July 1 Privacy Deadlines: Connecticut and Arkansas Tighten Teen Ad Rules

July 1 brings another round of US state privacy changes, and two of them focus squarely on advertising to young people. Amendments to the Connecticut Data Privacy Act take effect that day, as does Arkansas's Children and Teens' Online Privacy Protection Act. Both restrict targeted advertising to minors, and Connecticut's changes also widen who the law covers. This is not legal advice; it is a summary of what changes and where it touches the ad stack, so you can take the right questions to counsel.

Connecticut: broader coverage, a firm line on teens

According to Wiley's summary of the amendments:

• Lower thresholds. The law now applies to businesses handling the personal data of at least 35,000 Connecticut consumers, down from 100,000. Businesses that process sensitive data or sell personal data are covered regardless of volume.
• Teens 13 to 17. Where a business has actual knowledge, or wilfully disregards, that a consumer is at least 13 but under 18, it may not process that consumer's data for targeted advertising or sell it, even with consent. Previously the teen protections covered ages 13 to 16 and allowed consent.
• Sensitive data. The definition expands to include items such as government identifiers and financial account information, and selling sensitive data requires consent.
• Profiling. Consumers gain new rights around profiling decisions, and impact assessments are required for certain profiling activities beginning August 1.

Ice Miller's overview also notes a new disclosure requirement when personal data is used to train large language models, which means privacy notices may need updating.

Arkansas: no targeted ads to minors

Arkansas's law prohibits targeted advertising based on minors' personal data. It sets consent rules for collecting data from children 12 and under, which require a parent, and from teens 13 to 16, who may consent themselves or through a parent. It also applies data minimization principles that restrict how much data is collected and how long it is kept. Enforcement rests with the Arkansas Attorney General; there is no private right of action.

Why local and general-audience publishers should care

These laws are not only for sites built for kids. Local news sites cover high school sports, school boards and youth events. Gaming, entertainment and music sites draw teen readers. Homework-help and reference content is used by students. Under a knowledge-based standard, a publisher that knows parts of its audience skew young cannot assume the rules do not apply.

At the same time, the laws do not ban advertising to teens. They ban targeted advertising based on personal data and the sale of that data. Contextual advertising, based on the content of the page rather than the profile of the reader, remains available and is the natural fallback.

A pre-July 1 checklist

1. Map teen-heavy sections. Identify sections, templates and apps where you know or should expect a meaningful share of readers under 18. Document how you reached that view.
2. Decide how those sections are treated. For sections you treat as teen-directed, consider turning off user ID modules, first-party audience segments and data sharing with partners that pay for data, and serving contextual demand only.
3. Check how age signals flow. If you collect age or birth year at registration, confirm how that information reaches your ad stack. A logged-in user who told you they are 15 is a clear case of actual knowledge.
4. Use the signals your stack supports. Ad servers and many SSPs offer settings to mark inventory or requests as child-directed or to restrict personalized ads. Know which settings you use, where, and what they actually change in the bid request.
5. Update notices and contracts. Reflect the new Connecticut thresholds, sensitive data definitions and any AI training disclosures in your privacy notice. Check that partner contracts restrict onward use of minors' data.
6. Test revenue impact. Moving teen-heavy sections to contextual demand will change yield. Measure it on those sections rather than guessing, and look for contextual deals that value the content itself.

Signals in the bid request

Most publishers communicate privacy choices to partners through a consent management platform and, for US states, the IAB's Global Privacy Platform (GPP) string. Check that your CMP is configured for Connecticut's updated rules and that the GPP sections it sends are the ones your partners read. Then check the other end: pull sample bid requests from teen-heavy sections and confirm that personalization is actually off, identifiers are absent where they should be, and any child-directed flags are set. Configuration that looks right in the CMP console but does not change the bid request does not protect you.

Repeat that check after any CMP, wrapper or ad server update, since a routine upgrade can quietly change which signals are sent.

The bigger pattern

State laws are converging on a few points: lower thresholds, stricter treatment of sensitive data, and firm limits on targeted advertising to minors. Maryland's law, enforceable since April, bars targeted advertising to consumers under 18 where the business knew or should have known their age. Connecticut and Arkansas now add their own versions. Publishers who build one clear policy for minors' data, applied everywhere, will spend less time reacting to each new state deadline.

The takeaway

July 1 tightens the rules on targeted advertising to minors in two more states and pulls more businesses under Connecticut's law. Identify where young readers are, switch those sections to contextual demand where the law requires it, make sure age signals reach your ad stack, and update notices and contracts. Clear rules applied consistently are easier to defend than section-by-section exceptions.