NC
North Carolina Senate Bill S514

North Carolina 2025-2026 Regular Session

North Carolina Senate Bill S514 Compare Versions

OldNewDifferences
11 GENERAL ASSEMBLY OF NORTH CAROLINA
22 SESSION 2025
3-S 1
4-SENATE BILL 514
3+S D
4+SENATE BILL DRS45263-LRa-109
5+
56
67
78 Short Title: Social Media Control in IT Act. (Public)
89 Sponsors: Senator Hanig (Primary Sponsor).
9-Referred to: Rules and Operations of the Senate
10-March 26, 2025
11-*S514 -v-1*
10+Referred to:
11+
12+*DRS45263 -LRa-109*
1213 A BILL TO BE ENTITLED 1
1314 AN ACT TO COMBAT SOCIAL MEDIA ADDICTION BY REQUIRING THAT SOCIAL 2
1415 MEDIA PLATFORMS RESPECT THE PRIVACY OF NORTH CAROLINA USERS ' 3
1516 DATA AND NOT USE A NORTH CAROLINA MINOR 'S DATA FOR ADVERTISING 4
1617 OR ALGORITHMIC RECOMMENDATIONS, AND APPROPRIATING FUNDS FOR 5
1718 THAT PURPOSE, AND TO MAKE WILLFUL VIOLATIONS OF DATA USER 6
1819 PRIVACY AN UNFAIR PRACTICE UNDER CHAPTER 75 OF THE GENERAL 7
1920 STATUTES. 8
2021 The General Assembly of North Carolina enacts: 9
2122 SECTION 1. Chapter 75 of the General Statutes is amended by adding a new Article 10
2223 to read: 11
2324 "Article 2B. 12
2425 "Social Media Control in Information Technology. 13
2526 "§ 75-70. Title; definitions. 14
2627 (a) This Article shall be known and may be cited as the "Social Media Algorithmic 15
2728 Control in Information Technology Act." 16
2829 (b) Definitions. – The following definitions apply in this Article: 17
2930 (1) Accessible mechanism. – A user-friendly, clear, easy-to-use, readily 18
3031 available, and technologically feasible method that allows individuals to 19
3132 exercise their data privacy rights without undue burden. The mechanism must 20
3233 be designed to accommodate diverse user needs, including those with 21
3334 disabilities, and should be available across commonly used platforms. The 22
3435 mechanism should provide clear instructions, function without excessive 23
3536 complexity, and be free of unreasonable barriers such as length procedures, 24
3637 hidden settings, or excessive delays. 25
3738 (2) Algorithmic recommendation system. – A computational process that uses 26
3839 machine learning, natural language processing, artificial intelligence 27
3940 techniques, generative artificial intelligence, or other computational 28
4041 processing techniques that makes a decision or facilitates human decision 29
4142 making with respect to user-related data, to rank, order, promote, recommend, 30
4243 suggest, amplify, or similarly determine the delivery or display of information 31
4344 to an individual. 32
4445 (3) Collects, collected, or collection. – Buying, renting, gathering, obtaining, 33
4546 receiving, or accessing any personal information pertaining to a user by any 34
4647 means. This includes receiving information from the consumer, either actively 35
47-or passively, or by observing the consumer's behavior. 36 General Assembly Of North Carolina Session 2025
48-Page 2 Senate Bill 514-First Edition
48+or passively, or by observing the consumer's behavior. 36
49+FILED SENATE
50+Mar 25, 2025
51+S.B. 514
52+PRINCIPAL CLERK General Assembly Of North Carolina Session 2025
53+Page 2 DRS45263-LRa-109
4954 (4) Consent. – Any freely given, specific, informed, and unambiguous indication 1
5055 of a user's wishes by which the consumer, or the consumer's legal guardian, a 2
5156 person who has power of attorney, or a person acting as a conservator for the 3
5257 consumer, including by a statement or by a clear affirmative action, signifies 4
5358 agreement to the processing of personal information relating to the consumer 5
5459 for a narrowly defined particular purpose. None of the following constitutes 6
5560 consent: 7
5661 a. Acceptance of a general or broad terms of use, or similar document, 8
5762 that contains descriptions of personal information processing along 9
5863 with other, unrelated information. 10
5964 b. Hovering over, muting, pausing, or closing a given piece of content. 11
6065 c. Agreement obtained through use of dark patterns. 12
6166 (5) Default settings. – The predetermined options, values, and configurations that 13
6267 a program is initially set to whenever it is installed and initially accessed. 14
6368 (6) Minor. – An individual who is under 18 years of age. 15
6469 (7) Operator. – Defined in section 1302 of the Children's Online Privacy 16
6570 Protection Act of 1998, 15 U.S.C. § 6501. 17
6671 (8) Opt-in mechanism. – An accessible mechanism separate from any other 18
6772 notifications, disclosures, or consents, such as a privacy policy or terms of 19
6873 service, that allows the user to consent to the platform engaging in a specific, 20
