(B) "Operator" does not include:

(i) Any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act, 15 U.S.C.

§ 45 et seq.;

(ii) An interactive gaming platform that complies with the requirements of the Children's Online Privacy Act, 15 U.S.C.

§ 6501, and the rules, guidance, and exemptions under that act;

(iii) An agency, board, commission, institution, or other instrumentality of the State of Arkansas or its political subdivisions;

or (iv) A public educational entity of the State of 04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 Arkansas, including without limitation a school district and an institution of higher learning;

(10) "Parent" means a natural parent, adoptive parent, legal guardian, or legal custodian of an individual who is sixteen (16) years of age or younger;

(11) "Person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity;

(12)(A) "Personal information" means individually identifiable information about an individual collected online, including without limitation:

(i) A first and last name;

(ii) A home or other physical address including street name and name of the city or town of residence;

(iii) An e-mail address;

(iv) A telephone number;

(v) A Social Security number;

(vi) Any other identifier that permits the physical or online contacting of a specific individual;

(vii) Geolocation information sufficient to identify a street name and a city or town;

(viii) Information generated from the measurement or technological processing of an individual's biological, physical, or physiological characteristics that is used to identify an individual, including without limitation:

(a) Fingerprints;

(b) Voice prints;

(c) Iris or retina imagery scans;

(d) Facial templates;

(e) Deoxyribonucleic acid (DNA) information;

or (f) Gait;

(ix) Information linked or reasonably linkable to a child or teen;

or (x) Information linked or reasonably linkable to a child or teen or the parents of that child or teen, including without limitation any unique identifier, that an operator collects online from the 04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 child or teen and combines with an identifier described in this subdivision (11)(A).

(B) "Personal information" does not include an audio file that contains a child or teen’s voice so long as the operator:

(i) Does not request information via voice that would otherwise be considered personal information under subdivision (11)(A) of this section;

(ii) Provides clear notice of its collection and use of the audio file and its deletion policy in its privacy policy;

(iii) Uses the voice within the audio file as a replacement for written words, to perform a task, or engage with a website, online service, online application, or mobile application, such as to perform a search or fulfill a verbal instruction or request;

and (iv) Only maintains the audio file long enough to complete the stated purpose and improve or enhance the users' experience of the service and then deletes the audio file when it is no longer reasonably needed and does not make any other use of the audio file before deletion;

(13) "Processor" means a person that processes personal information on behalf of an operator;

(14)(A) "Social media platform" means a public or semipublic Internet-based service or application that:

(i) Is used by a consumer in this state;

(ii) Is primarily intended to connect and allow users to socially interact within that service or application;

and (iii) Enables a user to:

(a) Construct a public or semipublic profile for the purposes of signing into and using the service or application;

(b) Populate a public list of other users with whom the user shares a social connection within that service or application;

and (c) Create or post content that is viewable by other users, including without limitation on message boards, in chat rooms, or through a landing page or main feed that presents the user with content that is generated by other users.

(B) "Social media platform" does not include a public or semipublic Internet-based service or application that:

04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 (i) Exclusively provides electronic mail or direct messaging services;

(ii) Primarily consists of news, sports, entertainment, interactive video games, electronic commerce, or content that is preselected by the provider or for which any chat, comments, or interactive functionality is incidental to, directly related to, or dependent or a student engagement program;

(iii) Primarily provides career development opportunities, including without limitation professional networking, job skills, learning certifications, and job posting and application services;

or (iv) Is used by and under the direction of an educational entity, including without limitation a learning management system or a student engagement program;

(15)(A) "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict that consumer's preferences or interests.

(B) "Targeted advertising" does not include:

(i) Advertising based on activities within a controller's own websites or online applications;

(ii) Advertising based on the context of a consumer's current search query or visit to a website or online application;

(iii) Advertising directed to a consumer in response to the consumer's request for information or feedback;

or (iv) Processing of personal data that is processed solely for measuring or reporting advertising performance, reach, or frequency;

(16) "Teen" means an individual located in the State of Arkansas who is:

(A) Thirteen (13) years of age or older;

and (B) Younger than seventeen (17) years of age;

and (17) "Third party" means a person, public authority, agency, or body other than the consumer, operator, processor, or an affiliate of the processor or the operator.

6 04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 4-88-1503.

Personal information from and about children and teens — Online collection and use.

(a)(1) Except as provided in subdivision (a)(2) of this section, it is unlawful for an operator of a website, online service, online application, or mobile application directed at children or teens or for any operator of a website, online service, online application, or mobile application with actual knowledge that it is collecting personal information from children or teens:

(A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;

(B) Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen personal information of a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this information for targeted advertising to children or teens;

(C) To collect the personal information of a child or teen except when the collection of the personal information is:

(i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen;

or (ii) Required or specifically authorized by law;

or (D) To retain the personal information of a child or teen for longer that is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law.

(2) Neither an operator nor the operator’s agent shall be liable for a disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subdivision (b)(3)(A) of this section to the parent of a child or to a teen under subdivision (b)(4)(A) of this section.

(b) An operator of a website, online service, online application, or mobile application that has actual knowledge that it is collecting personal information from children or teens shall:

(1) Provide clear and conspicuous notice of:

04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 (A) What information is collected from children or teens by the operator;

(B) The purpose for processing personal data;

(C) The operator’s disclosure practices for such information;

(D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section;

(E) The categories of personal data that the controller shares with third parties, if any;

and (F) The categories of third parties, if any, with whom the controller shares personal data;

(2) Obtain consent for the collection, use, or disclosure of personal information from a teen from a parent of a teen or a teen, except when the processing is for:

or (G) Protecting the vital interests of a natural person;person;" AND Page 8, delete lines 1 through 15 LJH280 - 04-01-2025 10:15Amendment No.

or2 (H)to ProvidingHouse orBill maintaining1717 aPage specific4 productof or5 serviceThe requestedAmendment bywas read the teen;first time, rules suspended and read the second time and _______________________ By:

(3)Senator Provide:J.

