Law / United States / 
Arkansas
Student Online Personal Information Protection Act
Ark. Code Ann. sec. 6-18-109 (Act 1196 of 2015)
In force.
A sensitive categories rule binding private bodies.
- Instrument type
- an act of a legislature
- How the hook was established
- express
- What makes it apply
- User location
- Obligation class
- Prohibition, Retention, Security
- Audit expectation
- none
What it requires
- If you operate a website, online service, online application or mobile application that you know is used primarily for public school purposes, designed and marketed for them, and operating at capacity, do not knowingly target advertising based on covered information about a public school student that you acquired through the service, unless the public school, the student or the student's parent or guardian gives affirmative consent in response to clear and conspicuous notice (Ark. Code Ann. sec. 6-18-109(b)(1) and (e)).
- Do not knowingly use covered information to compile a profile about a public school student except in furtherance of public school purposes or with affirmative consent given in response to clear and conspicuous notice (sec. 6-18-109(b)(2) and (e)).
- Do not knowingly sell a public school student's covered information, other than in the purchase, merger or other acquisition of your business by an entity that is subject to the section (sec. 6-18-109(b)(3)).
- Disclose a public school student's covered information only as the section allows, such as in furtherance of public school purposes, to comply with law, or to a service provider you bind by contract to use it only for the contracted service, to keep it from further disclosure and to maintain reasonable security, or with affirmative consent given in response to clear and conspicuous notice (sec. 6-18-109(b)(4) and (e)).
- Implement and maintain reasonable security measures appropriate to the nature of the covered information you obtain, and protect it from unauthorized access, destruction, use, modification or disclosure (sec. 6-18-109(d)(1)).
- Delete a public school student's covered information within a reasonable time frame if the school or school district requests the deletion of covered information under its control (sec. 6-18-109(d)(2)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The section bars targeted advertising, profiling and sale of a public school student's covered information, limits disclosure, and requires reasonable security and deletion on a school's request. It names no log, no record the operator keeps and no reader of a record.
- Kind
- None
- As of
What this law does
The Student Online Personal Information Protection Act binds the operator of an internet website, online service, online application or mobile application with actual knowledge that it is used primarily for public school purposes, designed and marketed for public school purposes, and operating at capacity. An operator may not knowingly target advertising based on covered information it acquired through its website, service or application.
An operator may not knowingly use covered information to compile a profile about a public school student except in furtherance of public school purposes. An operator may not knowingly sell a public school student's covered information, other than in the purchase, merger or other acquisition of the operator by another entity that is subject to the section.
An operator may disclose a public school student's covered information only for the purposes the section lists, such as furtherance of public school purposes, legal compliance, or a service provider bound by contract to use it only to provide the contracted service. An operator must implement and maintain reasonable security measures appropriate to the nature of the covered information it obtains.
An operator must delete a public school student's covered information within a reasonable time frame if the school or school district requests the deletion of covered information under its control. Covered information includes a student's biometric information, medical or health records and geolocation information.
The section does not apply to general audience websites, services or applications, even if login credentials created on the operator's website, service or application are used to access them. Act 1196 of 2015 added the section to Subchapter 1 of Chapter 18 of Title 6 of the Arkansas Code. An operator does not include a school district or an open-enrollment public charter school.
The bars on targeted advertising, profiling and disclosure do not prohibit a use or disclosure of covered information with the affirmative consent of the public school, the student, or the student's parent or guardian, given in response to clear and conspicuous notice of the use or disclosure. The section does not prohibit an operator from using covered information to maintain, develop, support, improve or diagnose its website, service or application.
The section does not prohibit an operator from using aggregated or deidentified covered information within its own services to develop or improve educational products, or to demonstrate the effectiveness of its website, service or application.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .