Bill > S757

This bill introduces the North Carolina Consumer Privacy Act, a comprehensive law designed to protect consumers' personal data privacy. The bill applies to businesses operating in North Carolina that meet specific revenue and data processing thresholds, such as having annual revenues of $25 million or processing personal data of 100,000 or more consumers. The act provides consumers with several key rights, including the ability to confirm what personal data is being processed, access their personal data, delete data they've provided, obtain a copy of their data, and opt out of targeted advertising or personal data sales. Controllers (businesses that determine the purposes of data processing) must provide clear privacy notices, establish data security practices, and obtain consent before processing sensitive data. The bill includes numerous exemptions for certain types of organizations and data, such as governmental entities, healthcare providers, and research institutions. Importantly, the act does not allow for private lawsuits; instead, enforcement is exclusively handled by the North Carolina Attorney General, who can investigate complaints and impose penalties up to $7,500 per violation. The law creates a Consumer Privacy Account to fund investigations and consumer education, and requires a comprehensive report on the act's effectiveness to be submitted by July 1, 2027. The act will become effective on January 1, 2026.

https://www.ncleg.gov/BillLookUp/2025/S757