Law / North Dakota

North Dakota

age

North Dakota enacted a pair of companion adult content age verification laws in 2025, House Bill 1561 and Senate Bill 2380, both effective August 1, 2025. Each adds a near-identical section to chapter 51-07 of the Century Code requiring commercial entities whose websites contain more than one third sexual material harmful to minors to verify that visitors are 18 or older, bars retention of identifying information, and is enforced solely through private civil suits.

SB 2380 was introduced as a device, operating system, and app store age-signal mandate, an approach the adult industry's trade group publicly supported, but that mandate was stripped before passage; the enrolled law parallels HB 1561 and expressly shields internet service providers, search engines, cloud providers, and app stores. No social media minor-access, app store, or design code law has been enacted.

privacy

North Dakota has no comprehensive consumer personal-data-protection statute and takes a purely sectoral approach. Its breach notification duty, N.D. Cent.

Code ch. 51-30, requires notice to affected residents without unreasonable delay and, for a breach exceeding 250 individuals, to the Attorney General, but its ten-item personal information definition (a Social Security number, a driver's license or identification card number, a financial account number, a date of birth, a mother's maiden name, medical or health insurance information, an employer-assigned identification number, or a digitized signature) does not include biometric data at all, a confirmed absence rather than an unread gap.

The only North Dakota statute using the term biometric data is a criminal identity-theft prohibition, N.D. Cent. Code Sec. 12.1-23-11, which criminalizes a thief's unauthorized use of it and imposes no duty on a private-sector data handler.

Enforcement of the breach statute runs to the Attorney General under chapter 51-15, North Dakota's unlawful-practices chapter, because a violation of chapter 51-30 is deemed a violation of chapter 51-15; whether that deeming clause also opens chapter 51-15's own private civil-action provision, which arms a claim against a person who acquired moneys or property by means of the unlawful practice, to an individual harmed by a bare notification failure is genuinely unresolved on the text, and no North Dakota case law construing the combination was found.

7 instruments named 3 researched in detail As of 2026-08-28

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Adult content age verification (AV)

HB 1561, age verification for sexual material harmful to minors

cite N.D. Cent. Code ch. 51-07 (new section enacted by 2025 H.B. 1561) stage IN FORCE in force since 2025-08-01 source official enrolled bill text

Commercial entities that knowingly publish or distribute sexual material harmful to minors on a website where more than one third of the content meets that definition must perform reasonable age verification, such as a digitized identification card or a commercial verification system using a government ID or transactional data.

A commercial entity or third party performing verification may not retain identifying information after access is granted, and enforcement is through private civil suits only.

Note and primary source →

SB 2380, age verification for sexual material harmful to minors (companion to HB 1561)

cite N.D. Cent. Code ch. 51-07 (new section enacted by 2025 S.B. 2380) stage IN FORCE in force since 2025-08-01 source official enrolled bill text

Substantially identical to companion bill HB 1561: commercial entities that knowingly publish or distribute sexual material harmful to minors on a website where more than one third of the content meets that definition must verify visitors are 18 or older using a digitized identification card or a commercial age verification system relying on government-issued identification, a commercially available age and identity database, or transactional data, and may not retain identifying information after access is granted.

As introduced, the bill would have required device makers, operating systems, and app stores to determine user age and transmit age signals, but the enrolled law dropped that mandate entirely and instead expressly provides that internet service providers, search engines, cloud providers, and application stores are not liable solely for providing access to third-party content. Enforcement is through private civil suits only.

Note and primary source →

Breach notification

Notice of Security Breach for Personal Information

cite N.D. Cent. Code ch. 51-30 stage IMMINENT commencement not set source official North Dakota statute text, North Dakota Century Code chapter 51-30

Any person that owns or licenses computerized data including personal information must disclose a breach of the security system to any affected North Dakota resident, and separately to the Attorney General for a breach exceeding 250 individuals, in the most expedient time possible and without unreasonable delay; the chapter sets no numeric consumer-notification deadline and does not itself define or limit person to a private actor.

Personal information is a name combined with a Social Security number, a driver's or nondriver identification card number, a financial account number, a date of birth, a mother's maiden name, medical or health insurance information, an employer-assigned identification number, or a digitized signature, and excludes publicly available government-records information; biometric data is not among the ten enumerated categories, and this chapter does not reach it at all.

Enforcement runs to the Attorney General, who may use all the powers and remedies of chapter 51-15, North Dakota's unlawful-practices chapter, because a violation of this chapter is deemed a violation of chapter 51-15.

Whether that deeming clause makes chapter 51-15's own private-claim provision, Sec. 51-15-09, available to an individual for a bare notification failure is unresolved: that provision arms a claim specifically against a person who acquired any moneys or property by means of the unlawful practice, language that fits a fraud that took money more naturally than a business's mere failure to notify of someone else's breach, and no North Dakota case law construing this combination was found; secondary characterizations of chapter 51-30 disagree with each other on this point, and this document does not resolve it either way.

What it asks of an app →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.