Implement an age -gating or age verification functionality. 34
479		-	35
480		-	SECTION 2. DO NOT CODIFY. SEVERABILITY CLAUSE. 36 As Engrossed: S3/31/25 S4/2/25 S4/7/25 HB1717
481		-
482		-	13 04-07-2025 14:27:20 LJH194
483		-
484		-
485		-	If any provision of this act or the application of this act to any 1
486		-	person or circumstance is held invalid, the invalidity shall not affect other 2
487		-	provisions or applications of this act which can be given effect without the 3
488		-	invalid provision or application, and to this end, the provisions of this act 4
489		-	are declared severable. 5
490		-	6
491		-	SECTION 3. DO NOT CODIFY. EFFECTIVE DATE. 7
492		-	This act shall be effective on and after July 1, 2026. 8
	420	+	12 03/06/2025 3:05:16 PM LJH194
	421	+	provisions of this subchapter, the Attorney General may bring a civil action 1
	422	+	on behalf of the residents of the state in a court of competent jurisdiction 2
	423	+	to: 3
	424	+	(1) Enjoin that practice; 4
	425	+	(2) Enforce compliance with the rule; 5
	426	+	(3) Obtain damages, restitution, or other compensation on behalf 6
	427	+	of residents of the state; or 7
	428	+	(4) Obtain such other relief as the court finds appropriate. 8
493	429		9
494		-	~~/s/Gramlich~~ 10
495		-	11
496		-	12
497		-	~~APPROVED: 4/21/25~~ 13
498		-	14
499		-	15
	430	+	4-88-1505. Construction. 10
	431	+	This subchapter shall not be construed to require an operator to: 11
	432	+	(1) Affirmatively collect any personal information regarding the 12
	433	+	age of a child or teen that an operator is not already collecting in the 13
	434	+	normal course of business; or 14
	435	+	(2) Implement an age -gating or age verification functionality. 15
500	436		16
501		-	17
502		-	18
	437	+	SECTION 2. DO NOT CODIFY. EFFECTIVE DATE. 17
	438	+	This act shall be effective on and after July 1, 2026. 18
503	439		19
504	440		20
505	441		21
506	442		22
507	443		23
508	444		24
509	445		25
510	446		26
511	447		27
512	448		28
513	449		29
514	450		30
515	451		31
516	452		32
517	453		33
518	454		34
519	455		35
520	456		36