HB462 would create two new chapters in the North Carolina General Statutes: the North Carolina Data Privacy Act and the Social Media Safety Act. The data privacy portion establishes a broad consumer privacy framework for qualifying businesses that operate in or target North Carolina, including rights to confirm, access, correct, delete, and obtain portable copies of personal data, as well as rights to opt out of targeted advertising, the sale of personal data, and certain profiling. It also imposes duties on controllers and processors to limit collection, secure data, obtain consent for sensitive data, provide privacy notices, conduct data protection assessments for higher-risk processing, and honor opt-out preference signals and authorized-agent requests, including universal opt-out mechanisms.
The social media portion would require social media companies to verify the age of North Carolina users before allowing account creation, and to obtain express parental or guardian consent before a minor may hold an account. It defines reasonable age verification methods, requires third-party commercial verification, and prohibits retention of identifying information after verification is completed. The bill also creates civil liability, authorizes enforcement by the Attorney General, and makes a violation of the age-verification requirement a Class 1 misdemeanor enforceable by local district attorneys. It includes exemptions for certain services such as email, direct messaging, streaming, e-commerce, cloud storage, business-to-business software, and some news and research services.
If enacted, the bill would add Chapter 75F and Chapter 75G to the General Statutes and would significantly expand state-level regulation of consumer data practices and youth access to social media. It would also amend enforcement law by making violations of the privacy chapter an unfair trade practice under G.S. 75-1.1, while placing primary enforcement authority with the Department of Justice and limiting the privacy chapter to government enforcement rather than private lawsuits. The bill sets staggered effective dates, with the privacy chapter generally effective January 1, 2026, and data protection assessment requirements applying to new processing activities on or after July 1, 2026.
The overall sentiment reflected in the bill’s movement is generally favorable or at least sufficiently positive to advance it through committee as a committee substitute. There are no recorded floor votes or committee transcript excerpts in the provided materials, so the record does not show detailed public debate. The bill’s re-referral to Commerce and Economic Development suggests continued review of its business and regulatory impacts, especially for companies subject to the new privacy and age-verification obligations.
The main points of contention likely concern the scope and compliance burden of the privacy regime and the social media age-verification mandate. Businesses may object to the thresholds for covered controllers, the operational costs of consumer rights requests, data protection assessments, and universal opt-out compliance, while social media and technology companies may raise concerns about identity verification, data retention limits, and liability exposure. Privacy advocates and child-safety supporters are likely to favor the bill’s protections, while critics may question whether the age-verification provisions are workable, whether they implicate privacy or speech concerns, and whether the bill’s exemptions and definitions are sufficiently clear.
The bill would create two new chapters in North Carolina law governing consumer data privacy and social media age verification. It would impose new statutory duties on businesses that collect or process personal data, establish consumer privacy rights, authorize Attorney General enforcement, and classify violations as unfair trade practices. It would also require social media companies to verify age and obtain parental consent for minors, with civil penalties, criminal penalties for certain violations, and restrictions on retention of identifying information by verification vendors.
The available record suggests a generally favorable posture toward the bill, as it advanced as a committee substitute and was re-referred for further consideration. No vote totals or transcript excerpts are provided, so there is no documented opposition or support from specific legislators in the materials. Based on the bill’s content, it appears designed to appeal to privacy and child-safety concerns while still reflecting ongoing legislative scrutiny of its business and implementation effects.
Likely areas of contention include the compliance burden on businesses, the breadth of covered personal data practices, and the feasibility and privacy implications of mandatory age verification for social media. Technology companies and online platforms may object to the verification and data-retention requirements, while privacy-focused stakeholders may support the consumer rights and consent provisions. The bill’s exemptions, enforcement structure, and the misdemeanor penalty for age-verification violations are also likely to be debated.