North Carolina 2025 Session Status: In Committee Bipartisan · 4 D · 2 R cosponsors

SB 757 — Consumer Privacy Act.

Last action — Passed 1st Reading

  1. ✓
    Introduced
  2. 2
    In Committee
  3. 3
    Passed Senate
  4. 4
    Passed House
  5. 5
    To Executive
  6. 6
    Enacted

This bill is in committee in the Senate. Introduced March 25, 2025. It must pass committee before a floor vote.

Next likely step: a committee vote, then a floor vote in the Senate.

Odds of enactment

Low chance

Based on the sponsor, cosponsors, and committee posture, this bill has a low chance of becoming law.

Upgrade to see the exact probability and what's driving it.

A statistical estimate from our own model of past outcomes — an insight, not a guarantee. Policymaking is volatile.

Prognosis

Advancing 42% · moderate confidence

  • In Committee

    Current position in the legislative process.

  • 6 sponsors

    2 primary, 4 co-sponsors signed on.

  • Bipartisan support

    Sponsored across 2 parties (4 D · 2 R) — cross-party backing.

Based on stage, sponsorship breadth, committee status, recorded votes, and cross-state momentum — a description of the observable signals, not a prediction.

Bill Text

What changed in the latest version

41 added · 42 removed

Plain-language change summary

In the latest version of Senate Bill 757, several definitions related to consumer data protection have been clarified and refined. Notably, the term "consent" has been explicitly defined, ensuring that consumers must take a clear affirmative action to indicate their agreement. This change is important because it aims to provide greater transparency and control for consumers regarding their personal data, making it harder for companies to misuse or assume consent without proper acknowledgment from the individual.

