House committee substitute to the 1st edition makes the following changes.  

Part I.

Clarifies that only new GS Chapter 75F should be cited as the North Carolina Personal Data Privacy Act-Act (was, entire act cited as such). Removes business associate, covered entity, and protected health information from the Act’s definitions. Modifies terms child abuse, domestic violence, human trafficking, sexual assault, stalking, and violent felony. Expands the exclusion pertaining to financial institutions in GS 75F-103 (applicability of Act) so that it includes personal data collected, processed, or disclosed in accordance with Title V of the Gramm-Leach-Bliley Act and related regulations. Makes clarifying changes.

Replaces references to the “Department of Justice” with the “North Carolina Department of Justice (NCDOJ),” throughout the act. Changes the act’s deadline for NCDOJ to begin to engage in public outreach to about the Act from starting at least six months prior the act’s effective date to no later than July 1, 2025. Reorganizes the provisions specifying that Data protection requirements under GS 75F-108 are not retroactive into the Part’s effective date provisions and makes technical changes.

Part II.

Modifies terms NC user, reasonable age verification, social media company, and makes clarifying changes to the definitions contained in GS 75G-101 (definitions pertaining to new GS Chapter 75G-Social Media Verification). Specifies that GS 75G-102’s age verification requirements only apply when a social media company is determining whether a North Carolina user should be allowed access to the platform. Requires the social media company to use commercial entities (was, third-party vendor) to perform reasonable age verifications. Makes organizational and technical changes.

Amends GS 75G-103 (liability for social media companies) by replacing reference to a minor’s “custodian” with the minor’s “legal guardian.” Makes clarifying, organizational, and technical changes.  

Removes third-party vendors from the scope of GS 75G-104 which prohibits commercial entities from retaining any identifying information of an individual after access to a social media platform has been granted.