Law / United States / 
North Carolina
HB 805, Prevent Sexual Exploitation of Women and Minors Act
N.C. Gen. Stat. ch. 66, art. 51A, sections 66-505 to 66-510 (Session Law 2025-84)
In force since .
An adult content age verification (AV) rule binding private bodies.
- Age threshold
- 18
- Covered services
- Websites and mobile apps that publish or distribute pornographic images
- Obligation class
- Age verification, Consent, Disclosure
- Verification methods
- Gov ID
- Audit expectation
- on_request
- Who audits it
- Self
What it requires
- Applies to operators of websites and apps that publish pornographic images; the age check is on the people depicted, not on visitors.
- Before publication, verify that every individual depicted was at least 18 when the image was created and gave explicit written consent to each act and to distribution, backed by a signed consent form and matching government-issued identification.NIST Privacy FrameworkCT.PO-P1
- Display removal instructions.NIST Privacy FrameworkCM.AW-P1
- Remove an image within 72 hours of a request from a depicted individual or law enforcement.NIST Privacy FrameworkCT.PO-P3
- Block removed images from re-publication.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Attorney General civil penalties up to $10,000 per day per image after notice; private civil actions for $10,000 per day per image or actual damages, plus attorney fees.
Penalty structure
Attorney General civil penalty under G.S. 66-509(b)-(d), accruing on a per day and per image basis beginning 24 hours after the Attorney General gives notice: up to $10,000 per day per image against an online entity operator that violates the Article (including the verification duty in G.S. 66-506), G.S. 66-509(c) repeats the $10,000 ceiling for a violation of the notice-display duty in G.S. 66-507(b), and G.S. 66-509(d) sets a lower cap of up to $5,000 per day for a violation of the 72-hour removal duty in G.S. 66-507(c). Proceeds are remitted to the Civil Penalty and Forfeiture Fund.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 10,000
Over one month of continuous breach, USD 304,400.
Statutory damages
Available to an eligible person (the individual depicted, or an authorized representative) in a private civil action against the operator (G.S. 66-509(g)) or against a user of the online entity who violates the Article (G.S. 66-509(h)): $10,000 for each day a pornographic image remains on the online entity in violation, calculated on a per day and per image basis, or actual damages, whichever is greater. A prevailing eligible person is also awarded attorney fees.
- As of
- Currency
- USD
- Per person minimum
- 10,000
Who enforces it
Enforcement body
North Carolina Attorney General, plus private civil actions by depicted individuals or their representatives
Settledness
- As of
- Open questions
- Is a platform that hosts user-uploaded pornographic images, but whose website does not contain a 'substantial portion' of material harmful to minors, an 'online entity operator' under G.S. 66-505(b)(8)?
- Does G.S. 66-506, which Section 2.(b) of Session Law 2025-84 applies to 'acts or omissions occurring before, on, or after' , require an operator to hold the written consent and identification described in G.S. 66-506(c) for a pornographic image that was created and published before that date and remains on the online entity?
What it makes you log
What the log must hold
Affected person reference, Consent or opt-out state, Age assurance result
Logging duty
Section 66-506(c) requires an online entity operator to obtain, for each person in a pornographic image, a written consent form and one valid government identification, and section 66-507(d)(1) refers to "the records of the operator" that the operator must review when someone asks it to remove an image. The article states no retention period. The Attorney General's penalty power (section 66-509) carries no stated power to demand the records.
- Kind
- Explicit
- As of
- Provision
- N.C. Gen. Stat. § 66-506(c) and § 66-507(d)(1)
- Trigger
- age_assurance
- consent_or_optout
What this law does
Operators of websites and apps that publish pornographic images must verify, before publication, that every individual depicted was at least 18 when the image was created and gave explicit written consent to each act and to distribution, backed by a signed consent form and matching government-issued identification.
Operators must display removal instructions, remove images within 72 hours of a request from a depicted individual or law enforcement, and block removed images from re-publication; this regulates verification of people appearing in content rather than website visitors. The act was enacted over the Governor's veto on .
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .