North Carolina 2025-2026 Regular Session

North Carolina House Bill H860 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1		GENERAL ASSEMBLY OF NORTH CAROLINA
2	2		SESSION 2025
3		-	H 1
4		-	HOUSE BILL 860
	3	+	H D
	4	+	HOUSE BILL DRH40422-MCa-185
	5	+
5	6
6	7
7	8		Short Title: Social Media Control in IT Act. (Public)
8		-	Sponsors: Representatives McNeely, Humphrey, Johnson, and Gable (Primary Sponsors).
9		-	For a complete list of sponsors, refer to the North Carolina General Assembly web site.
10		-	Referred to: Commerce and Economic Development, if favorable, Appropriations, if
11		-	favorable, Rules, Calendar, and Operations of the House
12		-	April 10, 2025
13		-	H860 -v-1
	9	+	Sponsors: Representative McNeely.
	10	+	Referred to:
	11	+
	12	+	DRH40422 -MCa-185
14	13		A BILL TO BE ENTITLED 1
15	14		AN ACT TO COMBAT SOCIAL MEDIA ADDICTION BY REQUIRING THAT SOCIAL 2
16	15		MEDIA PLATFORMS RESPECT THE PRIVACY OF NORTH CAROLINA USERS ' 3
17	16		DATA AND NOT USE A NORTH CAROLINA MINOR 'S DATA FOR ADVERTISING 4
18	17		OR ALGORITHMIC RECOMMENDATIONS , AND APPROPRIATING FUNDS FOR 5
19	18		THAT PURPOSE, AND TO MAKE WILLFUL VIOLATIONS OF DATA USER 6
20	19		PRIVACY AN UNFAIR PRACTICE UNDER CHAPTER 75 OF THE GENERAL 7
21	20		STATUTES. 8
22	21		The General Assembly of North Carolina enacts: 9
23	22		SECTION 1. Chapter 75 of the General Statutes is amended by adding a new Article 10
24	23		to read: 11
25	24		"Article 2B. 12
26	25		"Social Media Control in Information Technology. 13
27	26		"§ 75-70. Title; definitions. 14
28	27		(a) This Article shall be known and may be cited as the "Social Media Control in 15
29	28		Information Technology Act." 16
30	29		(b) Definitions. – The following definitions apply in this Article: 17
31	30		(1) Accessible mechanism. – A user-friendly, clear, easy-to-use, readily 18
32	31		available, and technologically feasible method that allows individuals to 19
33	32		exercise their data privacy rights without undue burden. The mechanism must 20
34	33		be designed to accommodate diverse user needs, including those with 21
35	34		disabilities, and should be available across commonly used platforms. The 22
36	35		mechanism should provide clear instructions, function without excessive 23
37	36		complexity, and be free of unreasonable barriers such as length procedures, 24
38	37		hidden settings, or excessive delays. 25
39	38		(2) Algorithmic recommendation system. – A computational process that uses 26
40	39		machine learning, natural language processing, artificial intelligence 27
41	40		techniques, generative artificial intelligence, or other computational 28
42	41		processing techniques that makes a decision or facilitates human decision 29
43	42		making with respect to user-related data to rank, order, promote, recommend, 30
44	43		suggest, amplify, or similarly determine the delivery or display of information 31
45	44		to an individual. 32
46	45		(3) Collects, collected, or collection. – Buying, renting, gathering, obtaining, 33
47		-	receiving, or accessing any personal information pertaining to a user by any 34 General Assembly Of North Carolina Session 2025
48		-	Page 2 House Bill 860-First Edition
49		-	means. This includes receiving information from the consumer, either actively 1
50		-	or passively, or by observing the consumer's behavior. 2
51		-	(4) Consent. – Any freely given, specific, informed, and unambiguous indication 3
52		-	of a user's wishes by which the consumer, or the consumer's legal guardian, a 4
53		-	person who has power of attorney, or a person acting as a conservator for the 5
54		-	consumer, including by a statement or by a clear affirmative action, signifies 6
55		-	agreement to the processing of personal information relating to the consumer 7
56		-	for a narrowly defined particular purpose. None of the following constitutes 8
57		-	consent: 9
58		-	a. Acceptance of a general or broad terms of use, or similar document, 10
59		-	that contains descriptions of personal information processing along 11
60		-	with other, unrelated information. 12
61		-	b. Hovering over, muting, pausing, or closing a given piece of content. 13
62		-	c. Agreement obtained through use of dark patterns. 14
63		-	(5) Default settings. – The predetermined options, values, and configurations that 15
64		-	a program is initially set to whenever it is installed and initially accessed. 16
65		-	(6) Minor. – An individual who is under 18 years of age. 17
66		-	(7) Operator. – Defined in section 1302 of the Children's Online Privacy 18
67		-	Protection Act of 1998, 15 U.S.C. § 6501. 19
68		-	(8) Opt-in mechanism. – An accessible mechanism separate from any other 20
69		-	notifications, disclosures, or consents, such as a privacy policy or terms of 21
70		-	service, that allows the user to consent to the platform engaging in a specific, 22
71		-	narrow, and well-defined practice. The Division of Health Service regulations 23
72		-	has the authority to specify requirements for the notification and consent 24
73		-	process, including specific language and disclosures that may include a 25
74		-	warning on the harmful effects of manipulative algorithms, the length of time 26
75		-	for which the notification must appear before the user has the option to 27
76		-	consent, and the process that the user must follow to consent. 28
77		-	(9) Personal information. – Information that identifies, relates to, describes, is 29
78		-	reasonably capable of being associated with, or could reasonably be linked, 30
79		-	directly or indirectly, with a particular consumer or household. Personal 31
80		-	information includes, but is not limited to, the following if it identifies, relates 32
81		-	to, describes, is reasonably capable of being associated with, or could be 33
82		-	reasonably linked, directly or indirectly, with a particular user or household: 34
83		-	a. Identifiers such as a real name, alias, postal address, unique personal 35
84		-	identifier, online identifier, Internet Protocol address, email address, 36
85		-	account name, social security number, drivers license number, 37
86		-	passport number, or other similar identifiers. 38
87		-	b. Commercial information, including, but not limited to, records of 39
88		-	personal property, products, or services purchased, obtained, or 40
89		-	considered, or other purchasing or consumer histories or tendencies. 41
90		-	c. Biometric information, that is any information relating to an 42
91		-	individual's physiological, biological, or behavioral characteristics, 43
92		-	including, but not limited to, imagery of the iris, retina, fingerprint, 44
93		-	face, hand, palm, gait, vein patterns, and voice recordings. 45
94		-	d. Internet or other electronic network activity information, including, 46
95		-	but not limited to, browsing history, search history, and information 47
96		-	regarding a user's interaction with an internet website application or 48
97		-	advertisement. 49
98		-	e. Usage data. 50
99		-	f. Third-party data. 51 General Assembly Of North Carolina Session 2025
100		-	House Bill 860-First Edition Page 3
101		-	g. Geolocation data. 1
102		-	h. Audio, electronic, visual, thermal, olfactory, or similar information. 2
103		-	i. Professional or employment-related information. 3
104		-	j. Education information, defined as information that is not publicly 4
105		-	available personally identifiable information as defined in the Family 5
106		-	Education Rights and Privacy Act (20 U.S.C. § 1232(g); 34 C.F.R. 6
107		-	Part 99). 7
108		-	k. Financial information from a user, including, but not limited to, a 8
109		-	user's account log-in, financial account, debit card, or credit card 9
110		-	number in combination with any required security or access code, 10
111		-	password, or credentials allowing access to an account. 11
112		-	l. The contents of a user's mail, email, and text messages unless the 12
113		-	platform is the intended recipient of the communication. 13
114		-	m. A user's racial or ethnic origin, citizenship or immigration status, 14
115		-	religious or philosophical beliefs, or union membership. 15
116		-	n. Information related to a user's health, sex life, or sexual orientation. 16
117		-	o. Inferences drawn from any of the information identified in this 17
118		-	subdivision reflecting the user's preferences, characteristics, 18
119		-	psychological trends, predispositions, behavior, attitudes, intelligence, 19
120		-	abilities, and aptitudes. 20
121		-	(10) Platform user. – An individual who resides in North Carolina who uses a 21
122		-	social media platform. 22
123		-	(11) Social media platform, covered platform, or platform. – An electronic medium 23
124		-	with more than 1,000,000 monthly active users in the United States that 24
125		-	functions as a social media service. The term does not include any of the 25
126		-	following: 26
127		-	a. An entity acting in its capacity as a provider of a common carrier 27
128		-	service subject to the Communications Act of 1934 (47 U.S.C. § 151 28
129		-	et seq.) as amended and supplemented. 29
130		-	b. A broadband internet access service under section 8.1(b) of Title 47 of 30
131		-	the Code of Federal Regulations. 31
132		-	c. An electronic mail service. 32
133		-	d. Internet search engines specifically designed to lead a user to a result 33
134		-	which a user expressly searched for. 34
135		-	e. Internet service providers. 35
136		-	f. A wireless messaging service provided through the short messaging 36
137		-	service or multimedia messaging service protocols. 37
138		-	g. Video game services specifically designed to serve as a platform to 38
139		-	solely play video games. 39
140		-	h. Online shopping or e-commerce services specifically designed for that 40
141		-	sole purpose. 41
142		-	i. Video-streaming services that solely provide non-user generated 42
143		-	content. 43
144		-	(12) Third-party data. – Personal data from another person, company, data broker, 44
145		-	and/or platform that is not the user to whom the data pertains and is not the 45
146		-	platform. The term does not refer to persons, companies, data brokers, and/or 46
147		-	platforms that collect personal data from another entity if the entity shares 47
148		-	common branding with the platform, controls the platform, is controlled by 48
149		-	the platform, or is under common control of another legal entity with the 49
150		-	platform. 50 General Assembly Of North Carolina Session 2025
151		-	Page 4 House Bill 860-First Edition
152		-	(13) Usage data. – Any information that is gathered about a user's interactions, 1
153		-	behaviors, preferences, and usage patterns on a platform, including, but not 2
154		-	limited to, information related to pages visited, clicks, scrolls, navigation 3
155		-	patterns, search queries, button presses, feature usage, frequency of logins, 4
156		-	session duration, items added or removed from a shopping cart, purchasing 5
157		-	history, subscription usage, content watched, content read, content listened to, 6
158		-	or time spent using or engaging with any feature or piece of content on the 7
159		-	platform. This includes any and all inferences derivable and related to a user 8
160		-	from this usage data, including user engagement statistics, content metrics, 9
161		-	feature usage statistics, user flow data, retention rates, and churn rates. 10
162		-	"§ 75-71. User data privacy; targeting minors prohibited; registry. 11
163		-	(a) Privacy Requirements. – The General Assembly finds that unhealthy social media use 12
164		-	has been linked to depression, anxiety, eating disorders, and suicidal ideation, especially among 13
165		-	young people. Exploitation of user data can result in users being targeted in ways that increase 14
166		-	unhealthy social media use. It is the policy of this State that user data shall be respected by 15
167		-	platforms. Special protections are warranted for users who are minors. Therefore, the operator of 16
168		-	a social media platform shall comply with all of the following requirements for platform users: 17
169		-	(1) The platform must specifically and clearly inform users in the following ways: 18
170		-	a. A disclosure in a clear, easy-to-read, and accessible format when a user 19
171		-	first initializes their use of a platform for the first time, or after a period 20
172		-	of inactivity greater than or equal to six months, about how the 21
173		-	platform collects personal information, what personal information the 22
174		-	platform collects, how the personal information is used by the platform 23
175		-	for every use case, and how the user can exercise their rights and 24
176		-	choices on the platform. This disclosure must be provided in no more 25
177		-	than 500 words, and the platform must obtain a user's consent before 26
178		-	the platform collects any user-related data on the user. 27
179		-	b. A disclosure in a clear, easy-to-read, and accessible format that details 28
180		-	(i) the categories of information the platform has collected about the 29
181		-	user, (ii) the categories of sources from which the information is 30
182		-	collected, (iii) the business or commercial purpose for collecting, 31
183		-	selling, or sharing personal information, (iv) the categories of third 32
184		-	parties to whom the business discloses personal information, and (v) 33
185		-	the specific pieces of personal information it has collected about that 34
186		-	user. Such information must be available upon receipt of a verifiable 35
187		-	consumer request made through an accessible mechanism on the 36
188		-	platform. 37
189		-	(2) Personal information may be used in algorithmic recommendations only when 38
190		-	both of the following requirements are met: 39
191		-	a. The platform reasonably determines the user is not a minor from 40
192		-	personal information collected by and available to the covered 41
193		-	platform in its ordinary course of business. 42
194		-	b. The user has been notified and expressly consents to the use of their 43
195		-	own data in this manner by consenting in an opt-in mechanism. 44
196		-	(3) Through an accessible mechanism, users must be given the capacity to alter, 45
197		-	change, and delete what categories of personal information are used in a 46
198		-	platform's algorithmic recommendation system or systems. This selection 47
199		-	shall be modifiable at any time. If a user indicates that they intend a certain 48
200		-	category of personal information not to be used in an algorithmic 49
201		-	recommendation system, then the platform must not include said category or 50
202		-	categories within an algorithmic recommendation system. A covered platform 51 General Assembly Of North Carolina Session 2025
203		-	House Bill 860-First Edition Page 5
204		-	shall not discriminate against a user because the user exercised any of the 1
205		-	rights under this Article in the provision of functionality or features of the 2
206		-	covered platform, unless the use of user-related data in an algorithmic 3
207		-	recommendation system is reasonably necessary to the feature or 4
208		-	functionality. 5
209		-	(b) Targeting Minors Prohibited. – A covered platform must establish comprehensive and 6
210		-	effective controls to ensure that a minor's personal information is not used in any algorithmic 7
211		-	recommendation system. 8
212		-	(c) Exceptions. – Subsection (b) of this section does not apply to any of the following: 9
213		-	(1) Recommending or presenting content from accounts that a user follows in 10
214		-	reverse chronological order or a similar method of recommending or 11
215		-	presenting content. 12
216		-	(2) A user's explicit search for content or request for information for the sole 13
217		-	purpose of providing immediate results to the search, and without retention or 14
218		-	use of the user-related data from the search or request for purposes other than 15
219		-	providing results to the search or request. 16
220		-	(3) A covered platform's action, voluntarily taken in good faith to restrict access 17
221		-	to or availability of material as described in section 230(c)(2)(A) of the 18
222		-	Communications Act of 1934 (47 U.S.C. § 230(c)(2)(A)), is not subject to this 19
223		-	subsection, and nothing in this section otherwise limits or otherwise affects 20
224		-	the provisions of section 230 of the Communications Act of 1934, except as 21
225		-	otherwise provided in this Article. 22
226		-	(d) The operator of a social media platform may be held liable for violating subsection 23
227		-	(a) of this section if the user was given algorithmic content recommendations without a proper 24
228		-	opt-in mechanism or affirmation from the user from the opt-in process. The operator of a social 25
229		-	media platform may be held liable for violating subsection (b) of this section if the operator of 26
230		-	the social media platform knew or had reason to know that the user was a minor. The operator of 27
231		-	a social media platform that has made an estimation of a user's age based upon the user's 28
232		-	self-attestation is not liable if the user was a minor who falsely attested to not being a minor. 29
233		-	"§ 75-72. Design features and digital rights of users. 30
234		-	(a) Protective Default Settings for Minors. – A covered platform shall configure all 31
235		-	privacy settings provided to any user by the online service, product, or feature be both available 32
236		-	to minors and, by default, set to preferences that offer the highest level of privacy, unless the 33
237		-	business can demonstrate a compelling reason that a different setting is in the best interest of 34
238		-	minors. These settings must include all of the following: 35
239		-	(1) Notifications must be turned off by default. 36
240		-	(2) The visibility of reaction or interaction counts on all content, including content 37
241		-	generated by a minor and content seen by a minor generated from others, must 38
242		-	be turned off by default. 39
243		-	(3) The ability of other users, not added by the user to a list of approved contacts, 40
244		-	to communicate with the minor must be turned off by default. 41
245		-	(4) The ability of other users, whether registered or not, and not added by the user 42
246		-	to a list of approved contacts, to view the minor's user-related data collected 43
247		-	by or shared on the platform must be disabled by default. 44
248		-	(5) The ability of other users to see the geolocation of a minor must be disabled 45
249		-	by default. 46
250		-	(6) Features that increase, sustain, or extend the use of the covered platform by a 47
251		-	minor, such as automatic playing of media and rewards for time spent on the 48
252		-	platform, must be disabled by default. 49
253		-	(b) Rights to Change and Delete Data. – A covered platform shall provide users with both 50
254		-	of the following: 51 General Assembly Of North Carolina Session 2025
255		-	Page 6 House Bill 860-First Edition
256		-	(1) An accessible mechanism to request the correction of any inaccurate personal 1
257		-	information about the user, taking into account the nature of the personal 2
258		-	information and the purposes of the personal information. A platform that 3
259		-	receives a verifiable request to correct inaccurate personal information shall 4
260		-	use commercially reasonable efforts to correct the inaccurate personal 5
261		-	information as directed by the user. A covered platform shall maintain a record 6
262		-	of all requests. 7
263		-	(2) An accessible mechanism to request the deletion of personal information 8
264		-	about the user, taking into account the nature of the personal information and 9
265		-	the purposes of the personal information. If the personal information is 10
266		-	reasonably necessary for the platform to complete a transaction, to ensure the 11
267		-	security and integrity of the user's personal information, to debug or identify 12
268		-	and repair errors in the platform, to exercise free speech and ensure the user's 13
269		-	right to exercise free speech, to comply with existing federal and State 14
270		-	regulations, to engage in public or peer-reviewed scientific research, or to 15
271		-	enable solely internal uses reasonably aligned with a consumer's expectations, 16
272		-	then the covered platform is not required to comply with the user's request. 17
273		-	Otherwise, the covered platform is required to complete the request. A 18
274		-	covered platform shall maintain a confidential record of all requests. 19
275		-	(c) Digital Rights of the User. – All of the following rights belong to every minor utilizing 20
276		-	covered platforms: 21
277		-	(1) Right to protection from manipulative design. – Every minor has the right to 22
278		-	be protected from manipulative design techniques which exploit 23
279		-	psychological vulnerability or have been shown by the preponderance of the 24
280		-	evidence to create addiction or dependency. 25
281		-	(2) Right to transparency. – Every minor has the right to understand the nature of 26
282		-	their digital experiences. Platforms and services should provide clear and 27
283		-	accessible explanations of the platform features as well as how covered 28
284		-	platforms can negatively affect their well-being. 29
285		-	(3) Right to protection from personalized recommendation systems. – Every 30
286		-	minor has the right to be protected from algorithmic recommendation systems. 31
287		-	(d) The operator of a covered platform may be subject to violations of subsection (a), (b), 32
288		-	or (c) of this section if any of the requirements and rights established herein have been determined 33
289		-	to be violated. 34
290		-	"§ 75-73. Investigation; enforcement; private right of action. 35
291		-	(a) Violations. – Effective January 1, 2026, a platform's violation of this Article is an 36
292		-	unfair or deceptive act or practice under G.S. 75-1.1. 37
293		-	(b) Investigations. – The Attorney General shall monitor social media platforms for 38
294		-	compliance with this Article. 39
295		-	(c) Complaints. – A platform user may make a complaint to the Attorney General 40
296		-	alleging that a social media platform has failed to comply with the requirements of this Article. 41
297		-	The Attorney General may bring a civil action in any case in which the Attorney General has 42
298		-	reason to believe that the interest of the residents of this State has been or is threatened due to 43
299		-	noncompliance with this Article. 44
300		-	(d) Private Right of Action. – Minors can file suit if they are affected by any covered 45
301		-	platform found to be in violation of this Article through mechanisms involved in parens patriae 46
302		-	jurisdiction by the following: 47
303		-	(1) Civil suit brought through private action attorneys. 48
304		-	(2) Relief. – In a civil action brought under subsection (c) of this section or this 49
305		-	subsection in which a plaintiff prevails, the court may award the plaintiff any 50
306		-	one or more of the following: 51 General Assembly Of North Carolina Session 2025
307		-	House Bill 860-First Edition Page 7
308		-	a. An amount equal to the sum of any compensatory damages. 1
309		-	b. Punitive damages. 2
310		-	c. Injunctive relief. 3
311		-	d. Declaratory relief. 4
312		-	e. Reasonable attorneys' fees and litigation costs. 5
313		-	"§ 75-74. North Carolina Data Privacy Task Force. 6
314		-	(a) There is created the North Carolina Data Privacy Task Force (Task Force) within the 7
315		-	Department of Justice for budgetary purposes only. 8
316		-	(b) The Task Force shall be composed of 21 members. The ex officio members listed in 9
317		-	subdivisions (1) through (6) of this subsection may designate representatives from their particular 10
318		-	departments, divisions, or offices to represent them on the Task Force. In making appointments 11
319		-	or designating representatives, appointing authorities and ex officio members shall use best 12
320		-	efforts to select members or representatives with sufficient knowledge and experience to 13
321		-	effectively contribute to the issues examined by the Task Force and, to the extent possible, to 14
322		-	reflect the geographical, political, gender, and racial diversity of this State. The members shall 15
323		-	be as follows: 16
324		-	(1) The Attorney General. 17
325		-	(2) The State Chief Information Officer. 18
326		-	(3) The Secretary of the Department of Health and Human Services. 19
327		-	(4) The Director of the State Bureau of Investigation. 20
328		-	(5) The Director of the Maternal and Child Health Section of the Department of 21
329		-	Health and Human Services. 22
330		-	(6) The Director of the Division of Mental Health, Developmental Disabilities, 23
331		-	and Substance Use Services. 24
332		-	(7) A representative from NC Child, appointed by the Governor upon 25
333		-	recommendation of the President of the organization. 26
334		-	(8) A representative from a private group, other than NC Child, that advocates for 27
335		-	children, appointed by the Governor upon recommendation of private child 28
336		-	advocacy organizations. 29
337		-	(9) A pediatrician, licensed to practice medicine in North Carolina, appointed by 30
338		-	the President Pro Tempore of the Senate. 31
339		-	(10) A psychiatrist, licensed to practice medicine in North Carolina, appointed by 32
340		-	the Speaker of the House of Representatives. 33
341		-	(11) Two public members, one of whom is an educator, appointed by the Speaker 34
342		-	of the House of Representatives. 35
343		-	(12) Two public members, one of whom is a social worker, appointed by the 36
344		-	President Pro Tempore of the Senate. 37
345		-	(13) Two members of the Senate, appointed by the President Pro Tempore of the 38
346		-	Senate, and two members of the House of Representatives, appointed by the 39
347		-	Speaker of the House of Representatives. 40
348		-	(14) A representative from the North Carolina Young People's Alliance, appointed 41
349		-	by the Governor upon recommendation of the head of the organization. 42
350		-	(15) Two youth representatives under the age of 21 appointed by the Secretary of 43
351		-	the Department of Health and Human Services after conducting an 44
