Adds new Article 11, Online Safety Division, to GS Chapter 114, providing as follows. Establishes the Online Safety Division (Division) within the Office of the Attorney General, with the following duties: (1) investigation of complaints made under GS Chapter 114B (Children's Online Safety Act); (2) education of law enforcement agencies and the general public about the online safety of all North Carolinians, with an emphasis targeting harmful activities and dark patterns; (3) issuance of online safety standards and guidelines and review of relevant industry codes pertaining to internet safety, age-appropriate design, and compliance with the Children's Online Safety Act; and (4) facilitating advisory panels on internet safety, including child development experts, technology specialists, parent representatives, community stakeholders, and industry representatives.

Appropriates $5 million for 2025-26 and $4.5 million for 2026-27 from the General Fund to the Department of Justice to establish the Division. Effective July 1, 2025.

Enacts new GS Chapter 114B, Children’s Online Safety Act, providing as follows. Defines terms used in the Chapter, including defining covered platform as an internet platform providing online services having more than 5 million users in North Carolina and revenue exceeding $25 million annually. Makes it State public policy that its children are owned a duty of care with regard to their online activities in order to limit foreseeable harm and their exposure to dark patterns and harmful content on covered platforms; also endorses age-appropriate design and strong parental controls as central to protecting children. Requires covered platforms to require parental notifications for accounts created by children (defines child as an individual under age 18) and requires offering robust, easy-to-use parental supervision tools. Makes it illegal for covered platforms to use dark patterns (manipulative design elements in online environments) or deploy features known to be addictive or manipulative. Requires covered platforms to define cyberbullying and include provisions for reporting to the Division and provide intervention and support services for affected children. Requires platforms to submit an annual Child Impact Assessment to the Division for new and existing services; sets out required content and requires retaining documentation supporting the annual assessments for at least three years. Requires covered platforms to use the highest privacy settings by default for all users likely to be children and establish strict data minimization principles that include the nine specified elements, including requiring deletion when no longer needed, prohibiting profiling and behavioral advertising targeting children, and data broker restrictions for children’s information. Allows the Attorney General to bring civil actions to enforce this Article. Allows, when the defendant is found to have knowingly violated the Chapter, imposing civil penalties of up to $500,000 per violation. Sets out what must be considered in setting the amount of the penalty. Requires penalty proceeds to be remitted to the Civil Penalty and Forfeiture Fund. Includes a severability clause. Effective December 1, 2025, and applies to acts or omissions after that date.

Enacts new GS 143B-1209 establishing the Cyberbullying Unit (Unit) within the State Bureau of Investigation to protect children online and aid in the enforcement of new Article 11. Requires the Unit, in addition to other duties, to operate a toll-free number and website on online child safety and cyberbullying.

Appropriates $2 million for 2025-26 and $1 million for 2026-27 from the General Fund to the State Bureau of Investigation to create the Unit.

Establishes the nine-member North Carolina Online Child Safety Commission (Commission) to protect the state’s children from online harms through research, education, regulation enforcement and ongoing adaptation to the evolving digital landscape. Sets out additional Commission duties. Members are to be appointed by the Governor, President Pro Tempore of the Senate, Speaker of the House, Attorney General, and Superintendent of Public Instruction and must have expertise and commitment to child welfare, digital technology, mental health, education, or related fields relevant to children’s online safety; sets out additional membership qualifications. Sets terms at four years and prohibits serving more than two consecutive terms.

Allows the Commission, with assistance and input from the Department of Justice, to: (1) issue binding regulations implementing the provisions of this act; (2) establish safety standards for covered platforms; (3) review and approve industry codes of practice; (4) initiate investigations into potential violations; (5) issue orders requiring compliance with the act; (6) impose penalties for violations as provided in this act; and (7) seek injunctive relief through the courts when necessary to prevent harm to children. Requires the Commission to give expert guidance to, among others, the Governor and General Assembly on matters relating to online child safety, educational institutions on digital literacy and safety curricula, and parents and caregivers on tools and strategies to protect children online. Requires the Commission to: (1) conduct research and data collection as specified, (2) develop and oversee the specified educational initiatives, (3) handle complaints in the specified manner, and (4) coordinate and collaborate with listed entities. Requires the Commission to prepare and publish an annual “State of Children’s Online Safety in North Carolina” report that includes the specified items. Requires the Commission to conduct annual compliance reviews of covered platforms that include seven specified measures. Requires the Commission to submit annual recommendations to the NCGA on five specified issues. Requires the Commission to hold at least four public hearings including specialized hearings on emerging issues of concern. Requires the Commission to engage with the industry in four specified ways, including convening an annual Industry Safety Summit with platform representatives and reviewing and approving updates to industry codes of practice. Requires the Commission to publish annual transparency reports that detail information related to enforcement actions, complaints, penalties, and other Commission actions. Requires the Commission to annually audit and evaluate five listed programs and initiatives, including digital literacy programs in schools and public awareness campaign effectiveness. Requires the Commission to establish annual research priorities based on identified gaps, commission or conduct studies on priority areas, award research grants from the Children's Online Safety Fund, publish findings and recommendations based on research, and ensure research informs regulatory and educational approaches.

Also sets out provisions governing the Commission’s staffing and structure, funding, technological capabilities, ethics, and accountability mechanisms.

Requires initial appointments to the Commission to be made and the first meeting to be convened within 90 days of the act’s effective date. Requires the Commission to take specified actions during its first year. Requires the Commission to develop a phased implementation plan that: (1) prioritizes addressing the most serious harms; (2) accommodates different compliance timelines based on platform size; (3) allows for industry adjustment to new requirements; and (4) includes benchmarks for measuring progress. Requires the Commission, every three years, to: (1) review its activities and impact; (2) assess changing technological landscapes and emerging challenges; (3) revise strategic priorities and approaches as needed; and (4) recommend statutory amendments to maintain effectiveness.