(A)Boyd TheLJH/LJH opportunity- to:04-01-2025 10:15:06 _________________________ LJH280 Secretary LJH280 - 04-01-2025 10:15:06 Amendment No.

(i)2 Requestto atHouse anyBill time1717 thePage deletion5 of the5 account of the child or content or information submitted by the child to a website, 04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 online service, online application, or mobile application and to refuse at any time to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child;

and (ii) Challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected;

and (B) A means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child, if that information is available to the operator at the time the parent makes the request;

(4) Provide:

(A) The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;

(B) The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected;

and (C) A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the information is available to the operator at the time the teen makes the request;

(5) Not require a child to disclose more personal information than is reasonably necessary to participate as a condition to participate in:

(A) A game;

(B) The offering of a prize;

or (C) Another activity;

and (6) Establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and protect the personal information against unauthorized access.

(c) Verifiable consent under subdivision (b)(2)(A) of this section is not required in the case of:

04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 (1) Online contact information collected from a child or teen that is used only to respond directly on a one-time basis to a specific request from the child or teen and is not used to recontact the child or teen or to contact another child or teen and is not maintained in retrievable form by the operator;

(2) A request for the name or online contact information of a parent or teen that is used for the sole purpose of obtaining verifiable consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if verifiable consent is not obtained after a reasonable time;

(3) Online contact information collected from a child or teen that is used only to respond more than once directly to a specific request from the child or teen and is not used to recontact the child or teen beyond the scope of that request if, before any additional response after the initial response to the child or teen, the operator uses reasonable efforts to provide a parent or teen notice of the online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form;

and (4) The name of the child or teen and online contact information, to the extent reasonably necessary to protect the safety of a child or teen participant on the site:

(A) Used only for the purpose of protecting such safety;

(B) Not used to recontact the child or teen or for any other purpose;

and (C) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent or teen notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form;

or (5) The collection, use, or dissemination of such information by the operator necessary to:

(A) Protect the security or integrity of its website;

(B) Take precautions against liability;

04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 (C) Respond to judicial process;

(D) Protect the security or safety of the user on the service;

or (E) Provide information to law enforcement agencies or for an investigation on a matter related to public safety.

(d)(1) An operator may terminate service provided to a child whose parent has refused or a teen who has refused under subdivision (b)(2) of this section to permit the operator's further use or maintenance in retrievable form or future online collection of personal information from that child or teen.

(2) An operator shall not discontinue service provided to a child or teen on the basis of a request by the parent or the child or by the teen under subdivision (b)(3)(B)(i) of this section to delete personal information collected from the child or teen, to the extent that the operator is capable of providing this service without the personal information.

(3) A request made under subdivisions (b)(3)(B)(i) of this section to delete personal information of a child or teen shall not be construed to:

(A) Limit the authority of a law enforcement agency to obtain any content or information from an operator under a lawfully executed warrant or an order of a court of competent jurisdiction;

(B) Require an operator or third party to delete information that:

(i) Another law requires the operator or third party to maintain;

or (ii) Was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including without limitation content or information submitted by the user that was republished or resubmitted by another person;

and (C) Prohibit an operator from:

(i) Retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made under subsection (b) of this section;

(ii) Preventing, detecting, protecting against, or responding to a security incident, identity theft, fraud, or the reporting of 04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 a person responsible for a security incident, identity theft, or fraud;

(iii) Protecting the integrity or security of a website, online service, online application, or mobile application;

or (iv) Ensuring that the child or teen's personal information remains deleted.

(e) Except as provided under § 4-88-1503 and § 4-88-1505, a violation of subdivisions (b)(2) and (b)(3) of this section shall be treated as an unfair or deceptive act or practice prescribed under the Deceptive Trade Practices Act, § 4-88-101 et seq.

4-88-1504.

Enforcement.

(a) In a case in which the Attorney General has reason to believe that an interest of the residents of the state has been or is threatened or adversely affected by the engagement of any person in a practice that violates the provisions of this subchapter, the Attorney General may bring a civil action on behalf of the residents of the state in a court of competent jurisdiction to:

(1) Enjoin that practice;

(2) Enforce compliance with the rule;

(3) Obtain damages, restitution, or other compensation on behalf of residents of the state;

or (4) Obtain other relief that the court finds appropriate.

(b)(1) The Attorney General shall have exclusive authority to enforce this subchapter.

(2) Nothing in this subchapter provides the basis for, or subjects an operator, processor, or person to a private right of action for a violation of this subchapter or any other law.

4-88-1505.

Construction.

This subchapter shall not be construed to require an operator to:

(1) Affirmatively collect any personal information regarding the age of a child or teen that an operator is not already collecting in the normal course of business;

or (2) Implement an age-gating or age verification functionality.

SECTION 2.

DO NOT CODIFY.

SEVERABILITY CLAUSE.

04-07-2025 14:27:20 LJH194 As Engrossed:

S3/31/25 S4/2/25 S4/7/25 HB1717 If any provision of this act or the application of this act to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of this act which can be given effect without the invalid provision or application, and to this end, the provisions of this act are declared severable.

7 SECTION 3.

DO NOT CODIFY.

EFFECTIVE DATE.

This act shall be effective on and after July 1, 2026.

/s/Gramlich APPROVED:

4/21/25 13 04-07-2025 14:27:20 LJH194