NC S525

Establishes the North Carolina Consumer Privacy Act (Chapter 75F) effective January 1, 2024, creating comprehensive privacy protections for personal data processing by controllers and processors meeting specified thresholds.

Applies to entities conducting business in North Carolina with $25 million+ annual revenue that control/process personal data of 100,000+ consumers or derive 50%+ gross revenue from personal data sales with 25,000+ consumers.

Grants consumers four key rights: confirm and access personal data processing, delete provided personal data, obtain portable copies of data in usable format, and opt out of targeted advertising and personal data sales.

Requires controllers to provide clear privacy notices, implement reasonable data security practices, obtain consent before processing sensitive data (biometric, health, racial/ethnic origin, location), and prohibits discrimination against consumers exercising privacy rights.

Establishes Consumer Privacy Account funded by civil enforcement penalties up to $7,500 per violation, with Attorney General holding exclusive enforcement authority after 45-day cure period; no private right of action available to consumers.