--------------------------- Title: Arkansas Children and Teens' Online Privacy Protection Act (ACTOPPA): Website Compliance Support Guide URL: https://www.cookiebot.com/us/arkansas-children-teens-online-privacy-protection-act-actoppa/ --------------------------- # Arkansas Children and Teens' Online Privacy Protection Act (ACTOPPA): Website Compliance Support Guide The Arkansas Children and Teens' Online Privacy Protection Act (ACTOPPA) has been in effect since July 1, 2026. It extends COPPA-style consent and notice rules to teens for the first time. This guide explains who the law covers and how website owners can meet ACTOPPA requirements. ## At a Glance - Arkansas's Children and Teens' Online Privacy Protection Act (Act 952, HB 1717) took effect July 1, 2026. - It's the first state law to extend COPPA-style protections beyond children under 13 to teens aged 13 to 16. - Operators must get consent before collecting personal information from minors and are barred from using it for targeted advertising. - No age-verification mechanism is required, but operators must act once they have actual knowledge of a user's age. - Only the Arkansas Attorney General can enforce the law — there's no private right of action. Arkansas has quietly become a bellwether in children's privacy law. On April 21, 2025, the governor signed HB 1717, the [Arkansas Children and Teens' Online Privacy Protection Act](https://arkleg.state.ar.us/Home/FTPDocument?path=%2FACTS%2F2025R%2FPublic%2FACT952.pdf), into law. It came into effect July 1, 2026. If your site or app collects personal information from younger visitors, intentionally or otherwise, this law is worth understanding. ## What Is the Arkansas Children and Teens' Online Privacy Protection Act? The Act creates new privacy obligations for operators of websites, online services, and apps that collect personal information from minors. It borrows heavily from the federal [Children's Online Privacy Protection Act (COPPA)](https://www.cookiebot.com/us/coppa-compliance-requirements-checklist/), but goes further. Where COPPA protects children under 13, Arkansas extends similar — though not identical — protections to teens aged 13 to 16. That makes it the first state law of its kind, and one that closely mirrors the stalled federal "COPPA 2.0" proposal. ## Who Does ACTOPPA Apply To? ACTOPPA applies to for-profit operators of websites, online services, online applications, and mobile applications that are either: - Directed at children or teens, or - Operated with actual knowledge that they're collecting personal information from children or teens Neither term is defined in the statute. That's a genuine gap and not a technicality. Several law firms tracking the ACTOPPA have flagged it as an open question site owners will likely need Arkansas Attorney General guidance to resolve. If your audience skews younger, or you can't rule out minors interacting with your site, it's worth treating the ambiguity as a reason for caution. ## What Are ACTOPPA’s Requirements? ACTOPPA sets out a two-tier consent model, restricts targeted advertising, and adds standard data-protection obligations layered on top. ### Consent Requirements For children under 13, operators need parental consent before collecting personal information, which is consistent with the federal COPPA model. For teens aged 13 to 16, either the teen or a parent may provide consent. This two-tier structure is the Act's most novel feature, and no other state currently splits consent requirements this way. ### Targeted Advertising Restrictions Operators are prohibited from collecting or allowing access to a minor's personal information for targeted advertising purposes. Notably, the statute is silent on whether consent can override this restriction, so the more conservative choice would be treating it as a hard prohibition rather than something consent can unlock. ### Data Minimization and Security ACTOPPA requires operators to limit data collection to what's reasonably necessary for the service, provide clear privacy notices, and maintain reasonable security measures for minors' personal information. ### Individual Rights Minors, or their parents, depending on age tier, have rights to access, correct, and delete their personal information. ## What ACTOPPA Doesn't Require Two points are worth calling out because they run counter to what might be assumed: - **No age-verification mandate.** Operators aren't required to verify age. The obligations attach once an operator has actual knowledge of a user's age or operates a service directed at minors. - **No private right of action.** Individuals can't sue under this law. Enforcement sits exclusively with the Arkansas Attorney General, who can pursue injunctive relief, damages or restitution, and other court-ordered remedies. ## How Does ACTOPPA Compare to COPPA and COPPA 2.0? Arkansas's law draws directly from COPPA's structure in terms of notice, consent, and data minimization, but extends it to an age group COPPA has never covered. A federal counterpart, COPPA 2.0, has made real progress but isn't law yet. The Senate passed its version unanimously in March 2026, and the House passed a broader package incorporating its own version, the KIDS Act, in June 2026. The two chambers remain at odds over a duty-of-care provision the Senate wants and the House version omits, so reconciliation — and enactment — is still pending. Until COPPA 2.0 passes (if it passes), Arkansas's law stands as the most expansive minor-privacy statute currently in effect at the state level, and other states are widely expected to follow a similar path