Law / United States / 
Arkansas
Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025), consent, notice, deletion and security duties for children's and teens' personal information
Ark. Code Ann. secs. 4-88-1501 to 4-88-1505 (Act 952 of 2025)
In force since .
A data subject rights rule binding private bodies.
- Private right of action
- No
- Enforcement body
- Arkansas Attorney General, with exclusive authority to enforce the Act.
- Obligation class
- Consent, Data subject rights, Disclosure, Retention, Security
As of .
What it requires
- If you operate a website, online service, online application or mobile application that you know collects personal information from children or teens, obtain consent from a teen or the teen's parent before collecting, using or disclosing the teen's personal information, unless the processing is for a purpose the Act lists (Section 4-88-1503(b)(2)).
- Give clear and conspicuous notice of what information you collect from children or teens, the purpose of processing it, your disclosure practices, the rights available to a parent or teen, and the categories of personal data and of third parties you share it with (Section 4-88-1503(b)(1)).
- Give the parent of a child the opportunity to request deletion of the child's account, content or information, to refuse further use or collection, and to challenge and correct inaccurate information, and a reasonable means to obtain the information you hold (Section 4-88-1503(b)(3)).
- Give a teen the opportunity at any time to delete personal information collected from the teen, to challenge its accuracy and have inaccurate information corrected, and a reasonable means to obtain it (Section 4-88-1503(b)(4)).
- Do not require a child to disclose more personal information than is reasonably necessary to take part in a game, the offering of a prize or another activity (Section 4-88-1503(b)(5)).
- Establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens (Section 4-88-1503(b)(6)).
- If your service is directed at children or teens, or you know you collect their personal information, do not collect it for targeted advertising to children or teens or allow another person to collect, use, disclose or maintain it for that purpose (Section 4-88-1503(a)(1)(B)).
- Collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or your relationship with the child or teen, or is required or specifically authorized by law (Section 4-88-1503(a)(1)(C)).
- Do not retain a child's or teen's personal information longer than is reasonably necessary to fulfill a transaction or provide a service the child, teen or parent requested, except as required for the safety or integrity of the service or specifically authorized by law (Section 4-88-1503(a)(1)(D)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Act 952 of 2025 adds Subchapter 15 to Chapter 88 of Title 4 of the Arkansas Code and names it the Arkansas Children and Teens' Online Privacy Protection Act. It takes effect on . It binds an operator of a website, online service, online application or mobile application that is directed at children or teens, or that has actual knowledge it is collecting personal information from children or teens. A child is an individual twelve years of age or younger.
A teen is an individual located in Arkansas who is thirteen years of age or older and younger than seventeen. The operator must obtain consent for the collection, use or disclosure of a teen's personal information from the teen or the teen's parent, except for purposes the Act lists. The operator must give clear and conspicuous notice of what information it collects from children or teens, the purpose of processing it, and its disclosure practices.
The parent of a child must be able to request deletion of the child's account, content or information and to refuse further collection of the child's personal information. A teen must be able at any time to delete personal information collected from the teen and to challenge its accuracy and have inaccurate information corrected. The operator may not collect a child's or teen's personal information for targeted advertising to children or teens, or let another person do so.
It may collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or its relationship with the child or teen, or is required or specifically authorized by law. It may not retain that information for longer than is reasonably necessary to fulfill a transaction or provide a service the child, teen or parent requested, except as required for the safety or integrity of the service or specifically authorized by law.
The operator must establish, implement and maintain reasonable security practices to protect the personal information of children and teens. The Act does not require an operator to collect age information it is not already collecting or to implement age verification. The Attorney General has exclusive authority to enforce the Act, and it creates no private right of action.
When LexLint raises it
When your app profile says your app serves under-18s.