NC S624

Requires health information chatbots to obtain a license from the NC Department of Justice before operating, with applications documenting technical architecture, security measures, privacy protections, and proof of insurance; violations carry $50,000 civil penalties

Mandates licensees report data breaches within 24 hours to the Department and 48 hours to affected consumers, conduct security audits every 6 months, and demonstrate chatbot effectiveness through peer-reviewed controlled trials

Applies safety and privacy rules to "covered platforms" with over $100,000 annual revenue or 5,000+ monthly U.S. users, excluding educational/research and government chatbots

Imposes duty of loyalty requirements prohibiting platforms from designing chatbots that conflict with users' best interests, including duties to detect emergency situations, prevent emotional dependence, disclose the chatbot's artificial nature, and limit data collection to legitimate purposes

Grants the Attorney General enforcement authority and creates a private right of action allowing individuals to recover actual damages or $1,000 per violation, with a 2-year statute of limitations; both parts become effective January 1, 2026