Arkansas Children’s Privacy Laws (2026)

Enacted, enjoined · Social media · effective 2023-09-01 · binds operators, platforms

Ages: under 18

Requires: Social media platforms must verify the age of account holders via a third-party vendor and obtain parental consent before a minor (under 18) may create an account.

Litigation: NetChoice, LLC v. Griffin, No. 5:23-cv-05105 (W.D. Ark.). PI 2023-08-31; permanent injunction 2025-03-31. Appeal (8th Cir. No. 25-1889) was CONSOLIDATED with Nos. 26-1096 and 26-1962 (the State's appeals of the Act 901 and Act 900 preliminary injunctions) by court order dated 2026-05-27, which removed the case from the June 2026 oral-argument calendar and says the cases will be rescheduled for argument after briefing is completed in all of them. The State's opening brief in No. 26-1962 was approved and filed 2026-08-10, and a 2026-08-28 clerk order extended NetChoice's combined response brief in Nos. 26-1096 and 26-1962 to 2026-10-09. No argument date has been set. The permanent injunction remains in effect throughout.

Entry last reviewed 2026-10-01

Enacted, enjoined · Social media · effective 2026-04-21 · binds operators, platforms

Ages: under 16

Requires: Amends the Social Media Safety Act: lowers the age line for age verification and parental consent from under 18 to under 16, and requires platforms to block circumvention of age verification, including by monitoring false or repeated credentials and accounts registered outside Arkansas and used inside it. Section 2 bars practices that evoke addiction or compulsive use in minors (including through notifications, recommended content, or human-seeming bots), requires minors' non-safety notifications to be off by default from 10pm to 6am CST (a parent may change this) and their privacy and safety settings to default to the most protective level, and requires quarterly compulsive-use audits and a parent dashboard to view and restrict a child's use. Adds a parent's or guardian's civil action, makes violations strict-liability civil offenses, and raises the penalty from $2,500 to $10,000 per violation, with each day of unlawful access a separate violation.

Timing: Section 2's duties (the addictive-practices ban, the overnight notification default, the most-protective default settings, the quarterly audit and the parent dashboard) take effect 2026-04-21: sec. 8 makes Section 2 effective on and after one year following enactment, the act was approved 2025-04-21, and the 2026-04-20 preliminary-injunction order describes the act as set to go into effect that day. The other sections carry no effective-date clause of their own and the act has no emergency clause, so they took effect on the default date for the 2025 session's undated acts, 2025-08-05 (Ark. Const. art. 5, sec. 1; Ark. Att'y Gen. Op. 2025-032); the anti-circumvention duty in new 4-88-1405 applies to new accounts created twelve months on and after enactment

Litigation: NetChoice, LLC v. Griffin, No. 5:25-cv-05140 (W.D. Ark.). Preliminary injunction granted 2026-04-20, barring the Attorney General and the defendant prosecuting attorneys from enforcing Act 900 against NetChoice's members. Appeal (8th Cir. No. 26-1962) is CONSOLIDATED with Nos. 25-1889 and 26-1096 by court order 2026-05-27, which says the cases will be rescheduled for oral argument after briefing is completed in all of them. The State's opening brief was approved and filed 2026-08-10, and a 2026-08-28 clerk order extended NetChoice's combined response brief in Nos. 26-1096 and 26-1962 to 2026-10-09. No argument date has been set. Preliminary injunction remains in effect.

Entry last reviewed 2026-10-01

Enacted, enjoined · Social media · effective 2025-08-05 · binds operators, platforms

Ages: All users for the design-harm prohibition (4-88-1502); under 16 for the parent's suicide-harm action (4-88-1503(b))

Requires: Bars a social media platform from using a design, algorithm, or feature it knows, or should have known through reasonable care, causes a user (of any age) to buy a controlled substance, develop an eating disorder, commit or attempt suicide, or become addicted to the platform; correcting a risky feature within 30 days of discovering it is a defense except for the suicide prong, and the Attorney General and prosecutors enforce the ban under the Deceptive Trade Practices Act. Separately, a parent or guardian whose minor child commits or attempts suicide after exposure to content promoting self-harm or suicide may sue the platform that hosted, promoted, or facilitated the connection to that content, and a platform that knowingly and willfully violates that section is liable for a civil penalty of up to $10,000 per violation.

Timing: effective 2025-08-05: the act has no emergency clause and no effective-date section, so it took effect on the default date for the 2025 regular session's undated acts, the day after the 90-day referendum window that Ark. Att'y Gen. Op. 2025-032 counts from the 2025-05-05 sine die adjournment under Ark. Const. art. 5, sec. 1

Litigation: NetChoice, LLC v. Griffin, No. 5:25-cv-05140 (W.D. Ark.). Preliminary injunction granted 2025-12-15, barring the Attorney General and the defendant prosecuting attorneys from enforcing the provisions of Act 901 they have authority to enforce against NetChoice's members; the court did not enjoin the parent's private action in 4-88-1503(b), which the defendants disclaimed authority to enforce. Appeal (8th Cir. No. 26-1096) is CONSOLIDATED with Nos. 25-1889 and 26-1962 by court order 2026-05-27, which says the cases will be rescheduled for oral argument after briefing is completed in all of them. The State's opening brief was filed 2026-04-09, and a 2026-08-28 clerk order extended NetChoice's combined response brief in Nos. 26-1096 and 26-1962 to 2026-10-09. No argument date has been set. Preliminary injunction remains in effect.

Entry last reviewed 2026-10-01

HB 1717 / Act 952

In force · Privacy law (minors) · effective 2026-07-01 · binds operators

Ages: under 13 (children); 13-16 (teens)

Requires: Extends COPPA-style protections to teens ages 13 to 16, not just children under 13. Operators of online services directed at children or teens, or with actual knowledge they are collecting a child's or teen's personal information, may not collect or share it for targeted advertising to minors and must limit collection and retention to what the service needs. Operators with actual knowledge must give clear notice of their data practices, get the teen's or a parent's consent before collecting, using, or disclosing a 13-to-16-year-old's personal information (with listed exceptions), and let parents of children, and teens themselves, access, correct, and delete that data. The Arkansas Attorney General has exclusive enforcement authority; there is no private right of action.

Litigation: No lawsuit identified. NetChoice's ongoing Griffin litigation targets Arkansas's age-verification and platform-design social media laws (Acts 689, 900, 901), not this data-privacy act.

Entry last reviewed 2026-10-01