Privacy Laws in North Carolina: What You Need to Know

North Carolina does not yet have a single, comprehensive consumer data privacy law. Instead, the state relies on a patchwork of sector-specific statutes that address identity theft, data breaches, Social Security number protection, student privacy, and more. A proposed bill -- House Bill 462 -- could change that, but as of early 2026, it has not been enacted. Here is what North Carolina residents need to know about their current privacy rights and what may be coming next.

North Carolina's Sector-Specific Approach to Privacy

Rather than passing a single law that covers all aspects of consumer data privacy, North Carolina has taken a targeted approach. Several existing statutes address specific types of personal information and specific industries. While this leaves gaps -- particularly when it comes to data brokers -- it does provide meaningful protections in key areas.

NC Identity Theft Protection Act

North Carolina's Identity Theft Protection Act (N.C.G.S. Chapter 75, Article 2A) establishes criminal penalties for identity theft and provides victims with legal tools to recover. The law makes it a felony to knowingly obtain, possess, or use another person's identifying information without consent for the purpose of fraudulently representing that person. Victims can place security freezes on their credit reports and file police reports to begin the recovery process.

Data Breach Notification Law

Article 2C of Chapter 75 of the North Carolina General Statutes requires businesses to notify consumers when their personal information has been compromised in a data breach. Key provisions include:

• Timing: Businesses must notify affected individuals "without unreasonable delay" after discovering a breach. There is no fixed number of days specified in the statute.
• Who must comply: Any business that owns or licenses personal information of North Carolina residents.
• What triggers notification: Unauthorized access to or acquisition of unencrypted personal information that creates a reasonable likelihood of harm.
• Attorney General notification: If a breach affects more than 1,000 people, the business must also notify the North Carolina Attorney General and all consumer reporting agencies.

Social Security Number Safeguards

North Carolina law restricts the use and display of Social Security numbers. Businesses and government agencies are prohibited from publicly posting or intentionally communicating SSNs, requiring SSNs as a condition of accessing a website, or printing SSNs on documents mailed to individuals unless required by law. These restrictions help reduce the risk of identity theft from routine business interactions.

Student Privacy Protections

North Carolina has enacted laws protecting student data in the educational context. The Student Online Privacy Protection Act limits how education technology companies can use student data collected through school-administered programs. Schools must also comply with federal requirements under FERPA (the Family Educational Rights and Privacy Act), which gives parents and eligible students rights over educational records.

Insurance Data Security

The North Carolina Insurance Data Security Act establishes cybersecurity requirements for insurance companies licensed in the state. Insurers must implement comprehensive information security programs, conduct risk assessments, and report data breaches to the Commissioner of Insurance within specified timeframes. This law aligns with the National Association of Insurance Commissioners' model legislation.

Public Records Confidentiality

While North Carolina's public records law grants broad access to government documents, certain categories of personal information are exempt from disclosure. Medical records, juvenile records, personnel files of state employees, and certain law enforcement records are protected. However, many government records -- including property records, voter registration data, and court filings -- remain publicly accessible and are routinely collected by data brokers.

House Bill 462: The Proposed NC Personal Data Privacy Act

The most significant privacy legislation currently under consideration in North Carolina is House Bill 462, introduced during the 2025-2026 legislative session. Titled the North Carolina Personal Data Privacy Act, HB 462 would establish the state's first comprehensive consumer data protection law.

Status of HB 462

As of early 2026, HB 462 was referred to the Committee on Commerce and Economic Development on April 29, 2025. The bill has not been enacted and remains in the legislative process. Whether it advances, is amended, or stalls in committee remains to be seen.

What HB 462 Would Do

If passed, the bill would grant North Carolina consumers several important rights over their personal data:

• Right to confirm: Consumers could ask businesses whether they are collecting or processing their personal data.
• Right to access: Consumers could request a copy of the personal data a business holds about them.
• Right to correct: Consumers could request corrections to inaccurate personal data.
• Right to delete: Consumers could request that a business delete their personal information.
• Right to opt out: Consumers could opt out of data processing for targeted advertising, data sales, and profiling.

Which Businesses Would Be Covered

HB 462 would apply to businesses that conduct operations in North Carolina or produce products or services targeted at North Carolina residents and meet at least one of the following thresholds:

• Process the personal data of 35,000 or more North Carolina consumers in a calendar year
• Derive 20% or more of gross revenue from the sale of personal data and process the data of at least 10,000 consumers

Social Media Safety Act Component

HB 462 also includes provisions related to the Social Media Safety Act, which would impose restrictions on social media accounts for minors. These provisions reflect growing national concern about children's online safety and data privacy, an area where several other states have already enacted legislation.

Federal Laws That Protect North Carolina Residents

Even without a comprehensive state privacy law, North Carolina residents benefit from several federal statutes:

• HIPAA: Protects health information held by healthcare providers, insurers, and their business associates.
• GLBA: Requires financial institutions to safeguard personal financial data and provide opt-out rights for certain information sharing.
• FERPA: Protects the privacy of student education records at institutions receiving federal funding.
• COPPA: Requires websites and online services to obtain parental consent before collecting personal information from children under 13.
• FTC Act: The Federal Trade Commission can take enforcement action against companies that engage in unfair or deceptive practices involving consumer data.

How North Carolina Compares to Neighboring States

North Carolina's neighbors have taken different approaches to privacy legislation:

• Virginia: The Virginia Consumer Data Protection Act (VCDPA) has been in effect since January 2023 and includes consumer rights to access, delete, and opt out of data sales.
• Tennessee: The Tennessee Information Protection Act (TIPA) took effect on July 1, 2025, giving consumers rights similar to those proposed in North Carolina's HB 462.
• Georgia: Like North Carolina, Georgia does not yet have a comprehensive consumer privacy law, though proposals have been introduced.

North Carolina is part of a shrinking group of states without comprehensive privacy legislation. As more states enact these laws, pressure on the North Carolina General Assembly to act continues to build.

How to Protect Your Privacy Today

Regardless of what happens with HB 462, you can take steps right now to protect your personal information:

1. Search for yourself online: Look up your name on Google and major people-search sites like Spokeo, WhitePages, and BeenVerified to see what personal data is publicly available.
2. Submit opt-out requests: Most data brokers offer opt-out processes, even without a North Carolina-specific law requiring them. Submit removal requests directly through their websites.
3. Reference other states' laws: Many national data brokers honor CCPA and VCDPA requests from consumers in all states. Citing these laws can strengthen your removal requests.
4. Freeze your credit: Place security freezes with all three major credit bureaus to prevent unauthorized accounts from being opened in your name.
5. Monitor the dark web: Check whether your email addresses, passwords, or other personal data have appeared in known data breaches.
6. Use PrivacyOn: Manually tracking and removing your data from 100+ broker sites is a time-consuming, ongoing process. PrivacyOn automates the entire workflow -- submitting removal requests, monitoring for re-listings, and scanning the dark web for your exposed information. Family plans cover up to 5 people starting at $8.33/month, giving your entire household continuous protection regardless of what state laws do or do not require.

North Carolina's privacy protections are evolving, and a comprehensive law may be on the horizon. But data brokers are collecting and selling your personal information today. Taking proactive steps to remove your data now is the most effective way to protect yourself while the legislature catches up.