Summary
Arkansas adopted a far-reaching privacy bill, HB 1717 (now Act 952), to significantly limit data processing activities related to teens (individuals ages 13 to 16) and children (individuals under 13). Effective July 1, 2026, the law’s applicability to teens stretches it beyond the federal equivalent–the Children’s Online Privacy Protection Act (COPPA)–and related laws in its sister states. The bill could make it impractical for teens and children to use wearable devices such as smartwatches.
Teens are especially likely to benefit from AI wearables. These devices may provide manifold educational, vocational, and mental and physical health benefits. Recent research indicates that AI wearables may help diagnose mental health issues among teens and provide novel forms of effective care, for example.
The Arkansas State Legislature should amend the act to carve out AI wearables until lawmakers have a better understanding of the costs and benefits of the law with respect to child and teen use of these novel tools.
Background on Wearables
AI wearables, like all computer systems, gather information, process it, and generate outputs. There’s an increasing diversity of such tools but they can be loosely grouped into three categories:
- Biometric wearables focus inward on the wearer’s body. Such devices include continuous glucose monitors, smart rings, and smartwatches. These devices gather information about the user’s body to provide activity and exercise performance metrics, support predictive health insights, and facilitate chronic disease management.
- Auditory wearables look outward rather than looking inward at the user’s body. Some AI wearable products—such as the now-discontinued Humane AI Pin—are worn on the body and use audio as an input, operating via voice commands without a traditional screen. Future consumer AI devices may take similar forms, including pins or necklaces. These are commonly labeled as auditory wearables.
- Visual wearables observe the world around the user. Smart glasses offered by companies such as Ray-Ban Meta and Envision are a prime example of this kind of wearable. These tools often feature one or more integrated cameras and a small screen visible only to the user.
Read more from the Abundance Institute on the state wearable policy landscape here.
Reforming Act 952
Background: Lawmakers at the state and federal level have long sought to shield younger Americans from harmful or privacy-infringing experiences. Congress enacted COPPA in 1998 to do so. Arkansas legislators acted on a similar impulse in 2025 in passing HB 1717. The law received bipartisan support, due to a general concern that the federal government was unlikely to pass similar legislation to account for new online threats to the informational autonomy of younger residents.
The law’s core obligations track COPPA and its proposed federal expansion. Operators may not collect the personal information of children or teens for purposes of targeted advertising. They must obtain verifiable consent before collecting personal information–from a parent for children, from either the teen or a parent for teens. They must provide clear notice of their data practices, honor deletion and correction requests, limit collection and retention to what a given service requires, and maintain reasonable security. The Attorney General holds exclusive enforcement authority. There is no private right of action.
Several of these mandates pose little burden to AI wearables. The targeted advertising ban, for instance, may not be relevant to many AI wearable companies. The regulatory troubles may lie elsewhere. Data minimization and retention limits collide with always-on biometric streams whose diagnostic value depends on longitudinal records. And deletion rights raise an unresolved question about personal information embedded in trained AI models.
Policy Recommendations
- Change the definitions of “mobile application,” “online application,” and “operator”: Act 952 targets the data practices of mobile applications, defined as “a software program that runs on the operating system of (i) a cellular phone, (ii) a tablet computer; or, (iii) a similar portable computing device that transmits data over a wireless connection.” Services or applications “offered via a connected device” are also included. Online applications include “Internet-connected software program[s].” An operator is any entity that makes a mobile application or online application commercially available.
An AI wearable company is likely to fall within either of these broad definitions of applications and, therefore, qualify as an operator covered by the law. It’s unclear that state legislators intended for that to be the case.
AI wearables present a different profile of risks and benefits to teens and minors than the social media sites that were clearly the primary, if not exclusive, targets of state legislators.
In many cases, for example, AI wearables do not include the sorts of features that have drawn the regulatory scrutiny of some actors–continuous scrolling, excessive sharing with third parties of intimate personal information, and the manipulation of content to present a false or inaccurate depiction of reality, to name a few. Smartwatches, for example, may have few to no functionalities that are designed to maximize user engagement with a broader network.
Until the pros and cons of AI wearables on the mental and physical health of teens are better understood, the state legislature should explicitly carve such tools out of the aforementioned definitions. They may do so on a provisional basis of a year and contingent upon the AI wearable tool not bearing any of the features that led to this legislation in the first place.
- Amend the definition of “personal information”: Personal information is broadly defined to include a range of terms, including “information linked or reasonably linkable to a child or teen.” The law excludes certain kinds of personal information that is collected pursuant to clear notice, in line with specific deletion and retention requirements, and under a restrictive purpose limitation.
The data collection requirements of AI wearables are extensive by design. Absent the ongoing collection of personal information, such as “gait,” their utility may be significantly reduced. Yet, given that such information is generally not intended to be shared with third parties or otherwise used in a social context, it is of a different nature than the information collected by ad or social media platforms, for instance.
Legislators should therefore study how best to carve out personal information collected by AI wearables from this definition. This clarity will avoid the risk of unnecessarily putting AI wearables on the same regulatory track as social media platforms and related entities.
- Clarify what it means for a service to be “directed at” children or teens and when an operator has “actual knowledge”: Many of Act 952’s provisions turn on whether the operator maintains a service that is “directed at” children or teens. This ambiguous qualification creates an unproductive guessing game as to whether a company needs to substantially change its operations to comply with Act 952.
The Act’s second trigger—”actual knowledge”—is equally undefined. Does a birthdate entered at account setup suffice? A device purchased on a family plan? A parent pairing a child’s watch to their own phone? Observers expect the Attorney General to borrow the FTC’s COPPA criteria in answering these questions. Expectation, however, is not guidance.
Minimally, the state legislature should direct the Attorney General to provide guidance on these threshold questions as soon as possible. The “directed at” qualification has been used in other contexts but failed to provide a clear conception of its reach. The FTC, for example, applies a “totality-of-the-circumstances” inquiry to determine if a website is directed at minors under COPPA. This open-ended inquiry does little to help entities structure their products in a way that may or may not be within the intended scope of the law. In fact, it has deterred the creation of child-friendly or family friendly content, as the surest way to ensure your product doesn’t risk COPPA violations is to make the content adult-directed.
Upshot
A teen in rural Arkansas with limited access to mental health care may benefit most from the very tools Act 952 now sweeps into its scope. Lawmakers had good reason to act, and the bipartisan support behind the bill reflects a real concern about online threats to younger residents. Yet the technical features of services that drove that concern are largely absent from today’s AI wearables. The three reforms above would preserve the law’s protective core while keeping it from foreclosing devices that may improve the health, education, and economic prospects of the state’s youngest residents. Critically, none of these changes asks the legislature to abandon its caution or stop monitoring the well-being of Arkansas’s young residents. Each instead ensures the law’s mandates are calibrated to specific risks—and leaves room to revisit the question once the legislature has a better understanding of the policy landscape.