WHAT THIS BILL REGULATES · 3 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(a) There is hereby established in the Office of the Attorney General of North Carolina, the Online Safety DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6) (DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6)). The attorneys assigned to this DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6) shall function as an independent regulatory office within the Department of Justice focusing on online safety, with an emphasis on the protection of children online. The DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6) shall have the following duties: (1) Investigation of complaints made under the Chapter 114B of the General Statute (Children's Online Safety Act). (2) Educating of law enforcement agencies and the general public about the online safety of all North Carolinians, with an emphasis targeting harmful activities and dark patternsDark patternsDark patterns. – Manipulative design elements in online environments.G.S. § 114B-1(5). (3) Issuance of online safety standards and guidelines, and review of relevant industry codes pertaining to internet safety, age-appropriate designAge-appropriate designAge-appropriate design. – Design focused on developmental needs of children.G.S. § 114B-1(1), and compliance with the Children's Online Safety Act. (4) Facilitating advisory panels on internet safety, including child development experts, technology specialists, parent representatives, community stakeholders, and industry representatives.
This section creates the Online Safety Division within the North Carolina Attorney General's office as an independent regulatory office focused on online safety with an emphasis on protecting children. The Division's duties include investigating complaints under the Children's Online Safety Act, educating law enforcement and the public, issuing safety standards and guidelines, reviewing industry codes, and facilitating advisory panels with diverse stakeholders.
The Division is the operational enforcement arm — it receives and investigates complaints and issues the standards and guidelines that covered platforms must follow. The appropriation in Section 1.(b) provides $5 million for FY 2025–2026 and $4.5 million for FY 2026–2027.
The following definitions apply in this Article: (1) Age-appropriate designAge-appropriate designAge-appropriate design. – Design focused on developmental needs of children.G.S. § 114B-1(1). – Design focused on developmental needs of children. (2) Child or minorChild or minorChild or minor. – An individual under eighteen (18) years of ageG.S. § 114B-1(2). – An individual under eighteen (18) years of age (4) Covered platformCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4). – An internet platform providing online servicesOnline serviceOnline service. – Social media, gaming platforms, messaging services, content-sharing platforms, and other user-interactive services provided by a covered platform.G.S. § 114B-1(8) having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually. (5) Dark patternsDark patternsDark patterns. – Manipulative design elements in online environments.G.S. § 114B-1(5). – Manipulative design elements in online environments. (6) DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6). – The Online Safety Division of the North Carolina Department of Justice. (7) Harmful contentHarmful contentHarmful content. – Content that includes cyberbullying, self-harm promotion, sexually explicit material, violent content, discrimination, and other physical or psychological harms.G.S. § 114B-1(7). – Content that includes cyberbullying, self-harm promotion, sexually explicit material, violent content, discrimination, and other physical or psychological harms. (8) Online serviceOnline serviceOnline service. – Social media, gaming platforms, messaging services, content-sharing platforms, and other user-interactive services provided by a covered platform.G.S. § 114B-1(8). – Social media, gaming platforms, messaging services, content-sharing platforms, and other user-interactive services provided by a covered platformCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4).
This section establishes the key defined terms for the Children's Online Safety Act. The most consequential definition is covered platform, which scopes the entire Act to internet platforms with more than 5 million North Carolina users and annual revenues exceeding $25 million — a threshold that targets major social media, gaming, and messaging services while excluding smaller platforms. The definition of dark patterns is notably broad and vague ('manipulative design elements in online environments'), which may create compliance uncertainty and constitutional vulnerability.
(a) It is the public policy of this State that its children are owed a duty of care with regard to their online activities in order to limit foreseeable harm and their exposure to dark patternsDark patternsDark patterns. – Manipulative design elements in online environments.G.S. § 114B-1(5) and harmful contentHarmful contentHarmful content. – Content that includes cyberbullying, self-harm promotion, sexually explicit material, violent content, discrimination, and other physical or psychological harms.G.S. § 114B-1(7) on covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4). Further, the General Assembly endorses age-appropriate designAge-appropriate designAge-appropriate design. – Design focused on developmental needs of children.G.S. § 114B-1(1) and strong parental controls as central to protecting children in online serviceOnline serviceOnline service. – Social media, gaming platforms, messaging services, content-sharing platforms, and other user-interactive services provided by a covered platform.G.S. § 114B-1(8) environments.
(b) 1 Covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4) shall require parental notification for accounts created by children and must offer robust, easy-to-use parental supervision tools such as filtering options, contact management, time limits and scheduling, purchase controls, and activity reporting.
(c) 2 It is unlawful for covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4) to use dark patternsDark patternsDark patterns. – Manipulative design elements in online environments.G.S. § 114B-1(5) or deploy features known to be addictive or manipulative.
(d) 3 Covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4) shall establish clear definitions of what constitutes cyberbullying and include provisions for direct reporting to the DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6), as well as provide intervention and support services for affected children, including mediation options where appropriate.
(e) 4 Each covered platformCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4) shall submit to the Online Safety DivisionDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6) an annual Child Impact Assessment for new an existing services on the platform. The assessment shall include documentation of potential risks to children and assessment of addiction and compulsive usage risks. The documentation supporting each annual assessment shall be retained for at least a three-year period
(f) 5 Covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4) shall utilize the highest privacy settings by default for all users reasonably likely to be children and shall establish strict data minimization principles to include the following: (1) Limiting collection of personal data to what is necessary for the service. (2) Requiring deletion when no longer needed. (3) Prohibiting data use for commercial purposes unless strictly necessary. (4) Including "Right to be Forgotten" provisions empowering minors to request deletion of their data and content. (5) Prohibiting profiling and behavioral advertising targeting children. (6) Requiring child-friendly privacy information and controls. (7) Mandating transparency about personal data use. (8) Establishing clear restrictions on geolocation data collection and use. (9) Data broker restrictions for children's information.
This is the core operative section, establishing a broad duty of care owed by covered platforms to children and imposing six distinct categories of obligation. Subsection (a) declares the State's public policy that children are owed a duty of care limiting foreseeable harm and exposure to dark patterns and harmful content. Subsection (b) requires parental notification for minor accounts and mandates robust parental supervision tools. Subsection (c) categorically prohibits dark patterns and addictive or manipulative features.
Subsection (d) requires platforms to define cyberbullying, provide direct reporting to the Division, and offer intervention and support services. Subsection (e) imposes an annual Child Impact Assessment requirement — submitted to the Online Safety Division — covering potential risks to children and addiction/compulsive usage risks, with a three-year document retention obligation. Subsection (f) mandates highest-privacy-by-default settings for users reasonably likely to be children and establishes an extensive data minimization regime including purpose limitation, deletion requirements, a right to be forgotten, prohibition on profiling and behavioral advertising targeting children, child-friendly privacy controls, transparency about data use, geolocation restrictions, and data broker restrictions.
(a) The Attorney General shall bring civil actions to enforce this Article. In any suit instituted by the Attorney General, in which the defendant is found to have violated this Chapter and the acts or practices which constituted the violation were, when committed, knowingly violative of a statute, the court may, in its discretion, impose a civil penalty against the defendant of up to five hundred thousand dollars ($500,000) for each violation. Civil penalties may be imposed in a new action or by motion in an earlier action, whether or not such earlier action has been concluded. In determining the amount of the civil penalty, the court shall consider all relevant circumstances, including, but not limited to, the extent of the harm caused by the conduct constituting a violation, the nature and persistence of such conduct, the length of time over which the conduct occurred, the assets, liabilities, and net worth of the defendant, and any corrective action taken by the defendant. The clear proceeds of penalties so assessed shall be remitted to the Civil Penalty and Forfeiture Fund in accordance with G.S. 115C 457.2.
(b) This Article shall be liberally construed for the protection of minors and the general public. Noting in this Article shall be construed to infringe on any rights protected by the North Carolina or U.S. Constitutions.
(c) If any provision of this Article is held by a court of competent jurisdiction to be invalid, void, or unenforceable, in whole or in part, the decision shall not affect the validity, enforceability, or applicability of the remaining provisions, which shall remain in full force and effect as if the provision held invalid, void, or unenforceable had not been included.
This section provides the enforcement mechanism for the Children's Online Safety Act. The Attorney General is the exclusive enforcer through civil actions. Courts may impose civil penalties of up to $500,000 per violation, but only where the defendant knowingly violated the statute. The court must consider the extent of harm, nature and persistence of conduct, duration, the defendant's financial position, and corrective action taken. Proceeds go to the Civil Penalty and Forfeiture Fund.
The liberal-construction clause directs courts to interpret the Act broadly in favor of protecting minors, while the constitutional savings clause preserves North Carolina and federal constitutional rights — a provision that may be tested given the breadth of the 'dark patterns' and 'addictive features' prohibitions. The severability clause is standard.
(a) There is established in the State Bureau of Investigation the Cyberbullying Unit (Unit) dedicated to the protection of children online and to aid in the enforcement of Article 11 of Chapter 114 of the General Statutes.
(b) In addition to any other duties assigned by law, the Unit shall operate a toll-free number and website on online child safety and cyberbullying jointly with the Department of Justice.
This section establishes the Cyberbullying Unit within the State Bureau of Investigation, dedicated to protecting children online and supporting enforcement of the Online Safety Division's mandate under Article 11 of Chapter 114. The Unit must operate a toll-free number and website on online child safety and cyberbullying jointly with the Department of Justice. The appropriation provides $2 million for FY 2025–2026 and $1 million for FY 2026–2027.
There is hereby established the North Carolina Online Child Safety Commission as an independent regulatory body with oversight authority on matters relating to the safety and wellbeing of minors in digital environments. The Commission's primary mission shall be to protect North Carolina's children from online harms through research, education, regulation, enforcement, and ongoing adaptation to the evolving digital landscape. The Commission shall serve as the state's foremost authority on online child safety, advancing the digital wellbeing of minors while respecting fundamental rights. The Commission shall be guided by the best interests of the child, the recognition that digital safety is fundamental to childhood development, the understanding that technology must adapt to children's needs rather than the reverse, and the principle that powerful digital platforms must be held accountable for the safety of young users. The Commission shall consist of nine (9) members with demonstrated expertise and commitment to child welfare, digital technology, mental health, education, or related fields relevant to children's online safety. Members shall be appointed as follows: (1) Three (5) members appointed by the Governor (2) Two (1) members appointed by the President Pro Tempore of the Senate (3) Two (1) members appointed by the Speaker of the House of Representatives (4) One (1) member appointed by the Attorney General (5) One (1) member appointed by the Superintendent of Public Instruction.
This section creates the North Carolina Online Child Safety Commission as an independent regulatory body with oversight authority over the safety and wellbeing of minors in digital environments. The Commission consists of nine members appointed by the Governor, legislative leaders, Attorney General, and Superintendent of Public Instruction. Members serve staggered four-year terms with a two-consecutive-term limit. The required expertise includes child development, digital technology and data ethics, parent advocacy, cybersecurity, education, legal child protection, and youth advocacy.
The section contains an apparent drafting error in the appointment provisions: the parenthetical numbers add to 9 total members, but the written-out numbers ('Three,' 'Two,' 'Two') add to a different total. The parenthetical numbers should be controlling.
(a) The Commission with the assistance and input of the Department of Justice may do all of the following: (1) Issue binding regulations implementing the provisions of this act. (2) Establish safety standards for covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4). (3) Review and approve industry codes of practice. (4) Initiate investigations into potential violations. (5) Issue orders requiring compliance with the act. (6) Impose penalties for violations as provided in this act. (7) Seek injunctive relief through the courts when necessary to prevent harm to children.
(b) The Commission shall provide expert guidance to: (1) The Governor and General Assembly on matters relating to online child safety. (2) State agencies on implementation of digital safety programs. (3) Educational institutions on digital literacy and safety curricula. (4) Parents and caregivers on tools and strategies to protect children online. (5) Technology platforms on best practices for age-appropriate designAge-appropriate designAge-appropriate design. – Design focused on developmental needs of children.G.S. § 114B-1(1).
(c) Research and data collection. – The Commission shall: (1) Conduct or commission research on emerging online risks to children. (2) Collect and analyze data on the prevalence and impact of online harms. (3) Monitor global developments in online safety regulation. (4) Evaluate the effectiveness of interventions and regulations. (5) Maintain a database of safety incidents, platform responses, and outcomes.
(d) Educational Initiatives. – The Commission shall develop and oversee: (1) Public awareness campaigns on online child safety. (2) Resource development for schools, parents, and children. (3) Training programs for educators and other professionals. (4) Digital literacy standards for K-12 education.
(e) Complaint handling. – The Commission shall: (1) Establish accessible mechanisms for receiving complaints about online harms to children. (2) Create specialized response protocols for different categories of harm. (3) Oversee platform compliance with complaint response requirements. (4) Intervene directly in serious cases where platforms fail to act appropriately. (5) Provide support resources for affected children and families.
(f) Coordination and collaboration. – The Commission shall: (1) Coordinate with relevant state agencies including the Department of Justice, Department of Health and Human Services, and Department of Public Instruction. (2) Collaborate with federal authorities including the Federal Trade Commission and Department of Justice. (3) Engage with international counterparts to develop consistent approaches to digital safety. (4) Partner with academic institutions, non-profit organizations, and other stakeholders dedicated to child safety.
This section establishes the Commission's regulatory and advisory powers. The Commission, with DOJ assistance, may issue binding regulations implementing the Act, establish safety standards for covered platforms, review and approve industry codes of practice, initiate investigations, issue compliance orders, impose penalties, and seek injunctive relief. These are government-facing powers rather than private-sector compliance obligations — the Commission is the enforcement and standard-setting body, while the obligations on covered platforms flow from the standards it issues and from § 114B-2.
Advisory, research, educational, and complaint-handling functions round out the Commission's mandate, making it an unusually broad and powerful regulatory body for a state-level children's online safety regime.
(a) State of Children's Online Safety Assessment. – The Commission shall prepare and publish an annual "State of Children's Online Safety in North Carolina" report that: (1) Assesses current online risks facing North Carolina's children. (2) Analyzes trends in online harms and platform responses. (3) Evaluates platform compliance with this act and related regulations. (4) Identifies emerging threats and technologies of concern. (5) Measures progress in addressing previously identified issues. (6) Provides data-driven insights on the digital experiences of children by age group.
(b) Platform Compliance Review. – The Commission shall conduct annual compliance reviews of covered platformsCovered platformCovered platform. – An internet platform providing online services having more than five million (5,000,000) users in North Carolina and revenues exceeding twenty-five million dollars ($25,000,000) annually.G.S. § 114B-1(4) that: (1) Evaluate implementation of required safety measures. (2) Assess the effectiveness of age verification systems. (3) Review Child Impact Assessments and safety documentation. (4) Analyze complaint handling and response times. (5) Examine algorithmic systems for compliance with safety standards. (6) Identify best practices and areas requiring improvement. (7) Result in public compliance ratings for each major platform.
(c) Legislative Recommendations. – The Commission shall submit annual recommendations to the General Assembly that: (1) Identify necessary amendments to this act based on technological developments. (2) Propose new legislative measures to address emerging concerns. (3) Suggest improvements to enforcement mechanisms. (4) Recommend funding priorities for child online safety initiatives. (5) Identify areas where federal action or coordination is needed.
(d) Public Hearings and Testimony. – The Commission shall: (1) Hold at least four public hearings annually across different regions of the State. (2) Receive testimony from children, parents, educators, platforms, and experts. (3) Conduct specialized hearings on emerging issues of concern. (4) Ensure diverse perspectives are represented in deliberations. (5) Make hearing records publicly available.
(e) Industry Engagement. – The Commission shall: (1) Convene an annual Industry Safety Summit with platform representatives. (2) Facilitate regular working groups on specific safety challenges. (3) Review and approve updates to industry codes of practice. (4) Evaluate voluntary safety initiatives. (5) Promote adoption of safety innovations across the industry.
(f) Transparency Reporting. – The Commission shall publish annual transparency reports detailing: (1) Enforcement actions taken and their outcomes. (2) Complaints received and resolved. (3) Penalties assessed and collected. (4) Allocation and impact of Children's Online Safety Fund expenditures. (5) Commission activities, investigations, and initiatives. (6) Metrics for measuring the effectiveness of the Act's implementation.
(g) Audit of Educational Programs. – The Commission shall annually audit and evaluate: (1) Digital literacy programs in North Carolina schools. (2) Parent education initiatives. (3) Professional development for educators and youth workers. (4) Public awareness campaign effectiveness. (5) Resource allocation and accessibility across communities.
(h) Research Agenda Development. – The Commission shall: (1) Establish annual research priorities based on identified gaps. (2) Commission or conduct studies on priority areas. (3) Award research grants from the Children's Online Safety Fund. (4) Publish findings and recommendations based on research. (5) Ensure research informs regulatory and educational approaches.
This section details the Commission's extensive annual reporting and review cycle. The Commission must publish an annual 'State of Children's Online Safety in North Carolina' report, conduct annual compliance reviews of covered platforms (resulting in public compliance ratings), submit legislative recommendations, hold at least four public hearings across the state, convene an annual Industry Safety Summit, publish transparency reports on enforcement actions and complaint resolution, audit educational programs, and develop an annual research agenda. These are government duties rather than private-sector obligations, though the annual compliance reviews and public compliance ratings for each major platform will directly affect covered platforms' reputational exposure.
(a)–(e) Staffing and Structure. – The Commission shall: (1) Be supported by a professional staff led by an Executive Director. (2) Maintain specialized divisionsDivisionDivision. – The Online Safety Division of the North Carolina Department of Justice.G.S. § 114B-1(6) for enforcement, education, research, and policy. (3) Employ technologists, child development experts, data analysts, and legal specialists. (4) Establish advisory committees on specific issue areas as needed. (b) Funding Mechanisms. – The Commission shall: (1) Receive an annual appropriation from the General Assembly. (2) Administer the Children's Online Safety Fund. (3) Allocate penalties collected to prevention, education, and enforcement activities. (4) Report annually on budget allocation and performance metrics. (c) Technological Capabilities. – The Commission shall: (1) Maintain technical testing facilities to evaluate platform compliance. (2) Develop data analysis capabilities to identify patterns of harm. (3) Employ experts capable of evaluating platform algorithms and safety systems. (4) Keep pace with emerging technologies that may pose risks to children. (d) Ethical Frameworks. – The Commission shall: (1) Establish clear ethical guidelines for its work. (2) Ensure privacy protection in research and investigations. (3) Develop age-appropriate methods for involving children in policy development. (4) Balance safety imperatives with other rights and considerations. (e) Accountability Mechanisms. – The Commission shall: (1) Be subject to oversight by the General Assembly. (2) Maintain transparent decision-making processes. (3) Publish the basis for regulatory determinations. (4) Establish clear metrics for measuring its own effectiveness. (5) Undergo periodic independent evaluation.
This section establishes the Commission's internal operational structure, including staffing requirements (Executive Director, specialized divisions, technologists, child development experts), funding mechanisms (annual appropriation, administration of the Children's Online Safety Fund, penalty allocation), technological capabilities (testing facilities, data analysis, algorithm evaluation expertise), ethical guidelines, and accountability mechanisms (General Assembly oversight, transparent decision-making, periodic independent evaluation). These are government-facing organizational provisions that do not impose private-sector compliance obligations.
(a)–(d) Within 90 days of this act's effective date, initial appointments to the Commission shall be made and the Commission shall convene its first meeting. (b) Initial Responsibilities. – Within the first year of operation, the Commission shall: (1) Hire key staff and establish organizational structure. (2) Develop initial regulations implementing this act. (3) Create complaint handling systems. (4) Establish public education programs. (5) Develop platform compliance guidelines. (6) Submit its first annual report to the General Assembly. (c) Phased Implementation. – The Commission shall develop a phased implementation plan that: (1) Prioritizes addressing the most serious harms. (2) Accommodates different compliance timelines based on platform size. (3) Allows for industry adjustment to new requirements. (4) Includes benchmarks for measuring progress. (d) Review and Adaptation. –Every three years, the Commission shall: (1) Conduct a comprehensive review of its activities and impact. (2) Assess changing technological landscape and emerging challenges. (3) Revise strategic priorities and approaches as needed. (4) Recommend statutory amendments to maintain effectiveness.
This section sets the Commission's implementation timeline. Initial appointments must be made within 90 days of the Act's effective date. Within the first year, the Commission must hire staff, develop initial regulations, create complaint-handling systems, establish public education programs, develop platform compliance guidelines, and submit its first annual report. A phased implementation plan must accommodate platform size and allow industry adjustment. Every three years, the Commission must conduct a comprehensive review and recommend statutory amendments as needed.