352		-	application-based selection process. 45
353		-	(c) All members of the Task Force are voting members. Vacancies in the appointed 46
354		-	membership shall be filled by the appointing officer who made the initial appointment. Terms 47
355		-	shall be two years. The members shall elect a chair who shall preside for the duration of the 48
356		-	chair's term as a member. In the event a vacancy occurs in the chair before the expiration of the 49
357		-	chair's term, the members shall elect an acting chair to serve for the remainder of the unexpired 50
358		-	term. 51 General Assembly Of North Carolina Session 2025
359		-	Page 8 House Bill 860-First Edition
360		-	(d) Beginning March 15, 2026, and then annually thereafter, the Task Force shall report 1
361		-	to the General Assembly on its work, with a special focus on mental health issues related to social 2
362		-	media, along with findings, recommendations, and any legislative proposals." 3
363		-	SECTION 2. Effective July 1, 2025, there is appropriated from the General Fund to 4
364		-	the Department of Justice the sum of one hundred thousand dollars ($100,000) for the 2025-2026 5
365		-	fiscal year and the sum of one hundred thousand dollars ($100,000) for the 2026-2027 fiscal year 6
366		-	to develop the registry created in G.S. 75-71, as enacted by this act. 7
367		-	SECTION 3. Section 1 of this act becomes effective October 1, 2026. The remainder 8
368		-	of this act becomes effective July 1, 2025. 9
	46	+	receiving, or accessing any personal information pertaining to a user by any 34
	47	+	means. This includes receiving information from the consumer, either actively 35
	48	+	or passively, or by observing the consumer's behavior. 36
	49	+	H.B. 860
	50	+	Apr 9, 2025
	51	+	HOUSE PRINCIPAL CLERK General Assembly Of North Carolina Session 2025
	52	+	Page 2 DRH40422-MCa-185
	53	+	(4) Consent. – Any freely given, specific, informed, and unambiguous indication 1
	54	+	of a user's wishes by which the consumer, or the consumer's legal guardian, a 2
	55	+	person who has power of attorney, or a person acting as a conservator for the 3
	56	+	consumer, including by a statement or by a clear affirmative action, signifies 4
	57	+	agreement to the processing of personal information relating to the consumer 5
	58	+	for a narrowly defined particular purpose. None of the following constitutes 6
	59	+	consent: 7
	60	+	a. Acceptance of a general or broad terms of use, or similar document, 8
	61	+	that contains descriptions of personal information processing along 9
	62	+	with other, unrelated information. 10
	63	+	b. Hovering over, muting, pausing, or closing a given piece of content. 11
	64	+	c. Agreement obtained through use of dark patterns. 12
	65	+	(5) Default settings. – The predetermined options, values, and configurations that 13
	66	+	a program is initially set to whenever it is installed and initially accessed. 14
	67	+	(6) Minor. – An individual who is under 18 years of age. 15
	68	+	(7) Operator. – Defined in section 1302 of the Children's Online Privacy 16
	69	+	Protection Act of 1998, 15 U.S.C. § 6501. 17
	70	+	(8) Opt-in mechanism. – An accessible mechanism separate from any other 18
	71	+	notifications, disclosures, or consents, such as a privacy policy or terms of 19
	72	+	service, that allows the user to consent to the platform engaging in a specific, 20
	73	+	narrow, and well-defined practice. The Division of Health Service regulations 21
	74	+	has the authority to specify requirements for the notification and consent 22
	75	+	process, including specific language and disclosures that may include a 23
	76	+	warning on the harmful effects of manipulative algorithms, the length of time 24
	77	+	for which the notification must appear before the user has the option to 25
	78	+	consent, and the process that the user must follow to consent. 26
	79	+	(9) Personal information. – Information that identifies, relates to, describes, is 27
	80	+	reasonably capable of being associated with, or could reasonably be linked, 28
	81	+	directly or indirectly, with a particular consumer or household. Personal 29
	82	+	information includes, but is not limited to, the following if it identifies, relates 30
	83	+	to, describes, is reasonably capable of being associated with, or could be 31
	84	+	reasonably linked, directly or indirectly, with a particular user or household: 32
	85	+	a. Identifiers such as a real name, alias, postal address, unique personal 33
	86	+	identifier, online identifier, Internet Protocol address, email address, 34
	87	+	account name, social security number, drivers license number, 35
	88	+	passport number, or other similar identifiers. 36
	89	+	b. Commercial information, including, but not limited to, records of 37
	90	+	personal property, products, or services purchased, obtained, or 38
	91	+	considered, or other purchasing or consumer histories or tendencies. 39
	92	+	c. Biometric information, that is any information relating to an 40
	93	+	individual's physiological, biological, or behavioral characteristics, 41
	94	+	including, but not limited to, imagery of the iris, retina, fingerprint, 42
	95	+	face, hand, palm, gait, vein patterns, and voice recordings. 43
	96	+	d. Internet or other electronic network activity information, including, 44
	97	+	but not limited to, browsing history, search history, and information 45
	98	+	regarding a user's interaction with an internet website application or 46
	99	+	advertisement. 47
	100	+	e. Usage data. 48
	101	+	f. Third-party data. 49
	102	+	g. Geolocation data. 50
	103	+	h. Audio, electronic, visual, thermal, olfactory, or similar information. 51 General Assembly Of North Carolina Session 2025
	104	+	DRH40422-MCa-185 Page 3
	105	+	i. Professional or employment-related information. 1
	106	+	j. Education information, defined as information that is not publicly 2
	107	+	available personally identifiable information as defined in the Family 3
	108	+	Education Rights and Privacy Act (20 U.S.C. § 1232(g); 34 C.F.R. 4
	109	+	Part 99). 5
	110	+	k. Financial information from a user, including, but not limited to, a 6
	111	+	user's account log-in, financial account, debit card, or credit card 7
	112	+	number in combination with any required security or access code, 8
	113	+	password, or credentials allowing access to an account. 9
	114	+	l. The contents of a user's mail, email, and text messages unless the 10
	115	+	platform is the intended recipient of the communication. 11
	116	+	m. A user's racial or ethnic origin, citizenship or immigration status, 12