given how bipartisan children's privacy tends to be. ### How Does ACTOPPA Compare to Other States' Child Protection Laws? Most other state "Age-Appropriate Design Code" laws — California's, Maryland's, Vermont's — have drawn heavy First Amendment litigation, with California's still partly enjoined and Maryland's proceeding under an unresolved challenge. Age-verification mandates have fared worse still: Arkansas's own 2023 Social Media Safety Act was permanently enjoined, as was Utah's equivalent. ACTOPPA avoids much of that exposure by design. It skips age verification and platform-design mandates in favor of COPPA's narrower, already-litigated model, which includes consent, notice, and data minimization. That's a different legal theory than the ones facing challenges elsewhere, though ACTOPPA itself remains untested in court. ## Where Your Website Should Stand Now for ACTOPPA The July 1, 2026 effective date has passed, so if you haven't already brought your practices in line, here's where to focus: - **Audit what you collect from younger visitors** — Identify any pages, forms, or features where a child or teen might submit personal information. - **Review your advertising and analytics trackers** — Confirm whether any third-party scripts on pages likely to attract minors are used for targeted advertising, and reassess consent flows accordingly. - **Update consent flows for the two age tiers** — If your audience includes both children and teens, your consent mechanism will need to distinguish between the two. - **Revisit your privacy notice language** — Clear, minor-appropriate notice is a stated requirement, not a nice-to-have. - **Watch for Arkansas Attorney General guidance** — To address the undefined "directed at" and "actual knowledge" standards, which may still be clarified as enforcement practices develop. A properly configured consent management platform like [Cookiebot™ CMP](https://www.cookiebot.com/us/cookie-consent-solution/) supports these efforts, particularly around categorizing trackers and holding advertising scripts until appropriate consent is confirmed. Confirm the specifics of what qualifies as adequate consent under ACTOPPA with legal counsel given the statute's unresolved definitions. *Usercentrics (parent company of Cookiebot™) does not provide legal advice, and the information in this article is provided for educational purposes only. Engage qualified legal counsel regarding your specific business operations and data privacy compliance needs.* ## Manage notice and consent requirements Try Cookiebot™ free for 14 days and see how easy it is to launch your customized banner with geotargeted consent experiences and audit-ready consent logs. [Start Free Trial](https://admin.cookiebot.com/signup?lang=en) --- ## Footer ### Products - [Cookiebot™ Consent Solution](https://www.cookiebot.com/us/cookie-consent-solution/) - [Audience Survey](https://www.cookiebot.com/us/audience-survey-add-on/) - [Usercentrics for Wix](https://www.cookiebot.com/us/cookiebot-for-wix-by-usercentrics-app/) - [Usercentrics Cookiebot plugin for WordPress](https://www.cookiebot.com/us/new-wp-cookie-plugin/) - [Cookiebot CMP for Shopify](https://www.cookiebot.com/us/cookiebot-cmp-for-shopify/) - [Cookie checker](https://www.cookiebot.com/us/cookie-checker/) - [Usercentrics products](https://usercentrics.com/us/) - [Pricing](https://www.cookiebot.com/us/pricing/) ### Regulations - [DMA (EU)](https://www.cookiebot.com/us/digital-markets-act-dma/) - [GDPR (EU)](https://www.cookiebot.com/us/gdpr/) - [CCPA (California)](https://www.cookiebot.com/us/what-is-ccpa/) - [VCDPA (Virginia)](https://www.cookiebot.com/us/virginia-vcdpa/) - [LGPD (Brazil)](https://www.cookiebot.com/us/lgpd/) - [TCF v2.4 (IAB)](https://www.cookiebot.com/us/tcf/) - [Google Consent Mode (EU)](https://www.cookiebot.com/us/cookiebot-cmp-google-consent-mode/) - [Microsoft UET Consent Mode](https://www.cookiebot.com/us/microsoft-consent-mode-cmp/) - [View all regulations](/us/regulations-and-frameworks/#united-states-state&united-states-federal) ### Partners - [Become an affiliate](https://www.cookiebot.com/us/affiliates/) - [Affiliate Login](https://app.impact.com/login.user) - [Become a partner](https://www.cookiebot.com/us/resellers/) - [Find a partner](https://www.cookiebot.com/us/cookiebot-reseller/) ### Resources - [Blog](https://www.cookiebot.com/us/blog/) - [Customer stories](https://www.cookiebot.com/us/customer-stories/) - [Customer directory](https://www.cookiebot.com/us/cookiebot-customer-directory/) - [Digital Markets Act Hub](https://www.cookiebot.com/us/digital-markets-act-dma-resources/) - [Google Consent Mode Hub](https://www.cookiebot.com/us/google-consent-mode-resources/) - [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2) - [Google Consent Audit Fixes](https://www.cookiebot.com/us/google-consent-audit-fixes/) - [Cookie Banner Cost Calculator](https://www.cookiebot.com/us/cookie-banner-pricing-calculator/) ### Company - [About us](https://www.cookiebot.com/us/about/) - [Careers](https://usercentrics.com/career/) - [Support](https://support.cookiebot.com/hc/en-us/) - [Developer documentation](https://www.cookiebot.com/us/developer/) ©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of Usercentrics A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences [Privacy Policy](https://www.cookiebot.com/us/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/us/cookie-declaration/) · [Data Processing Agreement](/us/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/us/legal-notice/) · [Accessibility Statement](/en/accessibility-statement-wcag-compliance/)