SB 209 expands data privacy protections for minors participating in local government programs or specific child-focused initiatives in North Carolina. It requires local governments in designated areas (including Chatham County, Durham County, Raleigh, and several towns like Apex and Cary) to redact minors' personal details - such as name, address, phone number, and parent information - from public records. The bill specifies that only a minor’s county, municipality, and zip code remain public (with other details redacted), while clarifying that the protected information is not considered confidential. This applies to programs funded by the North Carolina Partnership for Children or local partnerships, but does not affect scholarship award details. The bill is currently pending in the Senate after passing its first reading.
SB 757, the North Carolina Consumer Privacy Act, gives residents the right to access, correct, or delete personal data collected by businesses operating in the state. It requires businesses to stop processing data when consumers request it, with key exceptions for health information (covered under existing health privacy rules) and publicly available data. The law applies to businesses that collect personal data about North Carolina residents, defining "personal data" as information that can identify an individual (like name or online activity), while excluding health data processed under healthcare laws. Enforcement would be handled by the North Carolina Department of Justice’s Consumer Protection Division, with specific rules for how businesses must handle consumer requests. The bill is currently under review by the Senate Rules committee.
HB 890 requires North Carolina's Department of Public Instruction to create an Emergency Internet Service Plan (EISP) ensuring public schools can access temporary internet during state emergencies, like natural disasters. The bill establishes a dedicated Emergency Internet Service Fund with $3.9 million in initial funding for equipment and service contracts, which schools cannot be charged to activate. Key provisions include requiring the plan to cover activation conditions, equipment needs, data protection, and third-party partnerships, while ensuring the fund is nonreverting (unused money carries over). This directly affects all public school units by guaranteeing emergency internet access without requiring school-level funding. The plan must be updated annually and reported to the legislature.
SB 514, the "Social Media Algorithmic Control in Information Technology Act," requires social media platforms with over 1 million monthly U.S. users to obtain clear, separate consent from North Carolina minors (under 18) before using their personal data for advertising or algorithmic recommendations. The bill mandates accessible opt-in mechanisms - replacing default settings - to let users control how their data is processed, while banning the use of minors' data for targeted ads or content algorithms. It defines prohibited data uses broadly to include browsing history, location, and biometric information, and designates violations as unfair business practices under North Carolina law. The law directly affects major social media platforms operating in North Carolina, imposing new data privacy obligations without specifying enforcement details.
HB 462, titled the "Personal Data Privacy/Social Media Safety Act," aims to protect North Carolinians by enacting two main components: the Personal Data Privacy Act and the Social Media Safety Act. The provided text details the "North Carolina Personal Data Privacy Act," which is set to take effect on January 1, 2026. This act establishes definitions for key terms such as "personal data," "biometric data," "precise geolocation data," and "consent," affecting North Carolina residents as "consumers" and entities that process their data as "controllers." It also outlines the framework for consumer rights regarding their personal data.
House Bill 81 requires insurance institutions and agents to obtain written consent from applicants and policyholders before collecting, receiving, selling, or using vehicle telematics data. The bill mandates that individuals be notified how their telematics data will be used and that they can revoke consent at any time. Insurers must provide a reasonable means for individuals to revoke consent, which must be actioned within 24 hours. A violation of these provisions would be considered an unfair trade practice, with the act becoming effective October 1, 2025.
HB 860, the Social Media Control in Information Technology Act, requires social media platforms with over 1 million U.S. monthly active users to stop using North Carolina minors' (under 18) personal data for advertising or algorithm-driven content recommendations. It mandates platforms to provide clear, easy-to-use privacy tools allowing users to control data sharing, with special opt-in consent required for minors' data. The bill prohibits "dark patterns" in consent processes and defines strict terms like "personal information" to cover data ranging from location to health details. Violations would be treated as unfair business practices under North Carolina law, with funds appropriated for enforcement. The law directly affects major social media platforms operating in North Carolina, focusing on protecting minors' data privacy rather than addressing broader social media use.
HB 819 creates North Carolina's Longitudinal Data System, which links student education data (like test scores, graduation records, and course enrollment) with workforce data (such as employment and wages) to track student outcomes. It directly affects public schools, universities, the Department of Public Instruction, and workforce agencies by requiring them to share de-identified student data through this centralized system. Key provisions include strict privacy safeguards (complying with FERPA and HIPAA), mandatory data security plans, a 5-year limit on linking education and workforce data, and annual reporting requirements for the system's oversight body. The bill aims to improve education policy decisions while ensuring data privacy and security for students.
SB 416, the Personal Privacy Protection Act, prohibits North Carolina public agencies from collecting, disclosing, or releasing personal information about members, volunteers, or donors (financial or nonfinancial) to 501(c) nonprofit organizations. It directly affects individuals who support nonprofits, shielding their identities from public agency records. Key provisions ban agencies from requiring such information, publicly sharing it, or asking contractors/grantees for lists of nonprofit supporters. The bill designates this information as non-public under state law, with limited exemptions for court orders, required disclosures, or voluntary releases by the individual.
