South Carolina

H.3424 (2024), Child Online Safety Act

Requires a commercial entity that knowingly publishes material on a website, more than one third of which is material harmful to minors, to perform reasonable age verification of South Carolina visitors using a digitized identification card, a third party verification service, or a commercially reasonable method relying on transactional data.

H.3431 (2026), Age-Appropriate Design Code Act (Act No. 96 of 2026)

Requires online services reasonably likely to be accessed by minors to set protective default privacy settings for known minors, offer opt outs from personalized recommendation systems, limit addictive design features and nighttime and school hours notifications, and undergo independent third party audits reported to the Attorney General. NetChoice sued days after enactment and a preliminary injunction motion is pending.

Business data breach of security, notification statute

A person conducting business in South Carolina that owns or licenses computerized data including personal identifying information must disclose a breach of the security of the system to an affected South Carolina resident in the most expedient time possible and without unreasonable delay, where the breach creates a material risk of harm.

Personal identifying information is name plus a Social Security number, driver's license or state ID number, a financial account number with access credential, or another government-issued identifying number; biometric, genetic, or health data is not folded into this definition. If a business notifies more than 1,000 persons at one time, it must also notify the Consumer Protection Division of the Department of Consumer Affairs and nationwide consumer reporting agencies.

The current definition of personal identifying information took effect April 23, 2013; the notification duty itself took effect July 1, 2009. A resident injured by a violation may bring a civil action for damages (willful and knowing violations) or actual damages (negligent violations), seek an injunction, and recover attorney's fees, an express, direct private right of action rather than one reached indirectly through a deeming clause.

An administrative fine of $1,000 per affected resident is also available to the Department of Consumer Affairs for a knowing and willful violation.

South Carolina Age-Appropriate Design Code, general applicability and minor-protective design duties

The Age-Appropriate Design Code applies to a covered online service reasonably likely to be accessed by a minor (a person under 18). It is not a general controller or processor personal-data regime; it imposes design and data-minimization duties specifically toward minor users, including default privacy settings, limits on profiling, targeted advertising, and precise-geolocation collection for known minors, parental controls, and an annual public report by an independent auditor.

The Act was enacted as Act No. 96 of 2026 (H. 3431, the South Carolina Social Media Regulation Act on its own caption) and creates Chapter 80 of Title 39; it took effect immediately upon the Governor's approval on February 5, 2026. It is not to be confused with H. 3402, a different, still-pending bill sharing the short title 'Age-Appropriate Design,' which would have created Chapter 79 and never advanced past referral to House Judiciary.

The consolidated online Code of Laws page for the new Chapter 80 does not yet resolve as of 2026-08-28 (HTTP 404 at every tried URL pattern); the session-law text of Act No. 96 is the authoritative current source.

Age-Appropriate Design Code, enforcement

The Attorney General enforces Chapter 80. A covered online service is liable for treble the financial damages incurred as a result of a violation, and officers and employees of a covered online service may be held personally liable for willful and wanton violations.

The 30,353-character enacted text does not resolve whether the treble-damages remedy is available to a private plaintiff or is confined to a suit the Attorney General brings: no clause reads that an injured person may bring a civil action, the phrasing South Carolina's breach statute uses to grant one, and no clause reads that the chapter creates no private right of action, the phrasing Pennsylvania's and West Virginia's comparable proposed and dead bills use to foreclose one.

This document leaves private_right_of_action unrecorded for this instrument rather than guessing; the treble-damages and personal-liability clauses read most naturally as remedies within the Attorney General's own suit given the enforcement section's framing naming only the Attorney General, but no clearer textual anchor or construing case was found.

Age-Appropriate Design Code, sensitive personal data and biometric data

Chapter 80 defines sensitive personal data to include a Social Security number, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of an individual's mail, email, or text messages, genetic data, biometric data for the purpose of uniquely identifying an individual, and health data.

'Biometric data' itself is never defined anywhere in the 30,353-character enacted text; the term appears exactly twice, once in this sensitive-data list and once in the publicly-available-data carve-out below, with no accompanying definitional entry among the chapter's twenty defined terms.

Whether the term excludes an identifier derived from a photograph, video, or audio recording therefore cannot be determined from the statutory text; there is no definitional clause to read as imposing or narrowing such an exclusion.

A narrower, separate carve-out excludes only 'biometric data collected by a covered online service about a minor without the minor's knowledge' from the chapter's definition of publicly available data, which does not address an adult's biometric data, or a knowingly collected minor's, drawn from a public recording.