6974 narrow, and well-defined practice. The Division of Health Service Regulation 21
7075 has the authority to specify requirements for the notification and consent 22
7176 process, including specific language and disclosures that may include a 23
7277 warning on the harmful effects of manipulative algorithms, the length of time 24
7378 for which the notification must appear before the user has the option to 25
7479 consent, and the process that the user must follow to consent. 26
7580 (9) Personal information. – Information that identifies, relates to, describes, is 27
7681 reasonably capable of being associated with, or could reasonably be linked, 28
7782 directly or indirectly, with a particular consumer or household. Personal 29
7883 information includes, but is not limited to, the following if it identifies, relates 30
7984 to, describes, is reasonably capable of being associated with, or could be 31
8085 reasonably linked, directly or indirectly, with a particular user or household: 32
8186 a. Identifiers such as a real name, alias, postal address, unique personal 33
8287 identifier, online identifier, Internet Protocol address, email address, 34
8388 account name, social security number, drivers license number, 35
8489 passport number, or other similar identifiers. 36
8590 b. Commercial information, including, but not limited to, records of 37
8691 personal property, products, or service purchases, obtained or 38
8792 considered, or other purchasing or consumer histories or tendencies. 39
8893 c. Biometric information that is any information relating to an 40
8994 individual's physiological, biological, or behavioral characteristics, 41
9095 including, but not limited to, imagery of the iris, retina, fingerprint, 42
9196 face, hand, palm, gait, vein patterns, and voice recordings. 43
9297 d. Internet or other electronic network activity information, including, 44
9398 but not limited to, browsing history, search history, and information 45
9499 regarding a user's interaction with an internet website application or 46
95100 advertisement. 47
96101 e. Usage data. 48
97102 f. Third-party data. 49
98103 g. Geolocation data. 50
99104 h. Audio, electronic, visual, thermal, olfactory, or similar information. 51 General Assembly Of North Carolina Session 2025
100-Senate Bill 514-First Edition Page 3
105+DRS45263-LRa-109 Page 3
101106 i. Professional or employment-related information. 1
102107 j. Education information, defined as information that is not publicly 2
103108 available, personally identifiable information as defined in the Family 3
104109 Education Rights and Privacy Act (20 U.S.C. § 1232(g); 34 C.F.R. 4
105110 Part 99). 5
106111 k. Financial information from a user, including, but not limited to, a 6
107112 user's account log-in, financial account, debit card, or credit card 7
108113 number in combination with any required security or access code, 8
109114 password, or credentials allowing access to an account. 9
110115 l. The contents of a user's mail, email, and text messages unless the 10
111116 platform is the intended recipient of the communication. 11
112117 m. A user's racial or ethnic origin, citizenship or immigration status, 12
113118 religious or philosophical beliefs, or union membership. 13
114119 n. Information related to a user's health, sex life, or sexual orientation. 14
115120 o. Inferences drawn from any of the information identified in this 15
116121 subdivision reflecting the user's preferences, characteristics, 16
117122 psychological trends, predispositions, behavior, attitudes, intelligence, 17
118123 abilities, and aptitudes. 18
119124 (10) Platform user. – An individual who resides in North Carolina who uses a 19
120125 social media platform. 20
121126 (11) Social media platform, covered platform, or platform. – An electronic medium 21
122127 with more than 1,000,000 monthly active users in the United States that 22
123128 functions as a social media service. The term does not include any of the 23
124129 following: 24
125130 a. An entity acting in its capacity as a provider of a common carrier 25
126131 service subject to the Communications Act of 1934 (47 U.S.C. § 151, 26
127132 et seq.,) as amended and supplemented. 27
128133 b. A broadband internet access service under section 8.1(b) of Title 47 of 28
129134 the Code of Federal Regulations. 29
130135 c. An electronic mail service. 30
131136 d. Internet search engines specifically designed to lead a user to a result 31
132137 which a user expressly searched for. 32
133138 e. Internet service providers. 33
134139 f. A wireless messaging service provided through the short messaging 34
135140 service or multimedia messaging service protocols. 35
136141 g. Video game services specifically designed to serve as a platform to 36
137142 solely play video games. 37
138143 h. Online shopping or e-commerce services specifically designed for that 38
139144 sole purpose. 39
140145 i. Video-streaming services that solely provide non-user generated 40
141146 content. 41
142147 (12) Third-party data. – Personal data from another person, company, data broker, 42
143148 and/or platform that is not the user to whom the data pertains and is not the 43
144149 platform. The term does not refer to persons, companies, data brokers, and/or 44
145150 platforms that collect personal data from another entity if the entity shares 45
146151 common branding with the platform, controls the platform, is controlled by 46
147152 the platform, or is under common control of another legal entity with the 47
148153 platform. 48
149154 (13) Usage data. – Any information that is gathered about a user's interactions, 49
150155 behaviors, preferences, and usage patterns on a platform, including, but not 50
151156 limited to, information related to pages visited, clicks, scrolls, navigation 51 General Assembly Of North Carolina Session 2025
152-Page 4 Senate Bill 514-First Edition
157+Page 4 DRS45263-LRa-109
153158 patterns, search queries, button presses, feature usage, frequency of logins, 1
154159 session duration, items added or removed from a shopping cart, purchasing 2
155160 history, subscription usage, content watched, content read, content listened to, 3
156161 or time spent using or engaging with any feature or piece of content on the 4
157162 platform. This includes any and all inferences derivable and related to a user 5
158163 from this usage data, including user engagement statistics, content metrics, 6
159164 feature usage statistics, user flow data, retention rates, and churn rates. 7
160165 "§ 75-71. User data privacy; targeting minors prohibited; registry. 8
161166 (a) Privacy Requirements. – The General Assembly finds that unhealthy social media use 9
162167 has been linked to depression, anxiety, eating disorders, and suicidal ideation, especially among 10
163168 young people. Exploitation of user data can result in users being targeted in ways that increase 11
164169 unhealthy social media use. It is the policy of this State that user data shall be respected by 12
165170 platforms. Special protections are warranted for users who are minors. Therefore, the operator of 13
166171 a social media platform shall comply with all of the following requirements for platform users: 14
167172 (1) The platform must specifically and clearly inform users in the following ways: 15
168173 a. A disclosure in a clear, easy-to-read, and accessible format when a user 16
169174 first initializes their use of a platform for the first time, or after a period 17
170175 of inactivity greater than or equal to six months, about how the 18
171176 platform collects personal information, what personal information the 19
172177 platform collects, how the personal information is used by the platform 20
173178 for every use case, and how the user can exercise their rights and 21
174179 choices on the platform. This disclosure must be provided in no more 22
175180 than 500 words, and the platform must obtain a user's consent before 23
176181 the platform collects any user-related data on the user. 24
177182 b. A disclosure in a clear, easy-to-read, and accessible format that details 25
178183 (i) the categories of information the platform has collected about the 26
179184 user, (ii) the categories of sources from which the information is 27
180185 collected, (iii) the business or commercial purpose for collecting, 28
181186 selling, or sharing personal information, (iv) the categories of third 29
182187 parties to whom the business discloses personal information, and (v) 30
183188 the specific pieces of personal information it has collected about that 31
184189 user. Such information must be available upon receipt of a verifiable 32
185190 consumer request made through an accessible mechanism on the 33
186191 platform. 34
187192 (2) Personal information may be used in algorithmic recommendations only when 35
188193 both of the following requirements are met: 36
189194 a. The platform reasonably determines the user is not a minor from 37
190195 personal information collected by and available to the covered 38
191196 platform in its ordinary course of business. 39
192197 b. The user has been notified and expressly consents to the use of their 40
