WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(a) This Article shall be known and may be cited as the "Social Media Algorithmic Control in Information Technology Act."
(b) Definitions. – The following definitions apply in this Article: (1) Algorithmic recommendation systemAlgorithmic recommendation system"Algorithmic recommendation system" means a fully or partially automated system used to suggest, promote, or rank information.G.S. § 75-70(b)(1). – A fully or partially automated system used to suggest, promote, or rank information. (2) MinorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2). – An individual who is age 18 or younger. (3) OperatorOperator"Operator" means as defined in section 1302 of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. § 6501.G.S. § 75-70(b)(3). – As defined in section 1302 of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. § 6501. (4) Social media algorithmSocial media algorithm"Social media algorithm" means the software used by social media platforms to prioritize content and direct the prioritized content to the user.G.S. § 75-70(b)(4). – The software used by social media platformsSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) to prioritize content and direct the prioritized content to the user. (5) Social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) or platform. – An electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail. (6) User dataUser data"User data" means any data collected directly or indirectly from or concerning a user.G.S. § 75-70(b)(6). – Any data collected directly or indirectly from or concerning a user.
This section establishes the short title of the act — the Social Media Algorithmic Control in Information Technology Act — and defines six key terms used throughout the article. The definition of operator incorporates by reference the COPPA definition at 15 U.S.C. § 6501, while social media platform is broadly defined to include any electronic medium enabling user-generated content but excludes search engines and email.
(a)(1) 1 The platform's privacy policy must be accessible on the platform's website with the disclosure of how user dataUser data"User data" means any data collected directly or indirectly from or concerning a user.G.S. § 75-70(b)(6) will be used by the platform stated in a succinct and easy to understand statement that communicates the true intent of the use in less than 250 words.
(a)(2) 2 User dataUser data"User data" means any data collected directly or indirectly from or concerning a user.G.S. § 75-70(b)(6) may be used in algorithmic recommendations only when the user has been notified and consents to the use of the data in such manner.
(a)(3) 3 Requests for data access that will be used to inform algorithmic recommendations shall require full disclosure of the use of the data, including third-party use. This notification shall be separate and distinct from the platform's terms of service notification.
(a)(4) 4 The platform must be fully functional for a user without the user having to give consent for their user dataUser data"User data" means any data collected directly or indirectly from or concerning a user.G.S. § 75-70(b)(6) to be used to inform algorithmic recommendations.
(a)(5) 5 The platform must use an age verification system that requires a user to self-attest to their age.
(a) registry 6 Beginning October 1, 2024, and then annually thereafter, a social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) shall provide the Consumer Protection Division of the North Carolina Department of Justice (Division) with a digital copy of the platform's privacy policy and certification that the platform has complied with the requirements of this subsection. Platforms shall provide notice of substantive privacy policy changes to the registry. The Division shall maintain a registry of these policies and certifications on its internet website.
(b)(1)–(2) 7 The operator of a social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) must control algorithmic recommendation systemsAlgorithmic recommendation system"Algorithmic recommendation system" means a fully or partially automated system used to suggest, promote, or rank information.G.S. § 75-70(b)(1) so that no minorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2)'s user dataUser data"User data" means any data collected directly or indirectly from or concerning a user.G.S. § 75-70(b)(6) is used: (1) To inform content recommendations to the minorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2). This requirement is not intended to prevent algorithmic recommendations from being shown as a direct result of explicit actions, such as showing posts from accounts a user follows in a chronological feed, but it is intended to prevent any data, including follows, from being used in an algorithm to generate algorithmic recommendations. (2) To inform what advertisements or promotions are shown to minorsMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2). This requirement is not intended to prevent the showing of advertisements or promotions that are shown to the user based upon explicit actions, such as being based on the results of a search initiated by the user on the platform.
(b) liability 7 The operator of a social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) may be held liable for violating this subsection if the operator of the social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) knew or had reason to know that the user was a minorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2). The operator of a social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) that has made an estimation of a user's age based upon the user's self-attestation is not liable if the user was a minorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2) who falsely attested to not being a minorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2).
(c) Exceptions. – A social media algorithmSocial media algorithm"Social media algorithm" means the software used by social media platforms to prioritize content and direct the prioritized content to the user.G.S. § 75-70(b)(4) that is intended to block access to inappropriate or harmful content to an account holder that is a minorMinor"Minor" means an individual who is age 18 or younger.G.S. § 75-70(b)(2) is exempt from the requirements of this section.
Section 75-71 is the bill's operative core, imposing three categories of obligations on social media platform operators. Subsection (a) establishes baseline privacy requirements applicable to all users: platforms must publish a concise privacy policy (under 250 words), obtain affirmative consent before using data for algorithmic recommendations, provide full disclosure of data use (including third-party sharing) separate from terms of service, ensure full platform functionality without algorithmic-data consent, and implement age self-attestation. Platforms must also annually certify compliance and submit privacy policies to the NC DOJ Consumer Protection Division for a public registry.
Subsection (b) prohibits using any minor's user data for algorithmic content recommendations or targeted advertising, with a knowledge-based liability standard and a safe harbor for operators who relied on a minor's false age self-attestation. Subsection (c) carves out algorithms designed to block minors' access to inappropriate or harmful content.
(a) Violations. – Effective January 1, 2025, a platform's violation of this Article is an unfair or deceptive act or practice under G.S. 75-1.1.
(b) Investigations. – The Attorney General shall monitor social media platformsSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) for compliance with this Article.
(c) Complaints. – A user may make a complaint to the Attorney General alleging that a social media platformSocial media platform"Social media platform" or "platform" means an electronic medium, including a browser-based or application-based interactive computer service, telephone network, or data network, that allows users to create, share, and view user-generated content. The term does not include internet search providers or electronic mail.G.S. § 75-70(b)(5) has failed to comply with the requirements of this Article. The Attorney General may bring a civil action in any case in which the Attorney General has reason to believe that the interest of the residents of this State has been or is threatened due to noncompliance with this Article.
(d) Private Right of Action. – No private right of action may be brought by an individual for a violation of this Article unless the individual is harmed as a result of the violation.
Section 75-72 establishes the enforcement framework. Violations are classified as unfair or deceptive acts under G.S. 75-1.1, effective January 1, 2025, which makes available the existing UDAP remedies including treble damages and attorney's fees. The Attorney General is charged with monitoring platforms and may bring civil actions when residents' interests are threatened. Users may file complaints with the Attorney General. A private right of action is available but is conditioned on the individual having been harmed as a result of the violation — an actual-harm requirement that limits private enforcement.
(a) There is created the North Carolina Data Privacy Task Force (Task Force) within the Department of Justice for budgetary purposes only.
(b) The Task Force shall be composed of 21 members. The ex officio members listed in subdivisions (1) through (6) of this subsection may designate representatives from their particular departments, divisions, or offices to represent them on the Task Force. In making appointments or designating representatives, appointing authorities and ex officio members shall use best efforts to select members or representatives with sufficient knowledge and experience to effectively contribute to the issues examined by the Task Force and, to the extent possible, to reflect the geographical, political, gender, and racial diversity of this State. The members shall be as follows: (1) The Attorney General. (2) The State Chief Information Officer. (3) The Secretary of the Department of Health and Human Services. (4) The Director of the State Bureau of Investigation. (5) The Director of the Maternal and Child Health Section of the Department of Health and Human Services. (6) The Director of the Division of Mental Health, Developmental Disabilities, and Substance Abuse Services. (7) A representative from NC Child, appointed by the Governor upon recommendation of the President of the organization. (8) A representative from a private group, other than NC Child, that advocates for children, appointed by the Governor upon recommendation of private child advocacy organizations. (9) A pediatrician, licensed to practice medicine in North Carolina, appointed by the President Pro Tempore of the Senate. (10) A psychiatrist, licensed to practice medicine in North Carolina, appointed by the Speaker of the House of Representatives. (11) Two public members, one of whom is an educator, appointed by the Speaker of the House of Representatives. (12) Two public members, one of whom is a social worker, appointed by the President Pro Tempore of the Senate. (13) Two members of the Senate, appointed by the President Pro Tempore of the Senate, and two members of the House of Representatives, appointed by the Speaker of the House of Representatives. (14) A representative from the North Carolina Young People's Alliance, appointed by the Governor upon recommendation of the head of the organization. (15) Two youth representatives under the age of 21 appointed by the Secretary of the Department of Health and Human Services after conducting an application-based selection process.
(c) All members of the Task Force are voting members. Vacancies in the appointed membership shall be filled by the appointing officer who made the initial appointment. Terms shall be two years. The members shall elect a chair who shall preside for the duration of the chair's term as member. In the event a vacancy occurs in the chair before the expiration of the chair's term, the members shall elect an acting chair to serve for the remainder of the unexpired term.
(d) Beginning March 15, 2024, and then annually thereafter, the Task Force shall report to the General Assembly on its work, with a special focus on mental health issues related to social media, along with findings, recommendations, and any legislative proposals.
Section 75-73 creates a 21-member North Carolina Data Privacy Task Force housed within the Department of Justice. The Task Force includes ex officio members from state agencies (Attorney General, State CIO, DHHS, SBI), appointed medical and child-advocacy professionals, legislators, youth representatives, and public members. The Task Force is charged with studying social media's impact on mental health and reporting annually to the General Assembly beginning March 15, 2024. This section creates a governmental study obligation, not a private-sector compliance duty.