NewsData Privacy Laws

Arkansas Teen Online Privacy Law (Act 952) Now in Effect

Independently fact-checkedBy Recording Law Editorial Team9 min read

Independently fact-checked against primary sources (last audited July 2, 2026). · 2 primary sources cited on this page. How we verify our legal content

Arkansas Teen Online Privacy Law (Act 952) Now in Effect

Arkansas Teen Online Privacy Law Takes Effect: COPPA-Style Rules Now Cover Ages 13-16

Arkansas began enforcing its Children and Teens' Online Privacy Protection Act on July 1, 2026. The law, passed in 2025 as Act 952 (HB 1717), extends COPPA-style consent and data rules to minors up to age 16, a step no state had taken in a standalone statute before.

Information last verified on July 2, 2026. This is a developing story; we update it as the record changes.

Status: Signed into law (2025); effective July 1, 2026.

Jurisdiction scope: This article covers Arkansas Act 952 (HB 1717) and how it compares to the federal Children's Online Privacy Protection Act (COPPA). It does not analyze other states' minor-privacy or age-verification laws, which differ in scope, ages covered, and enforcement.

What Happened

On July 1, 2026, the Arkansas Children and Teens' Online Privacy Protection Act became effective. The General Assembly passed the measure as House Bill 1717, and the Governor signed it in April 2025, where it was enrolled as Act 952 of the 2025 Regular Session.

The Act sets two age bands. It defines a "child" as an Arkansas resident 12 and under and a "teen" as an Arkansas resident aged 13 to 16. Federal COPPA, by contrast, reaches only children under 13, so Arkansas extends comparable protections to an older group for the first time in a standalone state statute.

The statute applies to for-profit operators of websites, online services, and applications that are directed to children or teens, or that have "actual knowledge" they are collecting a minor's personal information. Under the Act, covered operators may not collect personal information from a child or teen for targeted advertising, and they may not let another party collect, use, disclose, or keep that data for targeted advertising.

Consent rules turn on the age band. Operators must obtain verifiable parental consent before collecting personal information from a child under 13. For teens aged 13 to 16, the Act allows either the teen or a parent to give consent.

The Arkansas Attorney General holds exclusive authority to enforce the law and may seek injunctive relief and civil penalties. The Act does not create a private right of action, so individuals cannot sue operators directly under it.

Children and teens online data privacy and parental consent

What the Law Actually Says

Congress enacted the federal COPPA in 1998 to govern how online operators collect data from children under 13. COPPA requires notice and verifiable parental consent before an operator collects a young child's personal information, and it is enforced primarily by the Federal Trade Commission. You can read our plain-language overview of the federal COPPA / children's online privacy framework for background.

Arkansas builds on that model and pushes it further. Legal analysts have described Act 952 as inspired by the proposed federal "COPPA 2.0" expansion that stalled in Congress in 2024, which would have added a teen tier and a targeted-advertising restriction. Arkansas adopted that two-tiered structure at the state level.

Under Act 952, a covered operator with actual knowledge that it collects a minor's data must provide a clear privacy notice, obtain the required consent, and honor rights to access, correct, and delete personal information. The Act also imposes data-minimization and purpose-limitation duties and requires reasonable security practices. The statute defines personal information broadly, reaching contact details and identifiers as well as categories such as geolocation and biometric data.

The targeted-advertising restriction is central. The Act bars operators from collecting a child's or teen's personal information for targeted advertising, which effectively limits behavioral ad targeting to Arkansas users the operator knows are under 16.

Enforcement runs through the state. The Attorney General may pursue violations, and the Act channels remedies through that office rather than private lawsuits. For how these rules sit alongside Arkansas's broader consumer-data regime, see our overview of Arkansas data privacy and breach rules. To compare Arkansas with other jurisdictions, see our guide to children's online privacy laws by state.

