Arkansas Advances Children and Teen Privacy Laws

On April 21, 2025, Arkansas Governor Sarah Huckabee Sanders signed three laws expanding privacy protections for children and teens. The Content Creation Protection Act passed the legislature and is pending signature. This blog summarizes the statutes’ key takeaways.

Arkansas Children and Teens’ Online Privacy Act

Arkansas Children and Teens’ Online Privacy Act (HB 1717) is modeled after the proposed expansion of the Children’s Online Privacy Protection Act (“COPPA”) in the federal COPPA 2.0 bill that stalled in 2024. HB 1717 provides privacy protections to individuals between ages 13 and 16 (“teens”). The law goes into effect on July 1, 2026.

• Applicability: HB 1717 applies to “operators” of a website, online service, online application, or mobile application that are “directed at children or teens” or when operators have actual knowledge that they are collecting personal information from children or teens.

• Targeted Advertising: HB 1717 prohibits an operator of a website, online service, online app, or mobile app directed at children or teens or with actual knowledge that it is collecting personal information from children or teens to collect personal information for the purposes of targeted advertising. There are a few exceptions such as “advertising based on the context of a consumer’s current search query or visit to a website or online application.”

• Notice, Consent, and Consumer Rights: An operator that has actual knowledge that it is collecting personal information from children or teens must:
  • Provide clear and conspicuous notice of certain uses, processing, and disclosures of personal data as well as the rights available to parents;
  • Obtain consent for the collection, use, or disclosure of personal information from a teen or a parent of a teen, subject to exceptions such as providing the specific product requested by a teen or to conduct the operator’s internal business operations;
  • Provide the opportunity to request deletion of the account of a child or teen;
  • Provide the opportunity to challenge the accuracy of and correct inaccurate personal information of a child or teen; and
  • Provide a means for a teen or a child’s parent to obtain personal information collected from that teen or child, respectively.

• Data Minimization: There are a few data minimization requirements layered throughout HB 1717. For example,an operator that has actual knowledge that it is collecting personal information from children shall “not require a child to disclose more personal information than is reasonably necessary to participate as a condition in (a) a game; (b) the offering of a prize; or (c) another activity.”

• Enforcement: The Attorney General has exclusive authority to enforce HB 1717.

SB 611

SB 611 amends the Arkansas Social Media Safety Act (the “Act”)—codified at Ark. Code § 4-88-1402—which was permanently enjoined by a federal district court on March 31, 2025. The court enjoined the original Social Media Safety Act on the grounds that it is a facially-content based restriction on speech and unconstitutionally vague.

The Act required social media platforms to verify the age of all account-seekers who reside in Arkansas through a third-party vendor using either government identification or other reasonable age verification methods. It further prohibited social media companies from permitting minor users to become an account holder without the express consent of a parent or legal guardian.

The SB 611 amendments to the Social Media Safety Act are effective one year after SB 611’s enactment on April 21, 2026.

• Definitions: SB 611 excludes entities such email service providers, not-for-profit organizations, schools, business-to-business software, common carriers, and broadband internet services from the definition of a “covered social media platform.” SB 611 redefines “minor” as an individual under the age of 16 from an individual under the age of 18.

• Product Features for Minors: Social media platforms are prohibited from engaging in certain specified practices with minors, including “notifications, recommended content, artificial sense of accomplishment, or engagement with online bots that appear human.” Social media platforms must ensure that the default settings for minor users are those that provide the most protective level of control for privacy and safety on the platform, including ceasing notifications during evening hours.

• Product Features for Parents: SB 611 requires that social media platforms develop an easily accessible online dashboard that: (i) allows parents of a minor user to view and understand their child’s use of the social media platform, and (ii) provides tools for a parent to restrict their child’s access to the platform or portions of the platform.

• Requirements for Social Media Platforms: Social media platforms must conduct a quarterly audit to ensure that the platform’s software, apps, or other products meet certain specifications. Additionally, platforms must implement technological measures to prevent circumvention of age verification protocols, such as limiting the use of false or repeated credentials.

• Enforcement: The Social Media Safety Act previously authorized the Attorney General to initiate enforcement actions against social media companies that violated the Act. SB 611 creates a private right of action for parents or guardians of minor children against a social media company that violates Ark. Code § 4-88-1402.

• Penalties: SB 611 increases the penalties for any social media platform in violation of the Act to $10,000 per violation, with each day that a minor is allowed to improperly access a social media platform constituting a separate violation.

SB 612

SB 612 creates an individual private right of action against social media platforms that cause its users harm.

• Prohibited Activities: Social media platforms are prohibited from using a design, algorithm, or feature that it knows, or should know through the exercise of reasonable care, causes a user to: (i) purchase a controlled substance; (ii) develop an eating disorder; (iii) commit or attempt to commit suicide; or (iv) develop or sustain an addiction to the social media platform.
  • Safe Harbor: The social media platform does not violate the law if it corrects within 30 days a design, algorithm, or feature that it discovers presents more than a de minimis risk of the listed harms. This safe harbor does not apply to features that cause a user to commit or attempt to commit suicide.

• Enforcement: SB 612 creates a private right of action for all users of a social media platform that knowingly and willfully commits a prohibited activity.

• Penalties: SB 612 creates penalties of $10,000 for each knowing and willful violation of the law. SB 612 also creates a separate cause of action for parents or guardians of minors who attempt to commit suicide or commit suicide because of exposure to online content promoting self-harm or suicide. Social media platforms that knowingly and willfully hosted, promoted, or shared this type of content are liable for actual and punitive damages, costs of medical treatments, funeral costs, and punitive damages, among others.
  • Social media platforms are not liable for displaying content that is created or hosted entirely by a third party. Civil actions must be brought within four years after the cause of action accrued.

Child Content Creation Protection Act

The Content Creation Protection Act (the “Act” or HB 1975) creates privacy protections and compensation requirements for minors that are featured in vlog, podcast, social media, and streaming content. If signed by the governor, the Act will be effective on July 1, 2026. While much of the Act focuses on the obligations that content creators have towards the minors featured in their content, the Act imposes obligations on social media platforms, including:

• Privacy Removal Requests: A social media platform must provide an easily accessible mechanism for minors featured in a content creator’s content or an adult who was featured in content when they were a minor to (i) delete the content from the social media platform or (ii) edit the content to remove the minor’s private information if the minor is uniquely identifiable. A social media platform must notify the content creator of their obligation to remove the content within 30 days.
  • Upon notification from a social media platform, the content creator must either delete the content or edit the content to remove the minor’s uniquely identifiable information within 72 hours of receipt of the notification. If the content creator does not act within 30 days, the minor may bring an action against the creator for injunctive relief, damages, and attorney’s costs.
  • If a content creator fails to remove or edit content within 30 days, the social media platform must take reasonable steps to remove the content unless: (i) the minor featured in the content does not submit sufficient or accurate information in their request or (ii) the social media platform finds that the content is sufficiently newsworthy to outweigh the privacy interests of the featured minor.

• Content that Intentionally Sexualizes a Minor: Social media platforms must develop and implement a risk-based strategy to minimize the risks related to the monetization of the intentional sexualization of minors in the context of content creation. The strategy may include policies governing content and monetization, content restrictions, and quality assurance processes, among others. Social media platforms must make information about its policies and settings publicly available and easily understandable to both adults and minors.