United States – North Carolina

Regulator And AuthorityAmber

The NC Attorney General's Office enforces the state's breach-notification statute and general consumer-protection law; the FTC provides the concurrent federal backstop under Section 5.

Claims (1):

• The North Carolina Attorney General, currently Jeff Jackson, leads the North Carolina Department of Justice which enforces consumer-protection and data-breach law in the state.

Act And InstrumentsAmber

Primary instrument is the Identity Theft Protection Act (N.C. Gen. Stat. §§ 75-61, 75-65), supplemented by FTC Act Section 5 at the federal level.

Claims (2):

• North Carolina's data-breach notification law was enacted as Senate Bill 1048 in 2005 and has been codified as N.C. Gen. Stat. §§ 75-61, 75-65.
• Section 5 of the FTC Act provides a general federal unfair/deceptive-practices privacy enforcement baseline applicable nationally, including North Carolina, in the absence of state-level comprehensive privacy legislation.

Material ScopeRed

No omnibus material scope; the statute governs only breach notification for a narrowly defined category of 'personal information' tied to identity-theft risk.

Claims (1):

• North Carolina's breach statute defines a breach narrowly as unauthorized acquisition or access to unredacted or unencrypted records containing personal information that could create a material risk of harm, rather than governing personal-data processing generally.

Territorial ScopeAmber

No confirmed extraterritorial-application language specific to NC's statute was independently verified in primary text; treated as Probable pending direct statute review.

Claims (1):

• North Carolina's breach-notification statute is generally understood to apply to any entity that owns, licenses, or maintains personal information of North Carolina residents regardless of the entity's location, consistent with the typical structure of US state breach statutes, though the precise extraterritorial text was not independently verified against primary statute text in this run.

Regulator Registration And FilingAmber

No general registration/filing regime for controllers exists; the only filing duty is breach notification to the NC AG's Consumer Protection Division, required since a 2009 amendment removed the prior 1,000-person threshold.

Claims (1):

• A 2009 amendment to North Carolina's breach law introduced a requirement that businesses notify the Attorney General whenever North Carolina residents are notified of a breach, removing the prior 1,000-person notification threshold.

Lawful BasesRed

No NC statutory lawful-basis enumeration exists; processing legality for private-sector data is governed by contract, sectoral consent regimes, and general tort/consumer-protection law only.

Claims (1):

• North Carolina has no general statutory lawful-basis framework for processing personal data comparable to GDPR Article 6; where lawful processing standards exist, they derive from sector-specific federal requirements rather than a state omnibus regime.

Consent ThresholdsRed

No NC-specific consent standard was identified beyond sectoral federal requirements (HIPAA authorization, GLBA opt-out, COPPA verifiable parental consent).

Special CategoriesAmber

The Identity Theft Protection Act's 'personal information' definition is narrower than a GDPR/CCPA-style special-category taxonomy; broader sensitive-category protection (health, genetic, biometric) is addressed only via federal sectoral law.

Claims (1):

• North Carolina's breach statute's definition of 'personal information' centers on identity-theft/financial-fraud building blocks (name plus SSN, driver's license, financial account numbers) rather than the broader special-category taxonomy (health, biometric, genetic, political, sexual) found in comprehensive regimes.

Pseudonymisation And AnonymisationAmber

No statutory anonymisation/pseudonymisation safe harbour exists; the closest functional analogue is the breach law's encryption exemption.

Claims (1):

• North Carolina's breach law provides that notification is still required for encrypted personal information if the encryption keys were also compromised, functioning as a limited encryption-based safe harbour rather than a formal anonymisation/pseudonymisation regime.

Access RightRed

No general right of access to personal data held by private businesses exists under NC law; the ITPA affords only breach notice and credit-freeze rights.

Claims (1):

• North Carolina's Identity Theft Protection Act does not confer a general right of access to personal data held by private-sector businesses; it affords only credit-freeze rights and breach-notice mechanics.

Rectification And ErasureRed

No statutory right to rectification or erasure of personal data by private controllers was found in North Carolina law.

Absence provenance: not recorded. Searched: N.C. Gen. Stat. Chapter 75 Article 2A, IAPP US State Privacy Legislation Tracker (NC absent from 19 comprehensive states).

