On April 21, 2025, Arkansas Governor Sarah Huckabee Sanders signed HB 1717 into law. HB 1717, which will take effect on July 1, 2026, prohibits operators of online services "directed at children" or operators with "actual knowledge" that they are collecting personal information from children or teens from collecting the personal information of children or teens for the purposes of targeted advertising.
The law, which is modeled after the Children's Online Privacy Protection Act (15 U.S.C. 6501–6505) and a proposed federal bill to amend COPPA ("COPPA 2.0"), draws on familiar privacy law principles of notice, consent, data minimization, and rights for consumers. Like COPPA, the law imposes obligations on operators that collect personal information from children under the age of thirteen but then goes beyond COPPA by imposing similar obligations on personal information collected from teens ages thirteen to sixteen. While other comprehensive privacy laws have created some privacy protections for teenagers for specific data processing activities (e.g., the California Consumer Privacy Act), HB 1717 is the first law of its kind in terms of expanding the full breadth of children's privacy protections for teens. It is unlikely that Arkansas will be the last state in this regard, given that children's privacy tends to be a bipartisan issue.
In this post, we identify notable takeaways from HB 1717 and summarize its key provisions. We are happy to answer any questions you have about this law and its potential implications for your company's privacy compliance efforts. To stay up to date on the latest health privacy law developments, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.
KEY TAKEAWAYS
- Protection for Children and Teens: HB 1717's prohibitions on the collection of personal information for the purposes of targeted advertising apply to information "operators" collect from children under the age of thirteen and teens between the ages of thirteen and sixteen. This meaningfully expands the scope of children's privacy protections in the United States and may require businesses to rework their compliance programs.
- Data Minimization: HB 1717 places limits on retaining the personal information of a child or teen for longer than is reasonably necessary to fulfill the purpose for which the information was collected. HB 1717 also prohibits operators from conditioning participation in a game or winning a prize offering on how much information the child discloses. While this is a relatively moderate data minimization standard (especially compared to a law like Maryland's comprehensive privacy law), it still requires businesses to evaluate their practices in light of this standard.
- Specific Compliance Obligations for Operators: HB 1717 imposes obligations on an operator with "actual knowledge" that it is collecting personal information from children or teens, including providing a privacy notice, obtaining consent, granting rights to delete, access, or correct, imposing data minimization and purpose limitations, and maintaining adequate security practices.
KEY PROVISIONS OF HB 1717
Definitions
- Child: HB 1717 defines as "an individual twelve (12) years of age or younger in the State of Arkansas." A.C.A. § 4-88-1502(1).
- Teen: HB 1717 defines as "an individual located in the State of Arkansas who is: (A) Thirteen (13) years of age or older; and (B) Younger than seventeen (17) years of age." A.C.A. § 4-88-1502(1).
- Operator: HB 1717 defines as "a person who, for commercial purposes, operates or provides a website on the internet, an online service, an online application, or a mobile application, and who: (i) Collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application; or (ii) Allows another person to collect personal information directly from users of that website, service, or application, in which case, the operator is deemed to have collected the information." A.C.A. § 4-88-1502(9)(A).
- Targeted Advertising: HB 1717 defines as "displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict that consumer's preferences or interests." A.C.A. § 4-88-1502(15)(A).
- Consent: HB 1717 defines as "any
reasonable effort, taking into consideration available technology
and including without limitation a request for authorization for
future collection, use, and disclosure described in the notice, to
ensure that in the case of a teen, the parent of a teen or the
teen:
- (A) Receives notice of the personal information collection, use, and disclosure practices of the operator; and
- (B) Before the personal information of the teen is collected,
freely and unambiguously authorizes, including without limitation
the giving of consent through an operator's terms of service or
acknowledgement of the operator's privacy policy:
- (i) The collection, use, and disclosure, as applicable, of the teen's personal information; and
- (ii) Any subsequent use of the teen's personal information." A.C.A. § 4-88-1502(3).
Applicability
- HB 1717 applies to businesses that operate or provide websites,
online services, or online/mobile applications (i.e.,
"operators"), which are "directed at children or
teens." The law's provisions also apply to operators who
have "actual knowledge that [they are] collecting personal
information from children or teens." A.C.A. §
4-88-1503(a)(1).
- Although the law lacks a definition for "actual knowledge," there is no affirmative duty placed on businesses to collect information related to the child or teen's age or implement age verification functionalities. See A.C.A. § 4-88-1505(1)-(2).
Exemptions
- State Entities and Nonprofits: HB 1717 excludes nonprofits exempt from coverage under Section 5 of the Federal Trade Commission Act (15 28 U.S.C. § 45 et seq.), state public schools, and state governmental entities from its definition of "operator." A.C.A. § 4-88-1502(9)(B).
- Interactive Gaming Platforms: HB 1717 also excludes "interactive gaming platform[s]" that comply with COPPA's requirements, rules, guidance, and exemptions from its definition of "operator." A.C.A. § 4-88-1502(9)(B).
Substantive Requirements
- Prohibition on Collecting and Maintaining Personal Information for Targeted Advertising: HB 1717 makes it unlawful for operators of online services "directed at children" or with "actual knowledge" that they are collecting personal information from children or teens to collect (or allow another person to collect) or maintain personal information from children or teens for purposes of targeted advertising. See A.C.A. § 4-88-1503(a)(1)(B).
- Exceptions for Collection Pursuant to a Requested Service, Business Relationship or Legal Purpose: HB 1717 allows operators to collect the personal information of a child or teen when the collection is consistent with a business relationship the child or teen has with the operator (e.g., fulfilling a financial transaction), when collection is made to provide a product or service the child or teen (or parent of the child or teen) requested, or when required by law. See A.C.A. § 4-88-1503(a)(1)(C).
- Prohibition on Retention: HB 1717 prohibits operators from retaining the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide the requested service unless the retention is required by law or to protect the safety of the service. See A.C.A. § 4-88-1503(a)(1)(D).
- Obligations for Operators with "Actual
Knowledge": HB 1717 imposes additional
obligations on an operator with "actual knowledge that it is
collecting personal information from children or teens,"
including (see A.C.A. § 4-88-1503(b)):
- Privacy Notice: Operators shall provide a privacy notice that include (i) what information the operator collected from children or teens; (ii) the purpose for processing personal data; (iii) the operator's disclosure practices for such information; (iv) the rights and opportunities available to the child or teen (or parent) under the law; (v) the categories of personal data shared with third parties, if any; and (vi) the categories of third parties, if any, that the controller shares personal data with.
- Consent: Operators shall obtain consent from a teen (or the teen's parent) to collect, use, or disclose personal information, except when processing is to provide a specific product, conduct internal business operations, protect against fraud, comply with the law, or another legitimate purpose stated in the law.
- Rights to Access, Delete, and Correct: Operators shall provide the child or teen (or parent) with the opportunity to request that the account with the child or teen's personal information be deleted, to have inaccurate personal information corrected, and to obtain any personal information the operator has collected from the child or teen upon request.
- Data Minimization: Operators shall not require a child to disclose more personal information than is reasonably necessary as a precondition for the child to participate in a game, prize offering, or other activity.
- Security Practices: Operators shall establish, implement, and maintain reasonable security practices to protect the personal information of children or teens from unauthorized access.
Enforcement
The Attorney General has exclusive enforcement authority and may bring a civil action to obtain damages, restitution, or other compensation on behalf of Arkansas residents.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
