Social Media Control in IT Act.

GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
H 2
HOUSE BILL 860
Committee Substitute Favorable 6/17/25

Short Title: Social Media Control in IT Act. (Public)
Sponsors:
Referred to:
April 10, 2025
*H860-v-2*
A BILL TO BE ENTITLED 1
AN ACT TO COMBAT SOC IAL MEDIA ADDICTION BY REQUIRING THAT SO CIAL 2
MEDIA PLATFORMS RESP ECT THE PRIVACY OF N ORTH CAROLINA USERS' 3
DATA AND NOT USE A N ORTH CAROLINA MINOR' S DATA FOR ADVERTISI NG 4
OR ALGORITHMIC RECOM MENDATIONS, AND APPROPRIATING FUNDS FOR 5
THAT PURPOSE, AND TO MAKE WILLFUL VIOLAT IONS OF DATA USER 6
PRIVACY AN UNFAIR PR ACTICE UNDER CHAPTER 75 OF THE GENERAL 7
STATUTES. 8
The General Assembly of North Carolina enacts: 9
SECTION 1. Chapter 75 of the General Statutes is amended by adding a new Article 10
to read: 11
"Article 2B. 12
"Social Media Control in Information Technology. 13
"§ 75-70. Title; definitions. 14
(a) This Article shall be known and may be cited as the "Social Media Control in 15
Information Technology Act." 16
(b) Definitions. – The following definitions apply in this Article: 17
(1) Accessible mechanism. – A user -friendly, clear, easy -to-use, readily 18
available, and technologically feasible method that allows individuals to 19
exercise their data privacy rights without undue burden. The mechanism must 20
be designed to accommodate diverse user needs, including those with 21
disabilities, and should be available across commonly used platforms. The 22
mechanism should provide clear instructions, functi on without excessive 23
complexity, and be free of unreasonable barriers such as length procedures, 24
hidden settings, or excessive delays. 25
(2) Algorithmic recommendation system. – A computational process that uses 26
machine learning, natural language processing, artificial intelligence 27
techniques, generative artificial intelligence, or other computational 28
processing techniques that makes a decision or facilitates human decision 29
making with respect to user-related data to rank, order, promote, recommend, 30
suggest, amplify, or similarly determine the delivery or display of information 31
to an individual. 32
(3) Collects, collected, or collection. – Buying, renting, gathering, obtaining, 33
receiving, or accessing any personal information pertaining to a user by any 34
means. This includes receiving information from the consumer, either actively 35
or passively, or by observing the consumer's behavior. 36
General Assembly Of North Carolina Session 2025
Page 2 House Bill 860-Second Edition
(4) Consent. – Any freely given, specific, informed, and unambiguous indication 1
of a user's wishes by which the consumer, or the consumer's legal guardian, a 2
person who has power of attorney, or a person acting as a conservator for the 3
consumer, including by a statement or by a clear affirmative action, signifies 4
agreement to the processing of personal information relating to the consumer 5
for a narrowly defined particular purpose. None of the following constitutes 6
consent: 7
a. Acceptance of a general or broad terms of use, or similar document, 8
that contains descriptions of personal information processing along 9
with other, unrelated information. 10
b. Hovering over, muting, pausing, or closing a given piece of content. 11
c. Agreement obtained through use of dark patterns. 12
(5) Default settings. – The predetermined options, values, and configurations that 13
a program is initially set to whenever it is installed and initially accessed. 14
(6) Minor. – An individual who is under 18 years of age. 15
(7) Operator. – Defined in section 1302 of the Children 's Online Privacy 16
Protection Act of 1998, 15 U.S.C. § 6501. 17
(8) Opt-in mechanism. – An accessible mechanism separate from any other 18
notifications, disclosures, or consents, such as a privacy policy or terms of 19
service, that allows the user to consent to the platform engaging in a specific, 20
narrow, and well-defined practice. The Division of Health Service Regulation 21
has the authority to specify requirements for the notification and consent 22
process, including specific languag e and disclosures that may include a 23
warning on the harmful effects of manipulative algorithms, the length of time 24
for which the notification must appear before the user has the option to 25
consent, and the process that the user must follow to consent. 26
(9) Personal information. – Information that identifies, relates to, describes, is 27
reasonably capable of being associated with, or could reasonably be linked, 28
directly or indirectly, with a particular consumer or household. Personal 29
information includes, but is not limited to, the following if it identifies, relates 30
to, describes, is reasonably capable of being associated with, or could be 31
reasonably linked, directly or indirectly, with a particular user or household: 32
a. Identifiers such as a real name, alias, postal address, unique personal 33
identifier, online identifier, Internet Protocol address, email address, 34
account name, social security number, drivers license number, 35
passport number, or other similar identifiers. 36
