North Carolina SB 514: Social Media Control in IT Act.

Bill Text

GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
S 1
SENATE BILL 514

Short Title: Social Media Control in IT Act. (Public)
Sponsors: Senator Hanig (Primary Sponsor).
Referred to: Rules and Operations of the Senate
March 26, 2025
*S514-v-1*
A BILL TO BE ENTITLED 1
AN ACT TO COMBAT SOCIAL MEDIA ADDICTION BY REQUIRING THAT SOCIAL 2
MEDIA PLATFORMS RESPECT THE PRIVACY OF NORTH CAROLINA USERS' 3
DATA AND NOT USE A NORTH CAROLINA MINOR'S DATA FOR ADVERTISING 4
OR ALGORITHMIC RECOMMENDATIONS, AND APPROPRIATING FUNDS FOR 5
THAT PURPOSE, AND TO MAKE WILLFUL VIOLATIONS OF DATA USER 6
PRIVACY AN UNFAIR PRACTICE UNDER CHAPTER 75 OF THE GENERAL 7
STATUTES. 8
The General Assembly of North Carolina enacts: 9
SECTION 1. Chapter 75 of the General Statutes is amended by adding a new Article 10
to read: 11
"Article 2B. 12
"Social Media Control in Information Technology. 13
"§ 75-70. Title; definitions. 14
(a) This Article shall be known and may be cited as the "Social Media Algorithmic 15
Control in Information Technology Act." 16
(b) Definitions. – The following definitions apply in this Article: 17
(1) Accessible mechanism. – A user-friendly, clear, easy-to-use, readily 18
available, and technologically feasible method that allows individuals to 19
exercise their data privacy rights without undue burden. The mechanism must 20
be designed to accommodate diverse user needs, including those with 21
disabilities, and should be available across commonly used platforms. The 22
mechanism should provide clear instructions, function without excessive 23
complexity, and be free of unreasonable barriers such as length procedures, 24
hidden settings, or excessive delays. 25
(2) Algorithmic recommendation system. – A computational process that uses 26
machine learning, natural language processing, artificial intelligence 27
techniques, generative artificial intelligence, or other computational 28
processing techniques that makes a decision or facilitates human decision 29
making with respect to user-related data, to rank, order, promote, recommend, 30
suggest, amplify, or similarly determine the delivery or display of information 31
to an individual. 32
(3) Collects, collected, or collection. – Buying, renting, gathering, obtaining, 33
receiving, or accessing any personal information pertaining to a user by any 34
means. This includes receiving information from the consumer, either actively 35
or passively, or by observing the consumer's behavior. 36

General Assembly Of North Carolina Session 2025
Page 2 Senate Bill 514-First Edition
(4) Consent. – Any freely given, specific, informed, and unambiguous indication 1
of a user's wishes by which the consumer, or the consumer's legal guardian, a 2
person who has power of attorney, or a person acting as a conservator for the 3
consumer, including by a statement or by a clear affirmative action, signifies 4
agreement to the processing of personal information relating to the consumer 5
for a narrowly defined particular purpose. None of the following constitutes 6
consent: 7
a. Acceptance of a general or broad terms of use, or similar document, 8
that contains descriptions of personal information processing along 9
with other, unrelated information. 10
b. Hovering over, muting, pausing, or closing a given piece of content. 11
c. Agreement obtained through use of dark patterns. 12
(5) Default settings. – The predetermined options, values, and configurations that 13
a program is initially set to whenever it is installed and initially accessed. 14
(6) Minor. – An individual who is under 18 years of age. 15
(7) Operator. – Defined in section 1302 of the Children's Online Privacy 16
Protection Act of 1998, 15 U.S.C. § 6501. 17
(8) Opt-in mechanism. – An accessible mechanism separate from any other 18
notifications, disclosures, or consents, such as a privacy policy or terms of 19
service, that allows the user to consent to the platform engaging in a specific, 20
narrow, and well-defined practice. The Division of Health Service Regulation 21
has the authority to specify requirements for the notification and consent 22
process, including specific language and disclosures that may include a 23
warning on the harmful effects of manipulative algorithms, the length of time 24
for which the notification must appear before the user has the option to 25
consent, and the process that the user must follow to consent. 26
(9) Personal information. – Information that identifies, relates to, describes, is 27
reasonably capable of being associated with, or could reasonably be linked, 28
directly or indirectly, with a particular consumer or household. Personal 29
information includes, but is not limited to, the following if it identifies, relates 30
to, describes, is reasonably capable of being associated with, or could be 31
reasonably linked, directly or indirectly, with a particular user or household: 32
a. Identifiers such as a real name, alias, postal address, unique personal 33
identifier, online identifier, I