	117	+	religious or philosophical beliefs, or union membership. 13
	118	+	n. Information related to a user's health, sex life, or sexual orientation. 14
	119	+	o. Inferences drawn from any of the information identified in this 15
	120	+	subdivision reflecting the user's preferences, characteristics, 16
	121	+	psychological trends, predispositions, behavior, attitudes, intelligence, 17
	122	+	abilities, and aptitudes. 18
	123	+	(10) Platform user. – An individual who resides in North Carolina who uses a 19
	124	+	social media platform. 20
	125	+	(11) Social media platform, covered platform, or platform. – An electronic medium 21
	126	+	with more than 1,000,000 monthly active users in the United States that 22
	127	+	functions as a social media service. The term does not include any of the 23
	128	+	following: 24
	129	+	a. An entity acting in its capacity as a provider of a common carrier 25
	130	+	service subject to the Communications Act of 1934 (47 U.S.C. § 151 26
	131	+	et seq.) as amended and supplemented. 27
	132	+	b. A broadband internet access service under section 8.1(b) of Title 47 of 28
	133	+	the Code of Federal Regulations. 29
	134	+	c. An electronic mail service. 30
	135	+	d. Internet search engines specifically designed to lead a user to a result 31
	136	+	which a user expressly searched for. 32
	137	+	e. Internet service providers. 33
	138	+	f. A wireless messaging service provided through the short messaging 34
	139	+	service or multimedia messaging service protocols. 35
	140	+	g. Video game services specifically designed to serve as a platform to 36
	141	+	solely play video games. 37
	142	+	h. Online shopping or e-commerce services specifically designed for that 38
	143	+	sole purpose. 39
	144	+	i. Video-streaming services that solely provide non-user generated 40
	145	+	content. 41
	146	+	(12) Third-party data. – Personal data from another person, company, data broker, 42
	147	+	and/or platform that is not the user to whom the data pertains and is not the 43
	148	+	platform. The term does not refer to persons, companies, data brokers, and/or 44
	149	+	platforms that collect personal data from another entity if the entity shares 45
	150	+	common branding with the platform, controls the platform, is controlled by 46
	151	+	the platform, or is under common control of another legal entity with the 47
	152	+	platform. 48
	153	+	(13) Usage data. – Any information that is gathered about a user's interactions, 49
	154	+	behaviors, preferences, and usage patterns on a platform, including, but not 50
	155	+	limited to, information related to pages visited, clicks, scrolls, navigation 51 General Assembly Of North Carolina Session 2025
	156	+	Page 4 DRH40422-MCa-185
	157	+	patterns, search queries, button presses, feature usage, frequency of logins, 1
	158	+	session duration, items added or removed from a shopping cart, purchasing 2
	159	+	history, subscription usage, content watched, content read, content listened to, 3
	160	+	or time spent using or engaging with any feature or piece of content on the 4
	161	+	platform. This includes any and all inferences derivable and related to a user 5
	162	+	from this usage data, including user engagement statistics, content metrics, 6
	163	+	feature usage statistics, user flow data, retention rates, and churn rates. 7
	164	+	"§ 75-71. User data privacy; targeting minors prohibited; registry. 8
	165	+	(a) Privacy Requirements. – The General Assembly finds that unhealthy social media use 9
	166	+	has been linked to depression, anxiety, eating disorders, and suicidal ideation, especially among 10
	167	+	young people. Exploitation of user data can result in users being targeted in ways that increase 11
	168	+	unhealthy social media use. It is the policy of this State that user data shall be respected by 12
	169	+	platforms. Special protections are warranted for users who are minors. Therefore, the operator of 13
	170	+	a social media platform shall comply with all of the following requirements for platform users: 14
	171	+	(1) The platform must specifically and clearly inform users in the following ways: 15
	172	+	a. A disclosure in a clear, easy-to-read, and accessible format when a user 16
	173	+	first initializes their use of a platform for the first time, or after a period 17
	174	+	of inactivity greater than or equal to six months, about how the 18
	175	+	platform collects personal information, what personal information the 19
	176	+	platform collects, how the personal information is used by the platform 20
	177	+	for every use case, and how the user can exercise their rights and 21
	178	+	choices on the platform. This disclosure must be provided in no more 22
	179	+	than 500 words, and the platform must obtain a user's consent before 23
	180	+	the platform collects any user-related data on the user. 24
	181	+	b. A disclosure in a clear, easy-to-read, and accessible format that details 25
	182	+	(i) the categories of information the platform has collected about the 26
	183	+	user, (ii) the categories of sources from which the information is 27
	184	+	collected, (iii) the business or commercial purpose for collecting, 28
	185	+	selling, or sharing personal information, (iv) the categories of third 29
	186	+	parties to whom the business discloses personal information, and (v) 30
	187	+	the specific pieces of personal information it has collected about that 31
	188	+	user. Such information must be available upon receipt of a verifiable 32
	189	+	consumer request made through an accessible mechanism on the 33
	190	+	platform. 34
	191	+	(2) Personal information may be used in algorithmic recommendations only when 35
	192	+	both of the following requirements are met: 36
	193	+	a. The platform reasonably determines the user is not a minor from 37
	194	+	personal information collected by and available to the covered 38
	195	+	platform in its ordinary course of business. 39
	196	+	b. The user has been notified and expressly consents to the use of their 40
	197	+	own data in this manner by consenting in an opt-in mechanism. 41
	198	+	(3) Through an accessible mechanism, users must be given the capacity to alter, 42
	199	+	change, and delete what categories of personal information are used in a 43
	200	+	platform's algorithmic recommendation system or systems. This selection 44
	201	+	shall be modifiable at any time. If a user indicates that they intend a certain 45
	202	+	category of personal information not to be used in an algorithmic 46
	203	+	recommendation system, then the platform must not include said category or 47
	204	+	categories within an algorithmic recommendation system. A covered platform 48
	205	+	shall not discriminate against a user because the user exercised any of the 49
	206	+	rights under this Article in the provision of functionality or features of the 50
	207	+	covered platform, unless the use of user-related data in an algorithmic 51 General Assembly Of North Carolina Session 2025
	208	+	DRH40422-MCa-185 Page 5
	209	+	recommendation system is reasonably necessary to the feature or 1
	210	+	functionality. 2
	211	+	(b) Targeting Minors Prohibited. – A covered platform must establish comprehensive and 3
	212	+	effective controls to ensure that a minor's personal information is not used in any algorithmic 4
	213	+	recommendation system. 5
	214	+	(c) Exceptions. – Subsection (b) of this section does not apply to any of the following: 6
	215	+	(1) Recommending or presenting content from accounts that a user follows in 7
	216	+	reverse chronological order or a similar method of recommending or 8
	217	+	presenting content. 9
	218	+	(2) A user's explicit search for content or request for information for the sole 10
	219	+	purpose of providing immediate results to the search, and without retention or 11
	220	+	use of the user-related data from the search or request for purposes other than 12
	221	+	providing results to the search or request. 13
	222	+	(3) A covered platform's action, voluntarily taken in good faith to restrict access 14
	223	+	to or availability of material as described in section 230(c)(2)(A) of the 15
	224	+	Communications Act of 1934 (47 U.S.C. § 230(c)(2)(A)), is not subject to this 16
	225	+	subsection, and nothing in this section otherwise limits or otherwise affects 17
	226	+	the provisions of section 230 of the Communications Act of 1934, except as 18
	227	+	otherwise provided in this Article. 19
	228	+	(d) The operator of a social media platform may be held liable for violating subsection 20
	229	+	(a) of this section if the user was given algorithmic content recommendations without a proper 21
	230	+	opt-in mechanism or affirmation from the user from the opt-in process. The operator of a social 22
	231	+	media platform may be held liable for violating subsection (b) of this section if the operator of 23
	232	+	the social media platform knew or had reason to know that the user was a minor. The operator of 24
	233	+	a social media platform that has made an estimation of a user's age based upon the user's 25
	234	+	self-attestation is not liable if the user was a minor who falsely attested to not being a minor. 26
	235	+	"§ 75-72. Design features and digital rights of users. 27
	236	+	(a) Protective Default Settings for Minors. – A covered platform shall configure all 28
	237	+	privacy settings provided to any user by the online service, product, or feature be both available 29
	238	+	to minors and, by default, set to preferences that offer the highest level of privacy, unless the 30
	239	+	business can demonstrate a compelling reason that a different setting is in the best interest of 31
	240	+	minors. These settings must include all of the following: 32
	241	+	(1) Notifications must be turned off by default. 33
	242	+	(2) The visibility of reaction or interaction counts on all content, including content 34
	243	+	generated by a minor and content seen by a minor generated from others, must 35
	244	+	be turned off by default. 36
	245	+	(3) The ability of other users, not added by the user to a list of approved contacts, 37
	246	+	to communicate with the minor must be turned off by default. 38
	247	+	(4) The ability of other users, whether registered or not, and not added by the user 39
	248	+	to a list of approved contacts, to view the minor's user-related data collected 40
	249	+	by or shared on the platform must be disabled by default. 41
	250	+	(5) The ability of other users to see the geolocation of a minor must be disabled 42
	251	+	by default. 43
	252	+	(6) Features that increase, sustain, or extend the use of the covered platform by a 44
	253	+	minor, such as automatic playing of media and rewards for time spent on the 45
	254	+	platform, must be disabled by default. 46
	255	+	(b) Rights to Change and Delete Data. – A covered platform shall provide users with both 47
	256	+	of the following: 48
	257	+	(1) An accessible mechanism to request the correction of any inaccurate personal 49
	258	+	information about the user, taking into account the nature of the personal 50
	259	+	information and the purposes of the personal information. A platform that 51 General Assembly Of North Carolina Session 2025
	260	+	Page 6 DRH40422-MCa-185
	261	+	receives a verifiable request to correct inaccurate personal information shall 1
	262	+	use commercially reasonable efforts to correct the inaccurate personal 2
	263	+	information as directed by the user. A covered platform shall maintain a record 3
	264	+	of all requests. 4
	265	+	(2) An accessible mechanism to request the deletion of personal information 5
	266	+	about the user, taking into account the nature of the personal information and 6
	267	+	the purposes of the personal information. If the personal information is 7
	268	+	reasonably necessary for the platform to complete a transaction, to ensure the 8
	269	+	security and integrity of the user's personal information, to debug or identify 9
	270	+	and repair errors in the platform, to exercise free speech and ensure the user's 10
	271	+	right to exercise free speech, to comply with existing federal and State 11
	272	+	regulations, to engage in public or peer-reviewed scientific research, or to 12
	273	+	enable solely internal uses reasonably aligned with a consumer's expectations, 13
	274	+	then the covered platform is not required to comply with the user's request. 14
	275	+	Otherwise, the covered platform is required to complete the request. A 15
	276	+	covered platform shall maintain a confidential record of all requests. 16
	277	+	(c) Digital Rights of the User. – All of the following rights belong to every minor utilizing 17
	278	+	covered platforms: 18
	279	+	(1) Right to protection from manipulative design. – Every minor has the right to 19
	280	+	be protected from manipulative design techniques which exploit 20
	281	+	psychological vulnerability or have been shown by the preponderance of the 21
	282	+	evidence to create addiction or dependency. 22
	283	+	(2) Right to transparency. – Every minor has the right to understand the nature of 23
	284	+	their digital experiences. Platforms and services should provide clear and 24
	285	+	accessible explanations of the platform features as well as how covered 25
	286	+	platforms can negatively affect their well-being. 26
	287	+	(3) Right to protection from personalized recommendation systems. – Every 27
	288	+	minor has the right to be protected from algorithmic recommendation systems. 28
	289	+	(d) The operator of a covered platform may be subject to violations of subsection (a), (b), 29
	290	+	or (c) of this section if any of the requirements and rights established herein have been determined 30
	291	+	to be violated. 31
	292	+	"§ 75-73. Investigation; enforcement; private right of action. 32
	293	+	(a) Violations. – Effective January 1, 2026, a platform's violation of this Article is an 33
	294	+	unfair or deceptive act or practice under G.S. 75-1.1. 34
	295	+	(b) Investigations. – The Attorney General shall monitor social media platforms for 35
	296	+	compliance with this Article. 36
	297	+	(c) Complaints. – A platform user may make a complaint to the Attorney General 37
	298	+	alleging that a social media platform has failed to comply with the requirements of this Article. 38
	299	+	The Attorney General may bring a civil action in any case in which the Attorney General has 39
	300	+	reason to believe that the interest of the residents of this State has been or is threatened due to 40
	301	+	noncompliance with this Article. 41
	302	+	(d) Private Right of Action. – Minors can file suit if they are affected by any covered 42
	303	+	platform found to be in violation of this Article through mechanisms involved in parens patriae 43
	304	+	jurisdiction by the following: 44
	305	+	(1) Civil suit brought through private action attorneys. 45
	306	+	(2) Relief. – In a civil action brought under subsection (c) of this section or this 46
	307	+	subsection in which a plaintiff prevails, the court may award the plaintiff any 47
	308	+	one or more of the following: 48
	309	+	a. An amount equal to the sum of any compensatory damages. 49
	310	+	b. Punitive damages. 50
	311	+	c. Injunctive relief. 51 General Assembly Of North Carolina Session 2025
	312	+	DRH40422-MCa-185 Page 7
	313	+	d. Declaratory relief. 1
	314	+	e. Reasonable attorneys' fees and litigation costs. 2
	315	+	"§ 75-74. North Carolina Data Privacy Task Force. 3
	316	+	(a) There is created the North Carolina Data Privacy Task Force (Task Force) within the 4
	317	+	Department of Justice for budgetary purposes only. 5
	318	+	(b) The Task Force shall be composed of 21 members. The ex officio members listed in 6
	319	+	subdivisions (1) through (6) of this subsection may designate representatives from their particular 7
	320	+	departments, divisions, or offices to represent them on the Task Force. In making appointments 8
	321	+	or designating representatives, appointing authorities and ex officio members shall use best 9
	322	+	efforts to select members or representatives with sufficient knowledge and experience to 10
	323	+	effectively contribute to the issues examined by the Task Force and, to the extent possible, to 11
	324	+	reflect the geographical, political, gender, and racial diversity of this State. The members shall 12
	325	+	be as follows: 13
	326	+	(1) The Attorney General. 14
	327	+	(2) The State Chief Information Officer. 15
	328	+	(3) The Secretary of the Department of Health and Human Services. 16
	329	+	(4) The Director of the State Bureau of Investigation. 17
	330	+	(5) The Director of the Maternal and Child Health Section of the Department of 18
	331	+	Health and Human Services. 19
	332	+	(6) The Director of the Division of Mental Health, Developmental Disabilities, 20
	333	+	and Substance Use Services. 21
	334	+	(7) A representative from NC Child, appointed by the Governor upon 22
	335	+	recommendation of the President of the organization. 23
	336	+	(8) A representative from a private group, other than NC Child, that advocates for 24
	337	+	children, appointed by the Governor upon recommendation of private child 25
	338	+	advocacy organizations. 26
	339	+	(9) A pediatrician, licensed to practice medicine in North Carolina, appointed by 27
	340	+	the President Pro Tempore of the Senate. 28
	341	+	(10) A psychiatrist, licensed to practice medicine in North Carolina, appointed by 29
	342	+	the Speaker of the House of Representatives. 30
	343	+	(11) Two public members, one of whom is an educator, appointed by the Speaker 31
	344	+	of the House of Representatives. 32
	345	+	(12) Two public members, one of whom is a social worker, appointed by the 33
	346	+	President Pro Tempore of the Senate. 34
	347	+	(13) Two members of the Senate, appointed by the President Pro Tempore of the 35
	348	+	Senate, and two members of the House of Representatives, appointed by the 36
	349	+	Speaker of the House of Representatives. 37
	350	+	(14) A representative from the North Carolina Young People's Alliance, appointed 38
	351	+	by the Governor upon recommendation of the head of the organization. 39
	352	+	(15) Two youth representatives under the age of 21 appointed by the Secretary of 40
	353	+	the Department of Health and Human Services after conducting an 41
	354	+	application-based selection process. 42
	355	+	(c) All members of the Task Force are voting members. Vacancies in the appointed 43
	356	+	membership shall be filled by the appointing officer who made the initial appointment. Terms 44
	357	+	shall be two years. The members shall elect a chair who shall preside for the duration of the 45
	358	+	chair's term as a member. In the event a vacancy occurs in the chair before the expiration of the 46
	359	+	chair's term, the members shall elect an acting chair to serve for the remainder of the unexpired 47
	360	+	term. 48
	361	+	(d) Beginning March 15, 2026, and then annually thereafter, the Task Force shall report 49
	362	+	to the General Assembly on its work, with a special focus on mental health issues related to social 50
	363	+	media, along with findings, recommendations, and any legislative proposals." 51 General Assembly Of North Carolina Session 2025
	364	+	Page 8 DRH40422-MCa-185
	365	+	SECTION 2. Effective July 1, 2025, there is appropriated from the General Fund to 1
	366	+	the Department of Justice the sum of one hundred thousand dollars ($100,000) for the 2025-2026 2
	367	+	fiscal year and the sum of one hundred thousand dollars ($100,000) for the 2026-2027 fiscal year 3
	368	+	to develop the registry created in G.S. 75-71, as enacted by this act. 4
	369	+	SECTION 3. Section 1 of this act becomes effective October 1, 2026. The remainder 5
	370	+	of this act becomes effective July 1, 2025. 6