→
Previous
Latest
FILED SENATE GENERAL ASSEMBLY OF NORTH CAROLINA Mar 25, 2025 S.B.
GENERAL ASSEMBLY OF NORTH CAROLINA SESSION 2025 S 1 SENATE BILL 757 Short Title:
757 SESSION 2025 PRINCIPAL CLERK S D SENATE BILL DRS35255-LR-105A Short Title:
A BILL TO BE ENTITLED AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT OF NORTH CAROLINA.
Rules and Operations of the Senate March 26, 2025 A BILL TO BE ENTITLED AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT OF NORTH CAROLINA.
75F-4 is made by the consumer who is entitled to exercise those rights.
75F-4 is made bythe consumer who is entitled to exercise those rights.
*DRS35255-LR-105A* General Assembly Of North Carolina Session 2025 e.
*S757-v-1* General Assembly Of North Carolina Session 2025 e.
– An affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.
– An affirmative act bya consumer that unambiguouslyindicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.
Page 2 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 c.
Page 2 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 c.
– An individual who can be readily identified, directly or indirectly.
– An individual who can be readilyidentified, directly or indirectly.
(29) Publiclyavailableinformation.– Informationthataperson(i)lawfullyobtains from a record of a governmental entity, (ii) reasonably believes a consumer or widely distributed media has lawfully made available to the general public, or (iii) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.
(29) Publiclyavailableinformation.
–Informationthataperson(i)lawfullyobtains from a record of a governmental entity, (ii) reasonablybelieves a consumer or widely distributed media has lawfully made available to the general public, or (iii) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.
– The exchange of personal data for monetary consideration by the controller to a third party.
– The exchange of personal data for monetaryconsideration by the controller to a third party.
Considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a DRS35255-LR-105A Page 3 General Assembly Of North Carolina Session 2025 third party if the purpose is consistent with a consumer's reasonable expectations.
Considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a Senate Bill 757-First Edition Page 3 General Assembly Of North Carolina Session 2025 third party if the purpose is consistent with a consumer's reasonable expectations.
Page 4 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 (35) Third party.
Page 4 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 (35) Third party.
Information and documents created for purposes of the federal Health CareQuality Improvement Act of1986,42U.S.C.
Information and documents created for purposes of the federal Health CareQualityImprovement Act of1986,42U.S.C.
and DRS35255-LR-105A Page 5 General Assembly Of North Carolina Session 2025 2.
and Senate Bill 757-First Edition Page 5 General Assembly Of North Carolina Session 2025 2.
(8) Information originating from, and intermingled to be indistinguishable with, information under subdivision (7) of this subsection that is maintained by a (i) healthcarefacilityorhealthcareprovideror(ii)programoraqualifiedservice organization as defined in 42 C.F.R.
(8) Information originating from, and intermingled to be indistinguishable with, information under subdivision (7) of this subsection that is maintained bya (i) healthcarefacilityorhealthcareprovideror(ii)programoraqualifiedservice organization as defined in 42 C.F.R.
Aconsumer reporting agency,as definedin 15 U.S.C.
Aconsumer reportingagency,as definedin 15 U.S.C.
In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party to the extent the collection and use of the data are related to the individual's role;
In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third partyto the extent the collection and use of the data are related to the individual's role;
(c) A controller is in compliance with any obligation to obtain parental consent under this Chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C.
(c) A controller is in compliance with anyobligation to obtain parental consent under this Chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C.
Page 6 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 (d) This Chapter does not require a person to take any action in conflict with the federal Health InsurancePortabilityandAccountabilityActof1996,42U.S.C.
Page 6 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 (d) This Chapter does not require a person to take any action in conflict with the federal Health InsurancePortabilityandAccountabilityActof1996,42U.S.C.
If a controller extends the initial 45-day period, before the initial 45-day period expires, the controller shall (i) inform the consumer of the extension, including the length of the extension, and (ii) provide the reasons the extension is reasonably necessary.
If a controller extends the initial 45-dayperiod, before the initial 45-dayperiod expires, the controller shall (i) inform the consumer of the extension, including the length of the extension, and (ii) provide the reasons the extension is reasonably necessary.
(d) The 45-day period does not apply if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.
(d) The 45-dayperiod does not applyif the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.
However,acontrollermay charge areasonablefee to covertheadministrativecosts ofcomplying with a request or refuse to act on a request if:
However,acontrollermaycharge areasonablefee to covertheadministrativecosts ofcomplying with a request or refuse to act on a request if:
DRS35255-LR-105A Page 7 General Assembly Of North Carolina Session 2025 (1) The request is excessive, repetitive, technically infeasible, or manifestly unfounded;
Senate Bill 757-First Edition Page 7 General Assembly Of North Carolina Session 2025 (1) The request is excessive, repetitive, technically infeasible, or manifestly unfounded;
(b) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical datasecurity practices designedto protect theconfidentiality and integrity of personal data and reduce reasonably foreseeable risks of harm to consumers relating to the Page 8 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 processing of personal data.
(b) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical datasecuritypractices designed to protect theconfidentialityand integrity of personal data and reduce reasonably foreseeable risks of harm to consumers relating to the Page 8 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 processing of personal data.
Nothing in this subsection prohibits a controller from offering a different price, rate, level, quality, orselection ofagood orserviceto aconsumer,including offeringagoodorservice for no fee or at a discount, if the consumer has opted out of targeted advertising or the offer is related to the consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
Nothing in this subsection prohibits a controller from offering a different price, rate, level, quality, orselection ofagood orserviceto aconsumer,includingofferinga goodorservice for no fee or at a discount, if the consumer has opted out of targeted advertising or the offer is related to the consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
75F-4(a)(1)through (a)(3)donotapplytopseudonymous data if a controller demonstrates that any information necessary to identify a consumer is kept separately and subject to appropriate technical and organizational measures to ensure the personal data are not attributed to an identified individual or an identifiable individual.
75F-4(a)(1)through(a)(3)donotapplytopseudonymous data if a controller demonstrates that any information necessary to identify a consumer is kept separately and subject to appropriate technical and organizational measures to ensure the personal data are not attributed to an identified individual or an identifiable individual.
DRS35255-LR-105A Page 9 General Assembly Of North Carolina Session 2025 (a) The requirements described in this Chapter do not restrict a controller's or processor's ability to do any of the following:
Senate Bill 757-First Edition Page 9 General Assembly Of North Carolina Session 2025 (a) The requirements described in this Chapter do not restrict a controller's or processor's ability to do any of the following:
(8) Detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any illegal activity orinvestigate,report,orprosecuteapersonresponsibleforanactiondescribed in this subdivision.
(8) Detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or anyillegal activity orinvestigate,report,orprosecuteapersonresponsibleforanactiondescribed in this subdivision.
Page 10 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 (c) A controller or processor is not in violation of this Chapter if:
Page 10 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 (c) A controller or processor is not in violation of this Chapter if:
(1) Writtennoticeidentifyingeach provision ofthis Chapterthe Attorney General alleges the controller or processor has violated or is violating.
(1) Writtennoticeidentifyingeach provision ofthis Chapterthe AttorneyGeneral alleges the controller or processor has violated or is violating.
(g) If more than one controller or processor are involved in the same processing in violation of this Chapter, the liability for the violation shall be allocated among the controllers or processors in proportion to the comparative fault of each controller or processor.
(g) If more than one controller or processor are involved in the same processing in violation of this Chapter, the liabilityfor the violation shall be allocated among the controllers or processors in proportion to the comparative fault of each controller or processor.
(a) There is created a restricted account known as the "Consumer Privacy Account." The account shall be funded by money received through civil enforcement actions under this Chapter.
(a) There is created a restricted account known as the "Consumer Privacy Account." The account shall be funded bymoneyreceived through civil enforcement actions under this Chapter.
DRS35255-LR-105A Page 11 General Assembly Of North Carolina Session 2025 (b) Upon appropriation by the General Assembly, the account funds may be used by the Attorney General for these purposes:
Senate Bill 757-First Edition Page 11 General Assembly Of North Carolina Session 2025 (b) Upon appropriation by the General Assembly, the account funds may be used by the Attorney General for these purposes:
(a) The Attorney General and the Division shall compile a report evaluating the liability and enforcement provisions of this Chapter, including the effectiveness of the Attorney General's and the Division's efforts to enforce this Chapter and summarizing the data protected and not protected by this Chapter, including, with reasonable detail, a list of the types of information that are publicly available from State, local, and federal government sources.
(a) The Attorney General and the Division shall compile a report evaluating the liability and enforcement provisions of this Chapter, includingthe effectiveness of the AttorneyGeneral's and the Division's efforts to enforce this Chapter and summarizing the data protected and not protected bythis Chapter, including, with reasonable detail, a list of the types of information that are publicly available from State, local, and federal government sources.
Page 12 DRS35255-LR-105A
Page 12 Senate Bill 757-First Edition
⬇ Download PDF
View plain text versions (2)

Action History

  1. Passed 1st Reading

  2. Ref To Com On Rules and Operations of the Senate

  3. Filed

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

2 sponsors · 4 co-sponsors · 173 not signed on

Sponsors (2)

Co-sponsors (4)

Not signed on (173)

173 members have not signed on to this bill.

Show all 173 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

civil-rights technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 757?
SB 757 is sponsored by Michael Garrett (Democratic), Woodson Bradley (Democratic), Timothy D. Moffitt (Republican), Bobby Hanig (Republican), DeAndrea Salvador (Democratic), and Kandie D. Smith (Democratic).
What is the current status of SB 757?
This bill is in committee in the Senate. Introduced March 25, 2025. It must pass committee before a floor vote.
Where can I track SB 757?
Track SB 757 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 757

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 757

Last checked for changes 3 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →