NC S624: AI Chatbots - Licensing/Safety/Privacy

In one paragraph

North Carolina's S 624 (as filed) would require a Department of Justice license to operate or distribute a chatbot that deals substantially with health information, with a $50,000 civil penalty for violating G.S. 114B-5. It would also create a Chatbot Safety and Privacy Act: covered platforms would owe users a duty of loyalty and would have to disclose that a chatbot is not human, get consent each session and de-identify user data. Filed March 25, 2025 and referred to the Senate Rules and Operations Committee; it has not passed either house.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, health-information chatbot providers would need a license and chatbot platforms would face disclosure, consent and data-privacy duties.

Key provisions

1. 1Part I (Chatbot Licensing Act, G.S. 114B) would bar operating or distributing a chatbot that deals substantially with health information without a health information chatbot license from the Department of Justice.
2. 2Licensees would need professional liability insurance, security audits at least every six months, breach reports within 24 hours to the Department and 48 hours to affected consumers, and an annual third-party audit.
3. 3Any person violating G.S. 114B-5 would face a civil penalty of $50,000.
4. 4Part II (Chatbot Safety and Privacy Act, G.S. 170) would apply to covered platforms: those serving North Carolina users with over $100,000 annual gross revenue or over 5,000 monthly active U.S. users, excluding some educational, research and government uses.
5. 5Covered platforms would owe a duty of loyalty, including emergency-situation systems, and would have to clearly tell users the chatbot is not human and get affirmative consent at the start of each session.
6. 6Covered platforms would have to de-identify user-related data before storage and analysis; chatbots used in healthcare, financial services, legal, government services, mental health support and education would have to use self-destructing messages with a 30-day destruction period.
7. 7The Attorney General could sue; users injured by a violation could sue for the greater of actual damages or $1,000 per violation plus attorneys' fees. Both Parts are written to take effect January 1, 2026.
8. 8Status: referred to Senate Rules and Operations on March 26, 2025; not passed by either chamber.

Latest legislative action

Mar 26, 2025. Ref To Com On Rules and Operations of the Senate