Arkansas Undermines Child Privacy: Pioneering COPPA 2.0-Inspired Legislation for Minor Rights in Little Rock
The Arkansas legislature recently passed HB 1717, also known as the Arkansas Children and Teens' Online Privacy Protection Act, or Arkansas COPPA 2.0. This new law establishes privacy protections for teens aged 13 to 16 and introduces a narrower "actual knowledge" standard for determining when a business collects information from a teen, setting it apart from the federal COPPA 2.0 proposal.
HB 1717 applies to "operators" who operate or provide online services to children or teens. It provides new rights to access, delete, and correct personal information for teens, and mandates clear, age-appropriate privacy notices. Unlike the federal COPPA 2.0 proposal, Arkansas COPPA 2.0 allows for targeted advertising to minors based on data collected in a first-party context.
One of the key differences between Arkansas COPPA 2.0 and the federal COPPA 2.0 proposal lies in their scope. Arkansas COPPA 2.0 applies to operators of websites/apps that target children (under 18) or have actual knowledge of users under 18, covering a broader age range. In contrast, the federal COPPA 2.0 proposal applies to operators of websites/apps directed at children under 13 or that have actual knowledge of users under 13.
Consent under Arkansas COPPA2.0 only applies when an operator has actual knowledge that it is collecting personal information from a teen. Arkansas COPPA 2.0 does not rely on existing COPPA guidance and rule for clarification on certain terms. It establishes more prescriptive requirements for what constitutes valid consent than typical state privacy laws.
Questions of preemption and drafting quirks aside, Arkansas COPPA 2.0 focuses on data protection practices and may be on firmer constitutional ground than age-appropriate design codes or social media age verification mandates. The passage of Arkansas COPPA 2.0 may signal an emerging trend towards privacy-focused legislation modeled on COPPA standards.
It's important to note that HB 1717 exempts "interactive gaming platforms" from coverage if they comply with the requirements of the COPPA statute. Moreover, it clarifies that there is no requirement to implement age gating or age verification.
In summary, Arkansas COPPA 2.0 expands protections to all minors under 18, while federal COPPA 2.0 remains focused on under 13. Both restrict behavioral advertising targeting children without consent, but Arkansas explicitly bans it for under 18 without consent. Data minimization requirements are substantive in Arkansas COPPA 2.0, with specific requirements for collecting, processing, and retaining child and teen data. Enforcement and operator duties include verifiable parental consent and secure data handling, with Arkansas including some enhanced transparency and auditing requirements.
- The Arkansas Children and Teens' Online Privacy Protection Act (HB 1717) establishes new privacy protection regulations for youth aged 13 to 16, differing from the federal COPPA 2.0 proposal.
- HB 1717 requires operators who provide online services to children or teens to grant teens new rights to access, delete, and correct their personal information.
- Arkansas COPPA 2.0 mandates clear, age-appropriate privacy notices for operators and allows for targeted advertising to minors based on data collected in a first-party context.
- Unlike the federal COPPA 2.0 proposal, Arkansas COPPA 2.0 applies to operators of websites/apps that target children (under 18) or have actual knowledge of users under 18.
- Consent under Arkansas COPPA 2.0 only applies when an operator has actual knowledge that it is collecting personal information from a teen, and it sets more prescriptive requirements for valid consent than typical state privacy laws.
- The passage of Arkansas COPPA 2.0 may represent an emerging trend towards privacy-focused legislation that models itself on COPPA standards.
- HB 1717 exempts "interactive gaming platforms" from coverage if they comply with COPPA statute requirements and does not necessitate age gating or age verification.
