Each one links to its
LexLint note, which carries what it requires and what it flags on.
Operators of websites and apps that publish pornographic images must verify, before publication, that every individual depicted was at least 18 when the image was created and gave explicit written consent to each act and to distribution, backed by a signed consent form and matching government-issued identification.
Operators must display removal instructions, remove images within 72 hours of a request from a depicted individual or law enforcement, and block removed images from re-publication; this regulates verification of people appearing in content rather than website visitors. The act was enacted over the Governor's veto on July 29, 2025.
Note and primary source →
Any business that owns or licenses personal information of a North Carolina resident, or that conducts business in North Carolina and owns or licenses such information in any form, must give notice of a security breach to the affected person without unreasonable delay, consistent with the legitimate needs of law enforcement; the statute sets no numeric notification deadline.
Business is defined narrowly as a sole proprietorship, partnership, corporation, association, or other group, whether or not organized for profit, with no government entity included.
Personal information is a name combined with identifying information as cross-referenced from North Carolina's criminal identity-theft statute, G.S. Sec. 14-113.20(b), which lists biometric data as one of fourteen enumerated items alongside a Social Security number, a driver's license number, and financial account numbers, but no North Carolina statute anywhere defines what biometric data means for this purpose; the term is used but never defined.
Personal information excludes information a person voluntarily consented to have publicly disseminated and information made lawfully available to the general public from government records, but because biometric data is an undefined cross-referenced term, whether this carve-out would reach an identifier derived from a public recording cannot be evaluated.
A business must also notify the Consumer Protection Division of the Attorney General's Office on every breach requiring notice to any affected person, and separately, on any breach affecting more than 1,000 persons at one time, must notify nationwide consumer reporting agencies.
A violation of the notice duty is a violation of North Carolina's general Unfair and Deceptive Trade Practices Act, G.S. Sec. 75-1.1, but an individual may not sue for that violation unless injured by it; once that injury threshold is met, G.S. Sec. 75-16 arms the injured person with a civil action for treble damages. Most recently amended by Session Law 2025-25.
What it asks of an app →
As passed by the House 106-6 in May 2025, the bill would bar children under 14 from holding social media accounts and require parental consent for 14 and 15 year olds, with age verification duties on platforms. The Senate passed a revised committee substitute 48-0 on June 10, 2026, the House voted not to concur on June 23, 2026, and a conference committee was appointed the next day to reconcile the versions.
Note and primary source →
