AN ACT to combat social media addiction by requiring that sociAL Media platforms respect the privacy of NOrth Carolina users' data and not use a North Carolina minor's data for advertising or algorithmic recommendations AND to make willful violations of data user privacy an unfair practice under G.S. 75‑1.1.

The General Assembly of North Carolina enacts:

SECTION 1.  Effective October 1, 2024, Chapter 75 of the General Statutes is amended by adding a new Article to read:

Article 2B.

Social Media Algorithmic Control in Information Technology Act.

§ 75‑70.  Title; definitions.

(a)        This Article shall be known and may be cited as the Social Media Algorithmic Control in Information Technology Act.

(b)        Definitions. – The following definitions apply in this Article:

(1)        Algorithmic recommendation. – A recommendation of suggested, promoted, or ranked information.

(2)        Algorithmic recommendation system. – A fully or partially automated system used to suggest, promote, or rank information.

(3)        Minor. – An individual who is under 18 years of age.

(4)        North Carolina platform user. – An individual who resides in North Carolina who uses a social media platform.

(5)        Operator. – As defined in section 1302 of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. § 6501.

(6)        Social media algorithm. – The software used by social media platforms to prioritize content and direct the prioritized content to the user.

(7)        Social media platform or platform. – An electronic medium with more than 1,000,000 monthly active users in the United States, including a browser‑based or application‑based interactive computer service, telephone network, or data network, that allows users to create, share, and view user‑generated content. The term does not include any of the following:

a.         Internet search providers.

b.         Internet service providers.

c.         Electronic mail.

d.         Communications services as defined in G.S. 160A‑340(3).

e.         Community forums where the primary purpose of the forum is for customer self‑service support related to products, sellers, services, events, or places, or any combination thereof.

f.          Interactive video game services.

g.         Online shopping or e‑commerce.

(8)        User data. – Any data collected directly or indirectly from or concerning a North Carolina platform user.

§ 75‑71.  User data privacy; targeting minors prohibited; registry.

(a)        Privacy Requirements. – The General Assembly finds that unhealthy social media use has been linked to depression, anxiety, eating disorders, and suicidal ideation, especially among young people. Exploitation of user data can result in users being targeted in ways that increase unhealthy social media use. It is the policy of this State that user data shall be respected by platforms. Special protections are warranted for users who are minors. Therefore, the operator of a social media platform shall comply with all of the following requirements for North Carolina platform users:

(1)        The platform's privacy policy must be accessible on the platform's website with the disclosure of how user data will be used by the platform stated in a succinct and easy to understand statement that communicates the true intent of the use in less than 250 words.

(2)        User data may be used in algorithmic recommendations only when the user has been notified and consents to the use of the data in such manner.

(3)        Requests for data access that will be used to inform algorithmic recommendations shall require full disclosure of the use of the data, including third‑party use. This notification shall be separate and distinct from the platform's terms of service notification.

(4)        The platform must be fully functional for a user without the user having to give consent for their user data to be used to inform algorithmic recommendations.

(5)        The platform must use an age verification system that requires a user to self‑attest to their age.

(b)        Targeting Minors Prohibited. – The operator of a social media platform must control algorithmic recommendation systems so that no user data from a North Carolina platform user who is a minor is used:

(1)        To inform content recommendations to the minor. This requirement is not intended to prevent content recommendations from being shown as a direct result of explicit actions, such as showing posts from accounts a user follows in a chronological feed, but it is intended to prevent any data, including follows, from being used in an algorithm to generate algorithmic recommendations.

(2)        To inform what advertisements or promotions are shown to minors. This requirement is not intended to prevent the showing of advertisements or promotions that are shown to the user based upon explicit actions, such as being based on the results of a search initiated by the user on the platform.

(c)        The operator of a social media platform may be held liable for violating subsection (b) of this section if the operator of the social media platform knew or had reason to know that the user was a minor. The operator of a social media platform that has made an estimation of a user's age based upon the user's self‑attestation is not liable if the user was a minor who falsely attested to not being a minor.

(d)       Exceptions. – A social media algorithm that is intended to block access to inappropriate or harmful content to an account holder that is a minor is exempt from the requirements of this section.

(e)        Registry. – Beginning October 1, 2024, and then annually thereafter, a social media platform shall provide the Consumer Protection Division of the North Carolina Department of Justice (Division) with a digital copy of the platform's privacy policy and certification that the platform has complied with the requirements of this section. Platforms shall provide notice of substantive privacy policy changes to the registry. The Division shall maintain a registry of these policies and certifications on its internet website.

§ 75‑72.  Investigation; enforcement; private right of action.

(a)        Violations. – Effective January 1, 2025, a platform's violation of this Article is an unfair or deceptive act or practice under G.S. 75‑1.1.

(b)        Investigations. – The Attorney General shall monitor social media platforms for compliance with this Article.

(c)        Complaints. – A North Carolina platform user may make a complaint to the Attorney General alleging that a social media platform has failed to comply with the requirements of this Article. The Attorney General may bring a civil action in any case in which the Attorney General has reason to believe that the interest of the residents of this State has been or is threatened due to noncompliance with this Article.

(d)       Private Right of Action. – No private right of action may be brought by an individual for a violation of this Article unless the individual is harmed as a result of the violation.

§ 75‑73.  North Carolina Data Privacy Task Force.

(a)        There is created the North Carolina Data Privacy Task Force (Task Force) within the Department of Justice for budgetary purposes only.

(b)        The Task Force shall be composed of 21 members. The ex officio members listed in subdivisions (1) through (6) of this subsection may designate representatives from their particular departments, divisions, or offices to represent them on the Task Force. In making appointments or designating representatives, appointing authorities and ex officio members shall use best efforts to select members or representatives with sufficient knowledge and experience to effectively contribute to the issues examined by the Task Force and, to the extent possible, to reflect the geographical, political, gender, and racial diversity of this State. The members shall be as follows:

(1)        The Attorney General.

(2)        The State Chief Information Officer.

(3)        The Secretary of the Department of Health and Human Services.

(4)        The Director of the State Bureau of Investigation.

(5)        The Director of the Maternal and Child Health Section of the Department of Health and Human Services.

(6)        The Director of the Division of Mental Health, Developmental Disabilities, and Substance Abuse Services.

(7)        A representative from NC Child, appointed by the Governor upon recommendation of the President of the organization.

(8)        A representative from a private group, other than NC Child, that advocates for children, appointed by the Governor upon recommendation of private child advocacy organizations.

(9)        A pediatrician, licensed to practice medicine in North Carolina, appointed by the President Pro Tempore of the Senate.

(10)      A psychiatrist, licensed to practice medicine in North Carolina, appointed by the Speaker of the House of Representatives.

(11)      Two public members, one of whom is an educator, appointed by the Speaker of the House of Representatives.

(12)      Two public members, one of whom is a social worker, appointed by the President Pro Tempore of the Senate.

(13)      Two members of the Senate, appointed by the President Pro Tempore of the Senate, and two members of the House of Representatives, appointed by the Speaker of the House of Representatives.

(14)      A representative from the North Carolina Young People's Alliance, appointed by the Governor upon recommendation of the head of the organization.

(15)      Two youth representatives under the age of 21 appointed by the Secretary of the Department of Health and Human Services after conducting an application‑based selection process.

(c)        All members of the Task Force are voting members. Vacancies in the appointed membership shall be filled by the appointing officer who made the initial appointment. Terms shall be two years. The members shall elect a chair who shall preside for the duration of the chair's term as member. In the event a vacancy occurs in the chair before the expiration of the chair's term, the members shall elect an acting chair to serve for the remainder of the unexpired term.

(d)       Beginning March 15, 2024, and then annually thereafter, the Task Force shall report to the General Assembly on its work, with a special focus on mental health issues related to social media, along with findings, recommendations, and any legislative proposals.

SECTION 2.  Effective July 1, 2023, there is appropriated from the General Fund to the Department of Justice the sum of one hundred thousand dollars ($100,000) for the 2023‑2024 fiscal year to develop the registry created in G.S. 75‑71, as enacted by this act.

SECTION 3.  Except as otherwise provided, this act is effective when it becomes law.