Restriction And ObjectionRed

No statutory right to restrict processing or object to profiling exists under North Carolina law for private-sector data controllers.

Absence provenance: not recorded. Searched: IAPP US State Privacy Legislation Tracker, dataguidance NC jurisdiction page.

Data PortabilityRed

No statutory data-portability right exists under North Carolina law.

Absence provenance: not recorded. Searched: IAPP US State Privacy Legislation Tracker, dataguidance NC jurisdiction page.

Deadlines And Response WindowsAmber

The in-force standard requires notice 'without unreasonable delay' after discovery of a breach; a specific 15-day notification deadline was discussed in 2018 legislative reform proposals but was not confirmed as enacted.

Claims (2):

• North Carolina's breach law requires businesses to provide notice of a security breach to affected persons following discovery or notification of the breach without unreasonable delay.
• A 2018 legislative proposal discussed by the NC Attorney General and a state representative would have replaced the 'unreasonable delay' standard with a specific 15-day notification deadline to consumers and the Attorney General, but this proposal's enactment status was not confirmed.

Accountability And DpiaRed

No DPIA or general accountability-principle requirement exists in North Carolina law.

Absence provenance: not recorded. Searched: IAPP US State Privacy Legislation Tracker, dataguidance NC jurisdiction page.

Dpo RequirementsRed

No DPO appointment requirement exists under North Carolina law.

Absence provenance: not recorded. Searched: IAPP US State Privacy Legislation Tracker.

Ropa RequirementsRed

No records-of-processing-activities obligation exists under North Carolina law.

Absence provenance: not recorded. Searched: IAPP US State Privacy Legislation Tracker.

Joint Controller ArrangementsRed

No joint-controller framework exists at the state level; contractual data-sharing obligations arise only under sectoral federal law (e.g., GLBA service-provider contracts).

Absence provenance: not recorded. Searched: GLBA service-provider contract requirements, IAPP US State Privacy Legislation Tracker.

Security MeasuresAmber

Businesses must take reasonable measures to protect against unauthorized access to or use of consumers' personal information, including methods to secure sensitive information such as Social Security numbers.

Claims (1):

• North Carolina's Identity Theft Protection Act requires businesses to take reasonable measures to protect against unauthorized access to or use of consumers' personal information, using methods to secure sensitive data such as Social Security numbers.

Breach NotificationAmber

Breach notification to affected NC residents and to the Attorney General's Consumer Protection Division is required without unreasonable delay following discovery, with no numerical person-count threshold since the 2009 amendment.

Claims (1):

• Following a 2009 amendment, North Carolina businesses must notify the Attorney General whenever North Carolina residents are notified of a breach, with no minimum affected-person threshold.

Retention And DisposalAmber

N.C. Gen. Stat. § 75-64 addresses destruction of personal-information records, suggesting a disposal duty, though the substantive text was not independently retrieved in this run.

Claims (1):

• North Carolina General Statutes Chapter 75, Article 2A, Section 75-64 addresses the destruction of personal-information records, indicating a statutory disposal obligation distinct from a comprehensive retention-limitation regime.

Transfer MechanismsRed

No NC-specific transfer mechanism exists; cross-border transfers are governed at the federal sectoral level only.

Absence provenance: not recorded. Searched: NC General Statutes Chapter 75, IAPP US State Privacy Legislation Tracker.

Adequacy ReceivedRed

Adequacy is assessed by the EU at the national US level, not toward individual US states; no NC-specific adequacy determination exists or is applicable.

Absence provenance: not recorded. Searched: European Commission adequacy decisions list.

Adequacy GrantedRed

North Carolina does not independently grant adequacy status to foreign jurisdictions; this is not a sub-federal function under US law.

Absence provenance: not recorded. Searched: NC Department of Justice guidance on international transfers.

Sccs And BcrsRed

No NC-specific SCC/BCR uptake requirement exists.

Absence provenance: not recorded. Searched: NC General Statutes Chapter 75.

Transfer Impact AssessmentRed

No NC-specific transfer-impact-assessment requirement exists.

Absence provenance: not recorded. Searched: IAPP US State Privacy Legislation Tracker.

Data LocalisationRed

No NC data-localisation mandate was identified.