193198 own data in this manner by consenting in an opt-in mechanism. 41
194199 (3) Through an accessible mechanism, users must be given the capacity to alter, 42
195200 change, and delete what categories of personal information are used in a 43
196201 platform's algorithmic recommendation system or systems. This selection 44
197202 shall be modifiable at any time. If a user indicates that they intend a certain 45
198203 category of personal information not to be used in an algorithmic 46
199204 recommendation system, then the platform must not include said category or 47
200205 categories within an algorithmic recommendation system. A covered platform 48
201206 shall not discriminate against a user because the user exercised any of the 49
202207 rights under this Article in the provision of functionality or features of the 50
203208 covered platform, unless the use of user-related data in an algorithmic 51 General Assembly Of North Carolina Session 2025
204-Senate Bill 514-First Edition Page 5
209+DRS45263-LRa-109 Page 5
205210 recommendation system is reasonably necessary to the feature or 1
206211 functionality. 2
207212 (b) Targeting Minors Prohibited. – A covered platform must establish comprehensive and 3
208213 effective controls to ensure that a minor's personal information is not used in any algorithmic 4
209214 recommendation system. 5
210215 (c) Exceptions. – Subsection (b) of this section does not apply to any of the following: 6
211216 (1) Recommending or presenting content from accounts that a user follows in 7
212217 reverse chronological order or a similar method of recommending or 8
213218 presenting content. 9
214219 (2) A user's explicit search for content or request for information for the sole 10
215220 purpose of providing immediate results to the search and without retention or 11
216221 use of the user-related data from the search or request for purposes other than 12
217222 providing results to the search or request. 13
218223 (3) A covered platform's action, voluntarily taken in good faith to restrict access 14
219224 to or availability of material as described in section 230(c)(2)(A) of the 15
220225 Communications Act of 1934 (47 U.S.C. § 230(c)(2)(A)), is not subject to this 16
221226 subdivision, and nothing in this section otherwise limits or otherwise affects 17
222227 the provisions of section 230 of the Communications Act of 1934, except as 18
223228 otherwise provided in this Article. 19
224229 (d) The operator of a social media platform may be held liable for violating subsection 20
225230 (a) of this section if the user was given algorithmic content recommendations without a proper 21
226231 opt-in mechanism or affirmation from the user from the opt-in process. The operator of a social 22
227232 media platform may be held liable for violating subsection (b) of this section if the operator of 23
228233 the social media platform knew or had reason to know that the user was a minor. The operator of 24
229234 a social media platform that has made an estimation of a user's age based upon the user's 25
230235 self-attestation is not liable if the user was a minor who falsely attested to not being a minor. 26
231236 "§ 75-72. Design features and digital rights of users. 27
232237 (a) Protective Default Settings for Minors. – A covered platform shall configure all 28
233238 privacy settings provided to any user by the online service, product, or feature to be both available 29
234239 to minors and, by default, set to preferences that offer the highest level of privacy, unless the 30
235240 business can demonstrate a compelling reason that a different setting is in the best interest of 31
236241 minors. These settings must include all of the following: 32
237242 (1) Notifications must be turned off by default. 33
238243 (2) The visibility of reaction or interaction counts on all content, including content 34
239244 generated by a minor and content seen by a minor generated from others, must 35
240245 be turned off by default. 36
241246 (3) The ability of other users, not added by the user to a list of approved contacts, 37
242247 to communicate with the minor must be turned off by default. 38
243248 (4) The ability of other users, whether registered or not, and not added by the user 39
244249 to a list of approved contacts, to view the minor's user-related data collected 40
245250 by or shared on the platform must be disabled by default. 41
246251 (5) The ability of other users to see the geolocation of a minor must be disabled 42
247252 by default. 43
248253 (6) Features that increase, sustain, or extend the use of a covered platform by a 44
249254 minor, such as automatic playing of media and rewards for time spent on the 45
250255 platform, must be disabled by default. 46
251256 (b) Rights to Change and Delete Data. – A covered platform shall provide users with both 47
252257 of the following: 48
253258 (1) An accessible mechanism to request the correction of any inaccurate personal 49
254259 information about the user, taking into account the nature of the personal 50
255260 information and the purposes of the personal information. A platform that 51 General Assembly Of North Carolina Session 2025
256-Page 6 Senate Bill 514-First Edition
261+Page 6 DRS45263-LRa-109
257262 receives a verifiable request to correct inaccurate personal information shall 1
258263 use commercially reasonable efforts to correct the inaccurate personal 2
259264 information as directed by the user. A covered platform shall maintain a record 3
260265 of all requests. 4
261266 (2) An accessible mechanism to request the deletion of personal information 5
262267 about the user, taking into account the nature of the personal information and 6
263268 the purposes of the personal information. If the personal information is 7
264269 reasonably necessary for the platform to complete a transaction, to ensure the 8
265270 security and integrity of the user's personal information, to debug or identify 9
266271 and repair errors in the platform, to exercise free speech and ensure the user's 10
267272 right to exercise free speech, to comply with existing federal and State 11
268273 regulations, to engage in public- or peer-reviewed scientific research, or to 12
269274 enable solely internal uses reasonably aligned with a consumer's expectations, 13
270275 then the covered platform is not required to comply with the user's request. 14
271276 Otherwise, the covered platform is required to complete the request. A 15
272277 covered platform shall maintain a confidential record of all requests. 16
273278 (c) Digital Rights of the User. – All of the following rights belong to every minor utilizing 17
274279 covered platforms: 18
275280 (1) Right to protection from manipulative design. – Every minor has the right to 19
276281 be protected from manipulative design techniques which exploit 20
277282 psychological vulnerability or have been shown by the preponderance of the 21
278283 evidence to create addiction or dependency. 22
279284 (2) Right to transparency. – Every minor has the right to understand the nature of 23
280285 their digital experiences. Platforms and services should provide clear and 24
281286 accessible explanations of the platform features as well as how covered 25
282287 platforms can negatively affect their well-being. 26
283288 (3) Right to protection from personalized recommendation systems. – Every 27
284289 minor has the right to be protected from algorithmic recommendation systems. 28
285290 (d) The operator of a covered platform may be subject to violations of subsection (a), (b), 29
286291 or (c) of this section if any of the requirements and rights established herein have been determined 30
287292 to be violated. 31
288293 "§ 75-73. Investigation; enforcement; private right of action. 32
289294 (a) Violations. – Effective January 1, 2026, a platform's violation of this Article is an 33
290295 unfair or deceptive act or practice under G.S. 75-1.1. 34
291296 (b) Investigations. – The Attorney General shall monitor social media platforms for 35
292297 compliance with this Article. 36
293298 (c) Complaints. – A platform user may make a complaint to the Attorney General 37
294299 alleging that a social media platform has failed to comply with the requirements of this Article. 38
295300 The Attorney General may bring a civil action in any case in which the Attorney General has 39
296301 reason to believe that the interest of the residents of this State has been or is threatened due to 40
297302 noncompliance with this Article. 41
298303 (d) Private Right of Action. – Minors can file suit if they are affected by any covered 42
299304 platform found to be in violation of this Article through mechanisms involved in parens patriae 43
300305 jurisdiction by the following: 44
301306 (1) Civil suit brought through private action attorneys. 45
302307 (2) Relief. – In a civil action brought under this subsection or subsection (c) of 46
303308 this section in which a plaintiff prevails, the court may award the plaintiff any 47
304309 one or more of the following: 48
305310 a. An amount equal to the sum of any compensatory damages. 49
306311 b. Punitive damages. 50
307312 c. Injunctive relief. 51 General Assembly Of North Carolina Session 2025
308-Senate Bill 514-First Edition Page 7
313+DRS45263-LRa-109 Page 7
309314 d. Declaratory relief. 1
310315 e. Reasonable attorneys' fees and litigation costs. 2
311316 "§ 75-74. North Carolina Data Privacy Task Force. 3
312317 (a) There is created the North Carolina Data Privacy Task Force (Task Force) within the 4
313318 Department of Justice for budgetary purposes only. 5
314319 (b) The Task Force shall be composed of 21 members. The ex officio members listed in 6
315320 subdivisions (1) through (6) of this subsection may designate representatives from their particular 7
316321 departments, divisions, or offices to represent them on the Task Force. In making appointments 8
317322 or designating representatives, appointing authorities and ex officio members shall use best 9
318323 efforts to select members or representatives with sufficient knowledge and experience to 10
319324 effectively contribute to the issues examined by the Task Force and, to the extent possible, to 11
320325 reflect the geographical, political, gender, and racial diversity of this State. The members shall 12
321326 be as follows: 13
322327 (1) The Attorney General. 14
323328 (2) The State Chief Information Officer. 15
324329 (3) The Secretary of the Department of Health and Human Services. 16
325330 (4) The Director of the State Bureau of Investigation. 17
326331 (5) The Director of the Maternal and Child Health Section of the Department of 18
327332 Health and Human Services. 19
328333 (6) The Director of the Division of Mental Health, Developmental Disabilities, 20
329334 and Substance Use Services. 21
330335 (7) A representative from NC Child, appointed by the Governor upon 22
331336 recommendation of the President of the organization. 23
332337 (8) A representative from a private group, other than NC Child, that advocates for 24
333338 children, appointed by the Governor upon recommendation of private child 25
334339 advocacy organizations. 26
335340 (9) A pediatrician, licensed to practice medicine in North Carolina, appointed by 27
336341 the President Pro Tempore of the Senate. 28
337342 (10) A psychiatrist, licensed to practice medicine in North Carolina, appointed by 29
338343 the Speaker of the House of Representatives. 30
339344 (11) Two public members, one of whom is an educator, appointed by the Speaker 31
340345 of the House of Representatives. 32
341346 (12) Two public members, one of whom is a social worker, appointed by the 33
342347 President Pro Tempore of the Senate. 34
343348 (13) Two members of the Senate, appointed by the President Pro Tempore of the 35
344349 Senate, and two members of the House of Representatives, appointed by the 36
345350 Speaker of the House of Representatives. 37
346351 (14) A representative from the North Carolina Young People's Alliance, appointed 38
347352 by the Governor upon recommendation of the head of the organization. 39
348353 (15) Two youth representatives under the age of 21 appointed by the Secretary of 40
349354 the Department of Health and Human Services after conducting an 41
350355 application-based selection process. 42
351356 (c) All members of the Task Force are voting members. Vacancies in the appointed 43
352357 membership shall be filled by the appointing officer who made the initial appointment. Terms 44
353358 shall be two years. The members shall elect a chair who shall preside for the duration of the 45
354359 chair's term as a member. In the event a vacancy occurs in the chair before the expiration of the 46
355360 chair's term, the members shall elect an acting chair to serve for the remainder of the unexpired 47
356361 term. 48
357362 (d) Beginning March 15, 2026, and then annually thereafter, the Task Force shall report 49
358363 to the General Assembly on its work, with a special focus on mental health issues related to social 50
359364 media, along with findings, recommendations, and any legislative proposals." 51 General Assembly Of North Carolina Session 2025
360-Page 8 Senate Bill 514-First Edition
365+Page 8 DRS45263-LRa-109
361366 SECTION 2. Effective July 1, 2025, there is appropriated from the General Fund to 1
362367 the Department of Justice the sum of one hundred thousand dollars ($100,000) for the 2025-2026 2
363368 fiscal year and the sum of one hundred thousand dollars ($100,000) for the 2026-2027 fiscal year 3
364369 to develop the registry created in G.S. 75-71, as enacted by this act. 4
365370 SECTION 3. Section 1 of this act becomes effective October 1, 2026. The remainder 5
366371 of this act becomes effective July 1, 2025. 6