Law / United States / 
Arkansas
Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act
Act 952 of 2025 (HB1717), adding a subchapter to Ark. Code Ann. Title 4, Chapter 88
In force since .
A social media and minors rule binding private bodies.
- Enforcement body
- Arkansas Attorney General, with exclusive authority to enforce the Act.
As of .
What it requires
- The consent, notice, rights and security duties below apply to an operator of a website, online service, online application or mobile application that has actual knowledge that it is collecting personal information from children or teens; the limits on collection, targeted advertising and retention also apply to an operator directed at children or teens. A child is 12 or younger and a teen is 13 to 16.
- Obtain consent from a teen or the teen's parent before collecting, using or disclosing the teen's personal information, unless the processing is for a purpose the Act lists, such as providing the product or service the teen requested, protecting against fraud or security incidents, or complying with law.NIST Privacy FrameworkCT.PO-P1
- Provide clear and conspicuous notice of what information you collect from children or teens, the purpose of processing it, your disclosure practices, the rights available to the parent of a child or to a teen, and the categories of data and of third parties you share it with.NIST Privacy FrameworkCM.AW-P1
- Give the parent of a child the opportunity to request deletion of the child's account, content or information, to refuse further use or collection, and to challenge and correct inaccurate information, and give a reasonable means to obtain the information you hold.NIST Privacy FrameworkCT.PO-P3
- Give a teen the opportunity at any time to delete personal information collected from the teen, to challenge its accuracy and have inaccurate information corrected, and a reasonable means to obtain it.NIST Privacy FrameworkCT.PO-P3
- Do not require a child to disclose more personal information than is reasonably necessary to take part in a game, the offering of a prize or another activity.NIST Privacy FrameworkCT.DP-P4
- Establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens.NIST Privacy FrameworkPR.DS-P5
- Collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or the child's or teen's relationship with you, including what is needed to fulfill a transaction or provide a requested product or service, or where law requires or specifically authorizes it.NIST Privacy FrameworkCT.PO-P1
- Do not collect a child's or teen's personal information for targeted advertising to children or teens, and do not allow another person to collect, use, disclose or maintain it for that purpose.NIST Privacy FrameworkCT.PO-P1
- Do not retain a child's or teen's personal information longer than is reasonably necessary to fulfill a transaction or provide a service the child or teen requested, except as required for the safety or integrity of the service or specifically authorized by law.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
4 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it reaches
Age threshold
17
Covered services
Operators of websites, online services, online applications and mobile applications directed at children or teens, or with actual knowledge that they collect personal information from children or teens. Excludes nonprofits exempt under section 5 of the Federal Trade Commission Act, interactive gaming platforms that comply with the federal Children's Online Privacy Protection Act, state and local government bodies, and public educational entities.
Obligation class
Consent, Data subject rights, Disclosure, Retention, Security
Verification methods
Parental consent
What this law does
A child is an individual twelve years of age or younger in Arkansas. A teen is an individual located in Arkansas who is thirteen years of age or older and younger than seventeen.
The duties below apply to an operator of a website, online service, online application or mobile application that has actual knowledge that it is collecting personal information from children or teens. The operator must obtain consent for the collection, use or disclosure of a teen's personal information from the teen or the teen's parent, except for purposes the Act lists.
The operator must provide clear and conspicuous notice of what information it collects from children or teens, the purpose of processing it, and its disclosure practices.
The operator must give the parent of a child the opportunity to request deletion of the child's account, content or information and to refuse further collection of the child's personal information, and to challenge and correct inaccurate information. The operator must give a teen the opportunity at any time to delete personal information collected from the teen, and to challenge the accuracy of that information and have inaccurate information corrected.
The operator must establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens.
It is also unlawful for an operator directed at children or teens, or one with actual knowledge that it collects their personal information, to collect that information for targeted advertising to children or teens, to collect it outside the context of a service or the child's or teen's relationship with the operator unless law requires or authorizes it, or to retain it longer than is reasonably necessary to fulfill a transaction or provide a requested service, except as required for the safety or integrity of the service or specifically authorized by law.
The Act does not require an operator to affirmatively collect age information it is not already collecting in the normal course of business, or to implement age-gating or age verification functionality.
The Attorney General has exclusive authority to enforce the Act, and the Act creates no private right of action. A violation of the teen consent duty or of the duties owed to the parent of a child is treated as an unfair or deceptive act or practice under the Deceptive Trade Practices Act.
The Act was approved on . The Act is effective on and after .
When LexLint raises it
When your app profile says your app serves under-18s.