Absence provenance: not recorded. Searched: NC General Statutes Chapter 75, dataguidance NC jurisdiction page.

Financial Sector OverlayAmber

Insurance companies and agents operating in North Carolina are subject to GLBA's affirmative and continuing obligation to protect the security and confidentiality of customers' non-public personal information; NAIC model laws/principles are persuasive but not directly binding absent state adoption.

Claims (1):

• Insurance companies and agents, including those operating in North Carolina, are subject to the Gramm-Leach-Bliley Act's affirmative and continuing obligation to respect customer privacy and protect the security and confidentiality of non-public personal information.

Health Sector OverlayAmber

Health data in North Carolina is governed by federal HIPAA rather than a state-specific health-privacy statute.

Absence provenance: not recorded. Searched: NC health information privacy statute search.

Telecoms And EprivacyRed

No NC-specific ePrivacy/telecoms data statute equivalent to EU ePrivacy was identified; federal telecoms/robocall rules apply nationally.

Absence provenance: not recorded. Searched: NC telecoms privacy statute search.

Employment DataRed

No NC-specific employment-data-privacy statute was identified.

Absence provenance: not recorded. Searched: NC employment data privacy statute search.

Credit And ScoringAmber

Credit-reporting and scoring practices affecting NC residents are governed by the federal Fair Credit Reporting Act rather than a state-specific credit-scoring statute.

Absence provenance: not recorded. Searched: NC credit scoring statute search.

EducationRed

No NC-specific comprehensive student-data-privacy statute distinct from federal FERPA/COPPA protections was confirmed in this run.

Absence provenance: not recorded. Searched: North Carolina student data privacy statute 2023 minors' data bill status.

InsuranceAmber

Insurance data practices are shaped by NAIC model laws (Insurance Information and Privacy Protection Model Act; Insurance Data Security Model Law), which require state-by-state adoption; North Carolina's specific adoption status for the Insurance Data Security Model Law was not confirmed in this run.

Claims (1):

• NAIC model laws and regulations, including the Insurance Data Security Model Law, are not directly binding on the insurance industry until adopted in whole or part by individual state legislators or regulators, meaning North Carolina's specific obligations depend on independent state adoption not confirmed in this run.

Cookies And TrackersRed

No NC cookie/tracker consent statute exists.

Absence provenance: not recorded. Searched: NC cookie consent law search, IAPP US State Privacy Legislation Tracker.

Dark PatternsRed

No NC dark-pattern prohibition statute exists; dark patterns may be reachable only via FTC Section 5 deceptive-practices enforcement.

Claims (1):

• In the absence of a North Carolina-specific dark-pattern prohibition, deceptive interface design practices affecting NC consumers are reachable only through the FTC's general Section 5 unfair/deceptive-practices authority.

Opt Out SignalsRed

No NC statutory recognition of opt-out signals (e.g., Global Privacy Control) exists.

Absence provenance: not recorded. Searched: NC opt-out signal statute search.

Clean Rooms And DcrRed

No NC-specific clean-room/data-collaboration-room regulation exists.

Absence provenance: not recorded. Searched: NC data clean room regulation search.

Cross Context AdvertisingRed

No NC statutory 'sale'/'share' cross-context-advertising regime exists.

Absence provenance: not recorded. Searched: NC cross-context advertising statute search.

Direct MarketingRed

No NC-specific direct-marketing consent/suppression statute beyond general federal telemarketing rules (e.g., TCPA/TSR) was identified.

Absence provenance: not recorded. Searched: NC direct marketing consent statute search.

Profiling RestrictionsRed

No NC or targeted federal profiling-restriction statute analogous to GDPR Art. 22 exists.

Absence provenance: not recorded. Searched: NC profiling restriction statute search.

Automated Decision Making TransparencyRed

No NC ADM-transparency statute exists.

Absence provenance: not recorded. Searched: NC automated decision-making transparency statute search.

Ai Risk AssessmentsRed

No NC AI-risk-assessment statute exists.

Absence provenance: not recorded. Searched: NC AI risk assessment statute search.