Arkansas Attorney General enforcement of teen privacy rules

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The significance of Act 952 lies in the age line it moves. Federal COPPA has drawn its boundary at 13 since 1998, and most compliance systems, including age screens and parental-consent flows, are built around that number. Arkansas keeps the under-13 tier and adds a 13-to-16 tier with its own consent path, which means operators cannot simply rely on their existing COPPA controls to cover Arkansas teens.

Several law firms and privacy organizations tracking the measure have called it the first state statute to extend the core COPPA framework to teens. We attribute that framing to those sources rather than asserting it independently, because minor-privacy laws vary and other states regulate minors through different mechanisms such as age-appropriate design codes and age-verification mandates.

The targeted-advertising restriction and the "actual knowledge" trigger are the provisions most likely to shape day-to-day compliance. Because the Act reaches operators that know they are collecting a minor's data, how a company treats age signals it already holds becomes a practical question. We do not predict how the Attorney General will interpret or prioritize enforcement, and nothing here forecasts specific outcomes.

How This Affects You

If you are an Arkansas parent, the law gives you a formal role in consent for children under 13 and a shared role for teens 13 to 16, along with rights to access, correct, and delete your child's data held by covered operators. If you are a teen aged 13 to 16 in Arkansas, the Act recognizes your ability to consent in your age band and gives you rights over your own personal information.

If you operate a website, app, or online service that is directed to minors or that knows it collects data from Arkansas users under 16, the effective date has passed and the obligations now apply. That generally means reviewing consent flows, privacy notices, targeted-advertising practices, deletion and correction processes, and security measures against the Act's requirements. This is general information, not compliance advice for any specific product. For the wider landscape, see our overview of state data privacy laws.

This is general legal information, not legal advice. It covers Arkansas law and reflects sources verified on July 2, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Sources

Last updated: 2026-07-02. This is a developing story; details verified as of 2026-07-02.

Frequently Asked Questions

What is the Arkansas Children and Teens' Online Privacy Protection Act?

It is a 2025 Arkansas law, enacted as Act 952 (HB 1717), that extends COPPA-style privacy protections to minors. It took effect on July 1, 2026 and sets consent, notice, data-rights, and security rules for operators that collect personal information from children and teens.

When did the law take effect?

The Act became effective on July 1, 2026. The General Assembly passed HB 1717 in 2025, and the Governor signed it in April 2025 as Act 952 of the 2025 Regular Session.

Which ages does the law cover?

The Act defines a child as an Arkansas resident 12 and under and a teen as an Arkansas resident aged 13 to 16. Federal COPPA, by comparison, covers only children under 13.

What are the consent rules?

Operators must obtain verifiable parental consent to collect personal information from a child under 13. For teens aged 13 to 16, either the teen or a parent may give consent, according to the Act.

Does the law restrict targeted advertising to minors?

Yes. The Act bars covered operators from collecting a child's or teen's personal information for targeted advertising, and from allowing others to use that data for targeted advertising.

Who enforces the law, and can individuals sue?

The Arkansas Attorney General has exclusive enforcement authority and may seek injunctive relief and civil penalties. The Act does not create a private right of action, so individuals cannot sue operators directly under it.

How is this different from federal COPPA?

Federal COPPA regulates data collection from children under 13. Arkansas keeps that tier and adds a second tier for teens aged 13 to 16, along with a targeted-advertising restriction. Sources describe it as the first state law to extend the full COPPA framework to teens.

Updates

Independently fact-checked against the cited primary sources

Sources and References

  1. Arkansas General Assembly, Act 952 of the 2025 Regular Session (full text of HB 1717)(arkleg.state.ar.us).gov
  2. Arkansas General Assembly, HB 1717 bill information and status(arkleg.state.ar.us).gov
  3. WilmerHale, Arkansas Online Privacy Act Expands Privacy Protections for Children and Teens(wilmerhale.com)
  4. Davis Wright Tremaine, Arkansas Adopts Privacy Law To Extend COPPA-Like Protections to Teens(dwt.com)
  5. Alston & Bird, Arkansas Enacts Children and Teens Online Privacy Protection Act(alstonprivacy.com)
Share: