Enacts Article 2B to GS Chapter 75 to be cited as the "Social Media Algorithmic Control in Information Technology Act". Includes 13 defined terms. States legislative findings and establishes State policy concerning user data on social media platforms. Defines social media platform (platform) as an electronic medium with more than one million monthly active users in the US that functions as a social media service; excludes nine specified services.

Establishes the following requirements for platforms. Specifies that the platform must provide disclosure, when the user first initializes their use or after a six-month period of inactivity and in the format described, regarding their collection and use of personal information and how users can exercise their rights and choices on the platform. Requires platforms to obtain user consent before the platform collects any user-related data on the user. Further requires platforms to provide disclosure, available upon receipt of a verifiable consumer request, detailing the categories of information collected and sources from which the information is collected; the purpose for the collection, selling, or sharing of personal information; the categories of third-party to whom the business discloses personal information; and the specific pieces of information it has collected about that user. Establishes two qualifications for using personal information in algorithmic recommendations, including that the platform reasonably determines the user is not a minor and the user is notified and expressly consents to its use. Requires platforms provide users the ability to alter, change, and delete the categories of personal information used in an algorithmic recommendation system that is modifiable at any time. Bars use of categories users intend not to be used in an algorithmic recommendation system. Prohibits discrimination against users exercising rights under the Article in provision of functionality or features of the platform unless the use of user-related data in an algorithmic recommendation system is reasonably necessary to the feature or functionality. Mandates that platforms establish comprehensive and effective controls to ensure that a minor's personal information is not used in any algorithmic recommendation system, with three exceptions listed, including recommending or presenting content from accounts that a user follows in reverse chronological order or a similar method. Deems the operator of the platform liable for violations of the statute. Provides immunity where the platform made an estimation of a user's age based on the user's self-attestation that the person was not a minor.

Requires platforms to configure all privacy settings to be available to minors and default to the highest level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interest of minors. Includes six settings that must comply with this requirement. Requires platforms to provides users with accessible mechanisms to request correction or deletion of personal information about the user. Describes requirements and recordkeeping regarding these user requests. Establishes three rights specific to minors using platforms, as specified: right to protection from manipulative design; right to transparency; and right to protection from personalized recommendation systems. Provides the operation is potentially liable for violations of the statute.

Deems violations of the Article an unfair or deceptive act or practice under state law, effective January 1, 2026. Charges the Attorney General with monitoring compliance. Permits users to make compliance complaints and authorizes the Attorney General to bring a civil action where it is believed the noncompliance has or threatens the interest of State residents. Allows minors to file a civil action if they are affected by any covered platform found to be in violation of the Article. Where the Attorney General brings an action and prevails where a minor is affected, provides specific relief available to the court.

Establishes the 21-member Data Privacy Task Force (Task Force) within the Department of Justice. Details membership, appointment, meetings, and vacancies. Sets member terms to two years. Directs the Task Force to annually report to the NCGA on its work as specified, beginning March 15, 2025. 

Effective October 1, 2026.

Appropriates $100,000 to the Department of Justice for each year of 2025-27 to develop the registry created by the act. Effective July 1, 2025.