Consumer Privacy Act (S.B. 569)

• Establishes comprehensive consumer privacy protections in North Carolina applying to businesses collecting personal data from at least 100,000 consumers or 25,000 consumers deriving over 50% of revenue from data sales, effective January 1, 2023.

• Grants consumers rights to access, correct, delete, and port their personal data; opt out of targeted advertising, data sales, and profiling; and appeal controller decisions, with responses required within 45 days.

• Requires data controllers to limit data collection to necessary purposes, maintain reasonable security practices, provide clear privacy notices, obtain consent for sensitive data processing, and conduct annual data protection assessments for high-risk processing activities.

• Exempts financial institutions, healthcare providers, nonprofits, public schools, and institutions of higher education from the law's requirements.

• Establishes Attorney General enforcement with civil penalties up to $5,000 per violation and a private right of action for injured persons, with a three-year statute of limitations.