What Act 952 requires from an app with users in Arkansas
Act 952 bars covered operators from collecting a child's or teen's personal information for targeted advertising, or letting others do so. An operator with actual knowledge of child or teen users must give clear and conspicuous notice of what it collects, why, and which categories of third parties receive it. Consent from the teen or a parent is needed unless the processing is required to provide the requested service, run internal operations or handle security. Teens must be able to delete, correct and obtain their data, retention may not exceed what is reasonably necessary, and security must be reasonable. Only the Attorney General enforces it, there is no private right of action, and the Act does not require age verification. In practice that means listing every SDK that receives data, switching off advertising identifiers for teen accounts and building one deletion path.