b. Commercial information, including , but not limited to , records of 37
personal property, products , or service s purchased, obtained, or 38
considered, or other purchasing or consumer histories or tendencies. 39
c. Biometric information, that is any information relating to an 40
individual's physiological, biological, or behavioral characteristics , 41
including, but not limited to , imagery of the iris, retina, fingerprint, 42
face, hand, palm, gait, vein patterns, and voice recordings. 43
d. Internet or other electronic network activity information, including , 44
but not limited to , browsing history, search history, and information 45
regarding a user 's interaction with an internet website application or 46
advertisement. 47
e. Usage data. 48
f. Third-party data. 49
g. Geolocation data. 50
h. Audio, electronic, visual, thermal, olfactory, or similar information. 51
General Assembly Of North Carolina Session 2025
House Bill 860-Second Edition Page 3
i. Professional or employment-related information. 1
j. Education information, defined as information that is not publicly 2
available personally identifiable information as defined in the Family 3
Education Rights and Privacy Act (20 U. S.C. § 1232(g); 34 C.F.R. 4
Part 99). 5
k. Financial information from a user , including, but not limited to , a 6
user's account log -in, financial account, debit card, or credit card 7
number in combination with any required security or access code, 8
password, or credentials allowing access to an account. 9
l. The contents of a user 's mail, email, and text messages unless the 10
platform is the intended recipient of the communication. 11
m. A user 's racial or ethnic origin, citizenship or immigration status, 12
religious or philosophical beliefs, or union membership. 13
n. Information related to a user's health, sex life, or sexual orientation. 14
o. Inferences drawn from any of the information identified in th is 15
subdivision reflecting the user 's preferences, characteristics, 16
psychological trends, predispositions, behavior, attitudes, intelligence, 17
abilities, and aptitudes. 18
(10) Platform user. – An individual who resides in North Carolina who uses a 19
social media platform. 20
(11) Social media platform, covered platform, or platform. – An electronic medium 21
with more than 1,000,000 monthly active users in the United States that 22
functions as a social media service. The term does not include any of the 23
following: 24
a. An entity acting in its capacity as a provider of a common carrier 25
service subject to the Communications Act of 1934 (47 U.S.C. § 151 26
et seq.) as amended and supplemented. 27
b. A broadband internet access service under section 8.1(b) of Title 47 of 28
the Code of Federal Regulations. 29
c. An electronic mail service. 30
d. Internet search engines specifically designed to lead a user to a result 31
which a user expressly searched for. 32
e. Internet service providers. 33
f. A wireless messaging service provided through the short messaging 34
service or multimedia messaging service protocols , or thro ugh a 35
functional equivalent. 36
g. Video game services primarily designed to serve as a platform to play 37
video games. 38
h. Online shopping or e -commerce services primarily designed for that 39
purpose. 40
i. Video-streaming services that solely provide non -user generated 41
content. 42
j. A community forum where the primary purpose of the forum is for 43
customer self -service support related to products, sellers, services, 44
events, or places, or any combination thereof. 45
(12) Third-party data. – Personal data from another person, company, data broker, 46
and/or platform that is not the user to whom the data pertains and is not the 47
platform. The term does not refer to persons, companies, data brokers, and/or 48
platforms that collect personal data from another entity if the entity shares 49
common branding with the platform, controls the platform, is controlled by 50
General Assembly Of North Carolina Session 2025
Page 4 House Bill 860-Second Edition
the platform, or is under common control of another legal entity with the 1
platform. 2
(13) Usage data. – Any information that is gathered about a user 's interactions, 3
behaviors, preferences, and usage patterns on a platform, including , but not 4
limited to , information related to pages visited, clicks, scrolls, navigation 5
patterns, search queries, button presses, feature usage, frequency of logins, 6
session duration, items added or removed from a shopping cart, purchasing 7
history, subscription usage, content watched, content read, content listened to, 8
or time spent using or engaging with any feature or piece of content on the 9
platform. This includes any and all inferences derivable and related to a user 10
from this usage data , including user engagement statistics, content metrics, 11
feature usage statistics, user flow data, retention rates, and churn rates. 12
"§ 75-71. User data privacy; targeting minors prohibited; registry. 13
(a) Privacy Requirements. – The General Assembly finds that unhealthy social media use 14
has been linked to depression, anxiety, eating disorders, and suicidal ideation, especially among 15
young people. Exploitation of user data can result in users being targeted in ways that increase 16
unhealthy social media use. It is the policy of this State that user data privacy shall be respected 17
by platforms. Special protections are warranted for users who are minors. Therefore, the operator 18
of a social media platform shall comply with all of the following requirements for platform users: 19
(1) The platform must specifically and clearly inform users in the following ways: 20
a. A disclosure in a clear, easy-to-read, and accessible format when a user 21
first initializes their use of a platform for the first time, or after a period 22
of inactivity greater than or equal to six months, about how the 23
platform collects personal information, what personal information the 24
platform collects, how the personal information is used by the platform 25
for every use case, and how the user can exercise their rights and 26
choices on the platform. This disclosure must be provided in no more 27
than 500 words, and the platform must obtain a user 's consent before 28
the platform collects any user-related data on the user. 29
b. A disclosure in a clear, easy-to-read, and accessible format that details 30
(i) the categories of information the platform has collected about the 31
user, (ii) the categories of sources from which the information is 32
collected, (iii) the business or comm ercial purpose for collecting, 33
selling, or sharing personal information, (iv) the categories of third 34
parties to whom the business discloses personal information, and (v) 35
the specific pieces of personal information it has collected about that 36
user. Such information must be available upon receipt of a verifiable 37
consumer request made through an accessible mechanism on the 38
platform. 39
(2) Personal information may be used in algorithmic recommendations only when 40
both of the following requirements are met: 41
a. The platform reasonably determines the user is not a minor from 42
personal information collected by and available to the covered 43
platform in its ordinary course of business. 44
b. The user has been notified and expressly consents to the use of their 45
own data in this manner by consenting in an opt-in mechanism. 46
(3) Through an accessible mechanism, users must be given the capacity to alter, 47
change, and delete what categories of personal information are used in a 48
platform's algorithmic recommendation system or systems . This selection 49
shall be modifiable at any time. If a user indicates that they intend a certain 50
category of personal information not to be used in an algorithmic 51
General Assembly Of North Carolina Session 2025
House Bill 860-Second Edition Page 5
recommendation system, then the platform must not include said category or 1
categories within an algorithmic recommendation system. A covered platform 2
shall not discriminate against a user because the user exercised any of the 3
rights under this Article in the provision of functionality or features of the 4
covered platform, unless the use of user -related data in an algorithmic 5
recommendation system is reasonably necessary to the feature or 6
functionality. 7
(b) Targeting Minors Prohibited. – A covered platform must establish comprehensive and 8
effective controls to ensure that a minor 's personal informati on is not used in any algorithmic 9
recommendation system. 10
(c) Exceptions. – Subsection (b) of this section does not apply to any of the following: 11
(1) Recommending or present ing content from accounts that a user follows in 12
reverse chronological order or a similar method of recommending or 13
presenting content. 14
(2) A user 's explicit search for content or request for information for the sole 15
purpose of providing immediate results to the search, and without retention or 16
use of the user-related data from the search or request for purposes other than 17
providing results to the search or request. 18
(3) A covered platform's action, voluntarily taken in good faith to restrict access 19
to or avail ability of material as described in section 230(c)(2)(A) of the 20
Communications Act of 1934 (47 U.S.C. § 230(c)(2)(A)), is not subject to this 21
subsection, and nothing in this section otherwise limits or otherwise affects 22
the provisions of section 230 of the Communications Act of 1934, except as 23
otherwise provided in this Article. 24
(d) The operator of a social media platform may be held liable for violating subsection 25
(a) of this section if the user was given algorithmic content recommendations without a prope r 26
opt-in mechanism or affirmation from the user from the opt -in process. The operator of a social 27
media platform may be held liable for violating subsection (b) of this section if the operator of 28
the social media platform knew or had reason to know that the user was a minor. The operator of 29
a social media platform that has made an estimation of a user 's age based upon the user 's 30
self-attestation is not liable if the user was a minor who falsely attested to not being a minor. 31
(e) Registry. – Beginning October 1, 2026, and then annually thereafter, a social media 32
platform shall provide the Consumer Protection Division of the North Carolina Department of 33
Justice (Division) with a digital copy of the platform 's privacy policy and certification that the 34
platform has complied with the requirements of this section. Platforms shall provide notice of 35
substantive privacy policy changes to the registry. The Division shall maintain a registry of these 36
policies and certifications on its internet website. 37
"§ 75-72. Design features and digital rights of users. 38
(a) Protective Default Settings for Minors. – A covered platform shall configure all 39
privacy settings provided to any user by the online service, product, or feature to be both available 40
to minors and , by default, set to preferences that offer the highest level of privacy, unless the 41
business can demonstrate a compelling reason that a different setting is in the best interest of 42
minors. These settings must include all of the following: 43
(1) Notifications must be turned off by default. 44
(2) The visibility of reaction or interaction counts on all content, including content 45
generated by a minor and content seen by a minor generated from others, must 46
be turned off by default. 47
(3) The ability of other users, not added by the user to a list of approved contacts, 48
to communicate with the minor must be turned off by default. 49
General Assembly Of North Carolina Session 2025
Page 6 House Bill 860-Second Edition
(4) The ability of other users, whether registered or not, and not added by the user 1
to a list of approved contacts, to view the minor 's user-related data collected 2
by or shared on the platform must be disabled by default. 3
(5) The ability of other users to see the geolocation of a minor must be disabled 4
by default. 5
(6) Features that increase, sustain, or extend the use of the covered platform by a 6
minor, such as automatic playing of media and rewards for time spent on the 7
platform, must be disabled by default. 8
(b) Rights to Change and Delete Data. – A covered platform shall provide users with both 9
of the following: 10
(1) An accessible mechanism to request the correction of any inaccurate personal 11
information about the user, taking into account the nature of the personal 12
information and the purposes of the personal information. A platform that 13
receives a verifiable request to corr ect inaccurate personal information shall 14
use commercially reasonable efforts to correct the inaccurate personal 15
information as directed by the user. A covered platform shall maintain a record 16
of all requests. 17
(2) An accessible mechanism to request the del etion of personal information 18
about the user, taking into account the nature of the personal information and 19
the purposes of the personal information. If the personal information is 20
reasonably necessary for the platform to complete a transaction, to ensure the 21
security and integrity of the user 's personal information, to debug or identify 22
and repair errors in the platform, to exercise free speech and ensure the user's 23
right to exercise free speech, to comply with existing federal and State 24
regulations, to e ngage in public or peer -reviewed scientific research, or to 25
enable solely internal uses reasonably aligned with a consumer's expectations, 26
then the covered platform is not required to comply with the user 's request. 27
Otherwise, the covered platform is requi red to complete the request. A 28
covered platform shall maintain a confidential record of all requests. 29
(c) Digital Rights of the User. – All of the following rights belong to every minor utilizing 30
covered platforms: 31
(1) Right to protection from manipulative design. – Every minor has the right to 32
be protected from manipulative design techniques which exploit 33
psychological vulnerability or have been shown by the preponderance of the 34
evidence to create addiction or dependency. 35
(2) Right to transparency. – Every minor has the right to understand the nature of 36
their digital experiences. Platforms and services should provide clear and 37
accessible explanations of the platform features as well as how covered 38
platforms can negatively affect their well-being. 39
(3) Right to protection from personalized recommendation systems. – Every 40
minor has the right to be protected from algorithmic recommendation systems. 41
(d) The operator of a covered platform may be subject to violations of subsection (a), (b), 42
or (c) of this section if any of the requirements and rights established herein have been determined 43
to be violated. 44
"§ 75-73. Investigation; enforcement; private right of action. 45
(a) Violations. – Effective January 1, 202 7, a platform 's violation of this Article is an 46
unfair or deceptive act or practice under G.S. 75-1.1. 47
(b) Investigations. – The Attorney General shall monitor social media platforms for 48
compliance with this Article. 49
(c) Complaints. – A platform user may make a complain t to the Attorney General 50
alleging that a social media platform has failed to comply with the requirements of this Article. 51
General Assembly Of North Carolina Session 2025
House Bill 860-Second Edition Page 7
The Attorney General may bring a civil action in any case in which the Attorney General has 1
reason to believe that the interest of t he residents of this State has been or is threatened due to 2
noncompliance with this Article. 3
(d) Private Right of Action. – Minors can file suit if they are affected by any covered 4
platform found to be in violation of this Article through mechanisms involv ed in parens patriae 5
jurisdiction by the following: 6
(1) Civil suit brought through private action attorneys. 7
(2) Relief. – In a civil action brought under subsection (c) of this section or this 8
subsection in which a plaintiff prevails, the court may award the plaintiff any 9
one or more of the following: 10
a. An amount equal to the sum of any compensatory damages. 11
b. Punitive damages. 12
c. Injunctive relief. 13
d. Declaratory relief. 14
e. Reasonable attorneys' fees and litigation costs. 15
"§ 75-74. North Carolina Data Privacy Task Force. 16
(a) There is created the North Carolina Data Privacy Task Force (Task Force) within the 17
Department of Justice for budgetary purposes only. 18
(b) The Task Force shall be composed of 21 members. The ex officio members listed in 19
subdivisions (1) through (6) of this subsection may designate representatives from their particular 20
departments, divisions, or offices to represent them on the Task Force. In making appointments 21
or designating representatives, appointing authorities and ex officio mem bers shall use best 22
efforts to select members or representatives with sufficient knowledge and experience to 23
effectively contribute to the issues examined by the Task Force and, to the extent possible, to 24
reflect the geographical, political, gender, and ra cial diversity of this State. The members shall 25
be as follows: 26
(1) The Attorney General. 27
(2) The State Chief Information Officer. 28
(3) The Secretary of the Department of Health and Human Services. 29
(4) The Director of the State Bureau of Investigation. 30
(5) The Director of the Maternal and Child Health Section of the Department of 31
Health and Human Services. 32
(6) The Director of the Division of Mental Health, Developmental Disabilities, 33
and Substance Use Services. 34
(7) A representative from NC Child, appointed b y the Governor upon 35
recommendation of the President of the organization. 36
(8) A representative from a private group, other than NC Child, that advocates for 37
children, appointed by the Governor upon recommendation of private child 38
advocacy organizations. 39
(9) A pediatrician, licensed to practice medicine in North Carolina, appointed by 40
the President Pro Tempore of the Senate. 41
(10) A psychiatrist, licensed to practice medicine in North Carolina, appointed by 42
the Speaker of the House of Representatives. 43
(11) Two public members, one of whom is an educator, appointed by the Speaker 44
of the House of Representatives. 45
(12) Two public members, one of whom is a social worker, appointed by the 46
President Pro Tempore of the Senate. 47
(13) Two members of the Senate, appointed by the President Pro Tempore of the 48
Senate, and two members of the House of Representatives, appointed by the 49
Speaker of the House of Representatives. 50
General Assembly Of North Carolina Session 2025
Page 8 House Bill 860-Second Edition
(14) A representative from the North Carolina Young People's Alliance, appointed 1
by the Governor upon recommendation of the head of the organization. 2
(15) Two youth representatives under the age of 21 appointed by the Secretary of 3
the Department of Health and Human Services after conducting an 4
application-based selection process. 5
(c) All members of the Task F orce are voting members. Vacancies in the appointed 6
membership shall be filled by the appointing officer who made the initial appointment. Terms 7
shall be two years. The members shall elect a chair who shall preside for the duration of the 8
chair's term as a member. In the event a vacancy occurs in the chair before the expiration of the 9
chair's term, the members shall elect an acting chair to serve for the remainder of the unexpired 10
term. 11
(d) Beginning March 15, 2027, and then annually thereafter, the Task Force shall report 12
to the General Assembly on its work, with a special focus on mental health issues related to social 13
media, along with findings, recommendations, and any legislative proposals." 14
SECTION 2. Effective July 1, 2025, there is appropriated from the General Fund to 15
the Department of Justice the sum of one hundred thousand dollars ($100,000) for the 2025-2026 16
fiscal year and the sum of one hundred thousand dollars ($100,000) for the 2026-2027 fiscal year 17
to develop the registry created in G.S. 75-71, as enacted by this act. 18
SECTION 3. Section 1 of this act becomes effective October 1, 2026. The remainder 19
of this act is effective when it becomes law. 20