Biometric RegimeAmber

No federal biometric privacy act or facial-recognition-technology act exists; the FTC instead applies Section 5 to biometric-information practices through a dedicated policy statement covering facial, iris/retina, finger/handprint, voice, genetic, and gait/movement data, without preempting state or local biometric laws (none of which was found specific to North Carolina).

Claims (1):

• There is currently no federal biometric privacy act or facial recognition technology act; the FTC instead relies on Section 5 of the FTC Act, applying it to biometric information technologies through a dedicated Commission Policy Statement, which explicitly does not preempt state or local biometric laws.

Genetic DataRed

No NC-specific genetic-data-privacy statute was identified; genetic data is treated as biometric information under the FTC's policy statement and is otherwise governed by federal GINA protections in specific employment/insurance contexts.

Absence provenance: not recorded. Searched: NC genetic privacy statute search.

State Surveillance CarveoutsRed

No NC-specific state-surveillance carve-out statute was identified; national-security exemptions operate at the federal level only.

Absence provenance: not recorded. Searched: NC state surveillance carve-out statute search.

Age VerificationAmber

No NC-specific age-verification statute was confirmed; the FTC has issued an enforcement policy statement promoting adoption of age-verification technology at the federal level.

Claims (1):

• The FTC issued an Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology, operating at the federal level and applicable to businesses serving North Carolina consumers in the absence of a state-specific age-verification statute.

Parental ConsentAmber

Parental-consent mechanics for minors' online data in North Carolina derive from federal COPPA rather than a state-specific statute.

Absence provenance: not recorded. Searched: NC parental consent statute search.

Minor Profiling BansRed

No NC-specific minor-profiling ban was identified.

Absence provenance: not recorded. Searched: NC minor profiling ban statute search.

Education SettingsRed

No NC-specific education-settings data-privacy statute distinct from federal FERPA was confirmed.

Absence provenance: not recorded. Searched: NC student data privacy statute search.

Dependent AdultsRed

No NC-specific dependent-adults data-privacy statute was identified.

Absence provenance: not recorded. Searched: NC dependent adults data privacy statute search.

Regulator Powers And PenaltiesAmber

The NC AG enforces the breach statute and general consumer-protection law; specific statutory maximum-penalty figures for the ITPA were not independently retrieved in this run.

Absence provenance: not recorded. Searched: N.C. Gen. Stat. § 75-65 penalty provisions primary text.

Enforcement Activity IndexAmber

Historical multistate settlements involving North Carolina include the Target 2013 breach settlement, a 2017 Nationwide Insurance settlement, and a 2018 Uber breach settlement; no NC-specific enforcement action from the last 12 months was independently confirmed in this run.

Claims (2):

• In 2017, North Carolina received $390,814 as part of an $18 million nationwide settlement with Target arising from its 2013 data breach.
• In late 2018, North Carolina received $3,661,800.27 as part of a nationwide $148 million settlement with Uber over a data breach, with Uber also agreeing to implement improved data-security practices.

Regulator Funding And CapacityAmber

No specific funding/headcount data for the NC AG's Consumer Protection Division was retrieved in this run.

Absence provenance: not recorded. Searched: NC Department of Justice budget consumer protection division staffing.

Collective Redress And Class ActionsAmber

No NC-specific statutory collective-redress mechanism beyond ordinary state class-action procedure was identified for data-privacy claims.

Absence provenance: not recorded. Searched: NC class action data breach statute search.

Private Right Of ActionAmber

It was not confirmed in this run whether North Carolina's breach statute affords consumers a private right of action; some US state breach statutes do, others rely solely on AG enforcement.

Claims (1):

• Some but not all US state breach-notification statutes provide a private right of action for noncompliance, while others rely solely on state attorney general enforcement; North Carolina's specific status on this point was not independently confirmed against primary statute text in this run.

Recent Developments 180DAmber

No North Carolina-specific comprehensive privacy legislation, new breach-law amendment, or adequacy-relevant development was confirmed within the last 180 days as of this run's dispatch date (2026-08-06); broader US state privacy activity in 2026 continued but did not include a new North Carolina enactment.

Claims (1):

• As of early 2026, four new comprehensive state privacy laws had been enacted in the US generally, but this activity did not include a new North Carolina enactment, consistent with North Carolina's continued absence from the roster of states with comprehensive privacy statutes.