language: en · status: in-force · last checked: 2026-09-18

North Carolina — student online protection (N.C.G.S. §§115C-401.2, 115C-402.5)

Two provisions of the North Carolina school law, both from S.L. 2014-50. §115C-401.2 is the SOPIPA-family operator statute, binding the vendor directly. §115C-402.5 governs the State's own student data system — what the State Board must do to secure it, and four categories that may not be collected into it at all.

Applicability to EdTech

§115C-401.2 binds an operator of a site, service or application used primarily for, and designed and marketed for, K-12 school purposes. Two duties are sharper than the SOPIPA baseline: security procedures must be appropriate to the nature of the covered information rather than merely industry-standard (§115C-401.2(c)(1)), and deletion on a school's request runs to a hard 45-day deadline (§115C-401.2(c)(2)) where most sibling statutes say only "within a reasonable time".

For anything feeding the State's student data system, note the outright collection bans in §115C-402.5(c) — biometric information, political affiliation, religion and voting history — which bite regardless of consent.

Key obligations at a glance

Operators — prohibitions (§115C-401.2(b))

• No targeted advertising on the operator's own service or, on the strength of K-12-derived information, anywhere else — (b)(1).
• No amassing a profile about a student except in furtherance of K-12 school purposes — (b)(2).
• No sale or rent of a student's information — (b)(3).
• No disclosure of covered information outside the six enumerated purposes — (b)(4).

Operators — requirements (§115C-401.2(c))

• Reasonable security procedures appropriate to the nature of the covered information — (c)(1).
• Delete covered information within 45 days of a school's or local board's request — (c)(2).

State data system (§115C-402.5)

• The State Board's security duties for the student data system — §115C-402.5(b).
• Biometric information, political affiliation, religion and voting history may not be collected into or reported as part of the system — §115C-402.5(c)(1)–(4).

Enforcement. A parent, school, teacher, local board or the State Board may report an alleged violation to the Attorney General, who may bring a civil action; the section creates no private right of action — §115C-401.2(g).

Contents

Licence

The reproduced text is N.C.G.S. §115C-401.2 and §115C-402.5, enacted by the North Carolina General Assembly and served by the General Assembly on ncleg.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

The reproduced pages carry no copyright notice or terms of use (checked 2026-10-01 against the live pages or the builder's cached copies).

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the North Carolina General Assembly endorses the corpus.

Related

• California SOPIPA — the model for §115C-401.2
• Illinois SOPPA — the same family, extended to schools and made public by publication
• Florida §1006.1494 — the closest sibling with its own deletion deadline
• COPPA · FERPA — the federal regimes §115C-401.2(f) preserves

Sources

• N.C.G.S. §115C-401.2
• N.C.G.S. §115C-402.5