North Carolina HB 462: Personal Data Privacy/Social Media Safety.

Bill Text

GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
H 2
HOUSE BILL 462
Committee Substitute Favorable 4/29/25

Short Title: Personal Data Privacy/Social Media Safety. (Public)
Sponsors:
Referred to:
March 20, 2025
*H462-v-2*
A BILL TO BE ENTITLED 1
AN ACT TO PROTECT NORTH CAROLINIANS BY ENACTING THE PERSONAL DATA 2
PRIVACY ACT AND SOCIAL MEDIA SAFETY ACT. 3
The General Assembly of North Carolina enacts: 4
5
PART I. ENACT PERSONAL DATA PRIVACY ACT 6
SECTION 1.1. This Part shall be known and may be cited as the "North Carolina 7
Personal Data Privacy Act." 8
SECTION 1.2. Effective January 1, 2026, the General Statutes are amended by 9
adding a new Chapter to read: 10
"Chapter 75F. 11
"Data Privacy Act. 12
"§ 75F-101. Short title. 13
This Chapter shall be known and may be cited as the "North Carolina Data Privacy Act." 14
"§ 75F-102. Definitions. 15
The following definitions apply in this Chapter: 16
(1) Affiliate. – A legal entity that shares common branding with another legal 17
entity or controls, is controlled by, or is under common control with another 18
legal entity. For the purposes of this subdivision, "control" or "controlled" 19
means any of the following: 20
a. Ownership of, or the power to vote, more than fifty percent (50%) of 21
the outstanding shares of any class of voting security of a legal entity. 22
b. Control in any manner over the election of a majority of the directors 23
or of individuals exercising similar functions. 24
c. The power to exercise controlling influence over the management of a 25
legal entity. 26
(2) Authenticate. – To use reasonable means to determine that a request to 27
exercise any of the rights afforded under G.S. 75F-104(a)(1) to (4), inclusive, 28
is being made by, or on behalf of, the consumer who is entitled to exercise the 29
consumer rights with respect to the personal data at issue. 30
(3) Biometric data. – Personal information and data generated by automatic 31
measurements of an individual's unique biological characteristics, such as a 32
fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns 33
or characteristics that can be used to identify or authenticate a specific 34
individual. "Biometric data" does not include any of the following: 35
a. A digital or physical photograph. 36

General Assembly Of North Carolina Session 2025
Page 2 House Bill 462-Second Edition
b. An audio or video recording. 1
c. Any data generated from a digital or physical photograph, or an audio 2
or video recording, unless the data is generated to identify a specific 3
individual. 4
(4) Child. – As defined in COPPA. 5
(5) Child abuse. – Any conduct that would make an individual under 18 years of 6
age qualify as an abused juvenile under G.S. 7B-101 or any equivalent 7
provision in the laws of any other state; the United States; any territory, 8
district, or subdivision of the United States; or any foreign jurisdiction. 9
(6) Consent. – A clear affirmative act signifying a consumer's freely given, 10
specific, informed, and unambiguous agreement to allow the processing of 11
personal data relating to the consumer. "Consent" may include a written 12
statement, including by electronic means, or any other unambiguous 13
affirmative action. "Consent" does not include any of the following: 14
a. Acceptance of a general or broad terms of use or similar document that 15
contains descriptions of personal data processing along with other, 16
unrelated information. 17
b. Hovering over, muting, pausing, or closing a given piece of content. 18
c. Agreement obtained through the use of dark patterns. 19
(7) Consumer. – An individual who is a resident of this State. "Consumer" does 20
not include an individual acting in a commercial or employment context or as 21
an employee, owner, director, officer, or contractor of a company, partnership, 22
sole proprietorship, nonprofit organization, or government agency whose 23
communications or transactions with the controller occur solely within the 24
context of that individual's role with the company, partnership, sole 25
proprietorship, nonprofit organization, or government agency. 26
(8) Controller. – A person that, alone or jointly with others, determines the 27
purpose and means of processing personal data. 28
(9) COPPA. – The Children's Online Privacy Protection Act of 1998, 15 U.S.C. 29
§ 6501, et seq., as amended, and the regulations, rules, guidance, and 30
exemptions adopted pursuant to the act, and such regulations, rules, guidance, 31
and exemptions as may be amended. 32
(10) Dark pattern. – Any of the following: 33
a. A user interface designed or manipulated with the substantial effect of 34
subverting or impairing user autonomy, decision making, or choice. 35
b. Any other practice the Federal Trade Commission refers to as a dark 36
pattern. 37
(11) Decisions that produce legal or similarly significant effects concerning the 38
consumer. – Decisions made by the controller that result in the provision or 39
denial by t