Arkansas Children and Teens' Online Privacy Protection Act (ACTOPPA): Website Compliance Support Guide

Arkansas has quietly become a bellwether in children's privacy law. On April 21, 2025, the governor signed HB 1717, the Arkansas Children and Teens' Online Privacy Protection Act, into law. It came into effect July 1, 2026. If your site or app collects personal information from younger visitors, intentionally or otherwise, this law is worth understanding.

What Is the Arkansas Children and Teens' Online Privacy Protection Act?

The Act creates new privacy obligations for operators of websites, online services, and apps that collect personal information from minors. It borrows heavily from the federal Children's Online Privacy Protection Act (COPPA), but goes further. 

Where COPPA protects children under 13, Arkansas extends similar — though not identical — protections to teens aged 13 to 16. That makes it the first state law of its kind, and one that closely mirrors the stalled federal "COPPA 2.0" proposal.

Who Does ACTOPPA Apply To?

ACTOPPA applies to for-profit operators of websites, online services, online applications, and mobile applications that are either:

• Directed at children or teens, or
• Operated with actual knowledge that they're collecting personal information from children or teens

Neither term is defined in the statute. That's a genuine gap and not a technicality. Several law firms tracking the ACTOPPA have flagged it as an open question site owners will likely need Arkansas Attorney General guidance to resolve. If your audience skews younger, or you can't rule out minors interacting with your site, it's worth treating the ambiguity as a reason for caution.

What Are ACTOPPA’s Requirements?

ACTOPPA sets out a two-tier consent model, restricts targeted advertising, and adds standard data-protection obligations layered on top.

Consent Requirements

For children under 13, operators need parental consent before collecting personal information, which is consistent with the federal COPPA model. For teens aged 13 to 16, either the teen or a parent may provide consent. This two-tier structure is the Act's most novel feature, and no other state currently splits consent requirements this way.

Targeted Advertising Restrictions

Operators are prohibited from collecting or allowing access to a minor's personal information for targeted advertising purposes. Notably, the statute is silent on whether consent can override this restriction, so the more conservative choice would be treating it as a hard prohibition rather than something consent can unlock.

Data Minimization and Security

ACTOPPA requires operators to limit data collection to what's reasonably necessary for the service, provide clear privacy notices, and maintain reasonable security measures for minors' personal information.

Individual Rights

Minors, or their parents, depending on age tier, have rights to access, correct, and delete their personal information.

What ACTOPPA Doesn't Require

Two points are worth calling out because they run counter to what might be assumed:

• No age-verification mandate. Operators aren't required to verify age. The obligations attach once an operator has actual knowledge of a user's age or operates a service directed at minors.
• No private right of action. Individuals can't sue under this law. Enforcement sits exclusively with the Arkansas Attorney General, who can pursue injunctive relief, damages or restitution, and other court-ordered remedies.

How Does ACTOPPA Compare to COPPA and COPPA 2.0?

Arkansas's law draws directly from COPPA's structure in terms of notice, consent, and data minimization, but extends it to an age group COPPA has never covered. 

A federal counterpart, COPPA 2.0, has made real progress but isn't law yet. The Senate passed its version unanimously in March 2026, and the House passed a broader package incorporating its own version, the KIDS Act, in June 2026. The two chambers remain at odds over a duty-of-care provision the Senate wants and the House version omits, so reconciliation — and enactment — is still pending.

Until COPPA 2.0 passes (if it passes), Arkansas's law stands as the most expansive minor-privacy statute currently in effect at the state level, and other states are widely expected to follow a similar path given how bipartisan children's privacy tends to be.

How Does ACTOPPA Compare to Other States' Child Protection Laws?

Most other state "Age-Appropriate Design Code" laws — California's, Maryland's, Vermont's — have drawn heavy First Amendment litigation, with California's still partly enjoined and Maryland's proceeding under an unresolved challenge. 

Age-verification mandates have fared worse still: Arkansas's own 2023 Social Media Safety Act was permanently enjoined, as was Utah's equivalent.

ACTOPPA avoids much of that exposure by design. It skips age verification and platform-design mandates in favor of COPPA's narrower, already-litigated model, which includes consent, notice, and data minimization. That's a different legal theory than the ones facing challenges elsewhere, though ACTOPPA itself remains untested in court.

Where Your Website Should Stand Now for ACTOPPA

The July 1, 2026 effective date has passed, so if you haven't already brought your practices in line, here's where to focus:

Audit what you collect from younger visitors

Identify any pages, forms, or features where a child or teen might submit personal information.

Review your advertising and analytics trackers

Confirm whether any third-party scripts on pages likely to attract minors are used for targeted advertising, and reassess consent flows accordingly.

Update consent flows for the two age tiers

If your audience includes both children and teens, your consent mechanism will need to distinguish between the two.

Revisit your privacy notice language

Clear, minor-appropriate notice is a stated requirement, not a nice-to-have.

Watch for Arkansas Attorney General guidance

To address the undefined "directed at" and "actual knowledge" standards, which may still be clarified as enforcement practices develop.

A properly configured consent management platform like Cookiebot™ CMP supports these efforts, particularly around categorizing trackers and holding advertising scripts until appropriate consent is confirmed. Confirm the specifics of what qualifies as adequate consent under ACTOPPA with legal counsel given the statute's unresolved definitions.

Usercentrics (parent company of Cookiebot™) does not provide legal advice, and the information in this article is provided for educational purposes only. Engage qualified legal counsel regarding your specific business operations and data privacy compliance needs.