WeVote
Log In

Bill

Bill

HB 644

An Act amending the act of May 3, 1933 (P.L.242, No.86), referred to as the Cosmetology Law, further providing for definitions; and repealing provisions relating to booth rental prohibited.

2025-2026 Regular Session Introduced by Ann Flood and 4 co-sponsors

NC HB 644 requires clear privacy disclosures and consent for algorithmic use, bans using minors’ data for recommendations or ads, and enforces with a public registry.

Referred to Professional Licensure
0
WeVote Research Nonpartisan
Bill Summary · HB 644

HB 644 — "Social Media Algorithmic Control in Information Technology Act" (North Carolina)

Status note: This summary covers the Social Media Algorithmic Control in IT Act as drafted for North Carolina (House Bill 644, Committee Substitute — reported favorably). (Multiple unrelated bills share the HB 644 number in other jurisdictions.)

Main purpose

To limit algorithmic personalization and targeted advertising that rely on the personal data of North Carolina users — with special protections for minors — by (1) requiring clearer privacy disclosures and consent for algorithmic recommendations, (2) prohibiting use of minors’ data for algorithmic recommendations or targeted ads, and (3) establishing enforcement, reporting, and study mechanisms.

Key definitions (selected)

  • Social media platform / platform: an electronic service that allows user-generated content and has more than 1,000,000 monthly active users in the United States.
  • Minor: an individual under age 18 (versions use “under 18” or “age 18 or younger”).
  • Algorithmic recommendation/system: automated systems used to suggest, promote, or rank information.
  • User data: any data collected directly or indirectly from or about a platform user.

Major provisions

  • Privacy disclosures: Platforms must publish an accessible privacy policy. A succinct (≤250-word) statement must explain how user data will be used.
  • Consent for algorithmic use: User data may be used in algorithmic recommendation systems only after the user has been notified and consents to that use. Requests for data access that will inform algorithmic recommendations must include full, separate disclosure (distinct from terms of service).
  • Functionality without consent: Platforms must be fully functional for users who decline to consent to algorithm-driven personalization.
  • Age verification: Platforms must use an age verification system requiring users to self-attest their age.
  • Protections for minors:
    • Operators must ensure no minor’s user data is used to inform algorithmic content recommendations or to select advertisements/promotions shown to minors.
    • Operators can be liable if they knew or had reason to know the user was a minor. If age was estimated from a user’s self-attestation, the operator is not liable for a false attestation by the user.
    • Exceptions: algorithms intended to block access to inappropriate or harmful content for minors are exempt.
  • Registry and reporting: Beginning Oct. 1, 2024 (per text), platforms must annually submit a digital copy of their privacy policy and a certification of compliance to the Consumer Protection Division (NC Department of Justice). The Division will maintain a public registry.
  • Enforcement:
    • Violations are designated (effective Jan. 1, 2025 in the bill) as unfair or deceptive acts or practices under G.S. 75‑1.1.
    • The Attorney General is authorized to monitor compliance and bring civil actions where appropriate.
    • Private plaintiffs may sue only if they can show actual harm from a violation (limited private right of action).
  • North Carolina Data Privacy Task Force: Establishes a 21‑member Task Force (administratively within DOJ) including ex officio officials (Attorney General, State CIO, DHHS Secretary, SBI Director, mental health and maternal/child health directors) and appointed advocates/experts to study and advise on data privacy issues.

Who is affected

  • Covered social media platforms (threshold >1,000,000 monthly U.S. users).
  • North Carolina residents who use those platforms, especially minors and parents.
  • Advertisers and third parties that receive or process platform user data.
  • State agencies: Attorney General’s office (enforcement), Consumer Protection Division (registry), and the Task Force.

Enforcement timeline / effective dates (as drafted)

  • Privacy and registry requirements: effective Oct. 1, 2024 (per bill language).
  • Violations classified as unfair/deceptive (AG enforcement authority): effective Jan. 1, 2025. (Implementing dates shown in the bill text; actual effective dates may change if amended or enacted later.)

Potential impacts

  • For platforms: operational and compliance costs (consent flows, age verification, policy updates, registry filings), limits on personalized recommendation systems and ad targeting for minors.
  • For minors: increased privacy protections and reduced algorithm-driven personalization and targeted advertising.
  • For state enforcement: added monitoring and potential litigation responsibilities for the Attorney General.
  • For users: clearer privacy disclosures and optional non‑personalized use of platforms.

If you’d like, I can:
- Produce a side-by-side comparison of this bill with federal COPPA or other state laws (CA, CO, WA) protecting minors’ data; or
- Draft a short compliance checklist for platforms to meet this bill’s requirements.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.