South Carolina H 3400: School districts

Bill Text

2025-2026 Bill 3400 Text of Previous Version (Dec. 06, 2024) - South Carolina Legislature Online 

South Carolina General Assembly
126th Session, 2025-2026

Bill 3400

Indicates Matter Stricken
Indicates New Matter

(Text matches printed bills. Document has been reformatted to meet World Wide Web specifications.)

A bill

TO AMEND THE SOUTH CAROLINA CODE OF LAWS BY ENACTING THE 
"CHILD DATA PRIVACY AND PROTECTION ACT" BY ADDING ARTICLE 9 TO CHAPTER 5, TITLE 
39 SO AS TO PROVIDE DEFINITIONS, TO PROVIDE FOR CERTAIN DATA PROTECTION IMPACT ASSESSMENTS, 
TO PROVIDE THAT CERTAIN ENTITIES MAY NOT COLLECT, RETAIN, PROCESS, OR SELL 
CERTAIN PERSONAL DATA, TO PROVIDE THAT CERTAIN ENTITIES SHALL UTILIZE PRIVACY 
BY DEFAULT, TO PROVIDE THAT USERS MUST HAVE ACCESS TO THEIR ACCOUNTS, TO 
PROVIDE THAT CERTAIN CIVIL AND CRIMINAL SUBPOENAS AND WARRANTS MUST BE 
EXPEDITED, TO PROVIDE THAT PRIVACY POLICIES MUST BE PROMINENTLY DISPLAYED, TO 
PROVIDE FOR METHODS FOR NOTIFICATIONS, TO PROVIDE FOR A PUBLIC AWARENESS 
CAMPAIGN, TO REQUIRE A REPORT, AND TO PROVIDE FOR A CAUSE OF ACTION.

Be it enacted by the 
General Assembly of the State of South Carolina:

SECTION 1. This act may be cited as the "Child Data Privacy and Protection Act."

SECTION 2. Chapter 5, Title 39 of the S.C. Code is amended by 
adding:

Article 9

Child Data Privacy and Protection

 Section 
39-5-910. As used in this article:

 (1) 
"Child" or "children" means a consumer or consumers under eighteen years of 
age.

 (2) 
"Child user" means a child accessing an online product with a device.

 (3) 
"Data breach" means a breach of security leading to the accidental or unlawful 
destruction, loss, alteration, unauthorized disclosure of, or access to, 
personal data of child users transmitted, stored, or otherwise processed.

 (4) 
"Data controller" or "controller" means a natural or legal person which, alone 
or jointly with others, determines the purposes and means of processing of the 
personal data of child users. This includes, but is not limited to, any 
business, website, or platform that collects data while selling electronic 
advertising space on its platform tailed to any one or any aggregation of the 
items of personal data defined in this item. A data controller is not exempt 
from the requirements of this article if they are processing pseudonymized 
data, whereby "pseudonymized" or "pseudonymization" means the processing of 
personal data in a manner that renders the personal data no longer attributable 
to a specific child user without the use of additional information, provided 
that the additional information is kept separately and is subject to technical 
and organizational measures to ensure that the personal data is not attributed 
to an identified or identifiable child user.

 (5) 
"Data protection impact assessment" means an internal evaluation which the 
Office of the Attorney General requires entities to carry out in order to 
evaluate the level of risk associated with the entity's collection, retention, 
processing, or sale of child user data.

 (6) 
"Online product" means an online service, feature, or platform that is 
accessible to users with a digital device.

 (7) 
"Personal data" or "personal data identifier" means any computerized 
information about a child user set forth in this item that is not made publicly 
available through federal, state, or local government agencies or any publicly 
available information, regardless of whether it is collected for the purpose of 
selling or transferring it to another entity. Personal data also means 
information that identifies, relates to, describes, or is reasonably linked to 
a particular child user including, but not limited to:

 (a) 
physical address;

 (b) 
legal name;

 (c) alias;

 (d) unique personal identifier;

 (e) online identifier;

 (f) 
internet protocol address;

 (g) 
e-mail address;

 (h) 
account name;

 (i) 
social security number;

 (j) 
place of birth;

 (k) 
date of birth;

 (l) 
phone number;

 (m) 
audio, visual, thermal, or olfactory data;

 (n) 
medical history, records of past medical treatment, or any diagnosis of a 
physical or mental health condition or disability;

 (o) 
educational information that is not already publicly available through a local, 
state, or federal agency;

 (p) 
real-time geolocation data or stored geolocation history;

 (q) 
any unique biometric data, body measurement, technical analysis, or 
measurements collected for the purpose of allowing a child user to authenticate 
himself on a device, internet application, or web-based platform;

 (r) 
names and identifying information of a child user's immediate family;

 (s) 
internet or any other electronic network activity, including browsing history, 
search history, and information regarding a child user's activity on a website 
or interaction with an electronic advertisement;

 (t) 
any other information that alone, or combined with any of the information 
described in this item, could be re