Serves under-18s, in Arkansas

Ark. Code Ann. section 4-110-104(b) · Read the law's page

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
• This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
• There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.

Act 952 of 2025 (HB1717), adding a subchapter to Ark. Code Ann. Title 4, Chapter 88 · Read the law's page

• The consent, notice, rights and security duties below apply to an operator of a website, online service, online application or mobile application that has actual knowledge that it is collecting personal information from children or teens; the limits on collection, targeted advertising and retention also apply to an operator directed at children or teens. A child is 12 or younger and a teen is 13 to 16.
• Obtain consent from a teen or the teen's parent before collecting, using or disclosing the teen's personal information, unless the processing is for a purpose the Act lists, such as providing the product or service the teen requested, protecting against fraud or security incidents, or complying with law.
• Provide clear and conspicuous notice of what information you collect from children or teens, the purpose of processing it, your disclosure practices, the rights available to the parent of a child or to a teen, and the categories of data and of third parties you share it with.
• Give the parent of a child the opportunity to request deletion of the child's account, content or information, to refuse further use or collection, and to challenge and correct inaccurate information, and give a reasonable means to obtain the information you hold.
• Give a teen the opportunity at any time to delete personal information collected from the teen, to challenge its accuracy and have inaccurate information corrected, and a reasonable means to obtain it.
• Do not require a child to disclose more personal information than is reasonably necessary to take part in a game, the offering of a prize or another activity.
• Establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens.
• Collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or the child's or teen's relationship with you, including what is needed to fulfill a transaction or provide a requested product or service, or where law requires or specifically authorizes it.
• Do not collect a child's or teen's personal information for targeted advertising to children or teens, and do not allow another person to collect, use, disclose or maintain it for that purpose.
• Do not retain a child's or teen's personal information longer than is reasonably necessary to fulfill a transaction or provide a service the child or teen requested, except as required for the safety or integrity of the service or specifically authorized by law.

Ark. Code Ann. secs. 4-88-1501 to 4-88-1505 (Act 952 of 2025) · Read the law's page

• If you operate a website, online service, online application or mobile application that you know collects personal information from children or teens, obtain consent from a teen or the teen's parent before collecting, using or disclosing the teen's personal information, unless the processing is for a purpose the Act lists (Section 4-88-1503(b)(2)).
• Give clear and conspicuous notice of what information you collect from children or teens, the purpose of processing it, your disclosure practices, the rights available to a parent or teen, and the categories of personal data and of third parties you share it with (Section 4-88-1503(b)(1)).
• Give the parent of a child the opportunity to request deletion of the child's account, content or information, to refuse further use or collection, and to challenge and correct inaccurate information, and a reasonable means to obtain the information you hold (Section 4-88-1503(b)(3)).
• Give a teen the opportunity at any time to delete personal information collected from the teen, to challenge its accuracy and have inaccurate information corrected, and a reasonable means to obtain it (Section 4-88-1503(b)(4)).
• Do not require a child to disclose more personal information than is reasonably necessary to take part in a game, the offering of a prize or another activity (Section 4-88-1503(b)(5)).
• Establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens (Section 4-88-1503(b)(6)).
• If your service is directed at children or teens, or you know you collect their personal information, do not collect it for targeted advertising to children or teens or allow another person to collect, use, disclose or maintain it for that purpose (Section 4-88-1503(a)(1)(B)).
• Collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or your relationship with the child or teen, or is required or specifically authorized by law (Section 4-88-1503(a)(1)(C)).
• Do not retain a child's or teen's personal information longer than is reasonably necessary to fulfill a transaction or provide a service the child or teen requested, except as required for the safety or integrity of the service or specifically authorized by law (Section 4-88-1503(a)(1)(D)).