Law / United States / 
North Carolina
HB 8, Pornography Age Verification Enforcement (PAVE) Act
N.C. Gen. Stat. ch. 66, art. 51, sections 66-500 to 66-501 (Session Law 2023-132)
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to commercial entities that knowingly publish or distribute material harmful to minors from a website where more than one third of the content meets that definition.
- Verify that visitors are 18 or older using a commercial database or another commercially reasonable method.no control in the NIST Privacy Framework
- Do not retain identifying information after access is granted.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Civil injunctions, compensatory and punitive damages, attorney fees, sought by private plaintiffs.
Who enforces it
Enforcement body
None (private civil action only); no designated state enforcement agency
Settledness
- As of
- Open questions
- Is the 'substantial portion' threshold in G.S. 66-500(b)(8), more than thirty-three and one-third percent of total material on a website, measured by number of items, number of pages or running time?
- Which methods other than 'a commercially available database that is regularly used by businesses or governmental entities' count as 'another commercially reasonable method of age and identity verification' under G.S. 66-501(a)?
What it reaches
Age threshold
18
Covered services
Commercial websites where more than one third of total material is harmful to minors
Obligation class
Age verification, Retention
Verification methods
Third party service, Transactional data
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- More than thirty-three and one-third percent (33 1/3%) of total material on a website, which meets the definition of material harmful to minors as defined in this subsection.
What it makes you log
Log retention
G.S. 66-501(b); subsection (d)(2) gives any person whose identifying information is retained in violation a civil action.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Any identifying information of the individual, after access has been granted to the material
Logging duty
G.S. 66-501(b), headed "No data retention", forbids the commercial entity or its third-party verifier to retain identifying information of the individual after access is granted, and subsection (d)(2) lets a person whose information was retained sue. The article names no record of the check.
- Kind
- None
- As of
What this law does
Commercial entities that knowingly publish or distribute material harmful to minors from a website where more than one third of the content meets that definition must verify that visitors are 18 or older using a commercial database or another commercially reasonable method. Providers may not retain identifying information after access is granted, and enforcement is solely through private civil suits by parents, guardians, or affected individuals.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .