Law / United States / 
South Carolina
Age-Appropriate Design Code, sensitive personal data and biometric data
S.C. Code Ann. sec. 39-80-10(18) (Act No. 96 of 2026, H. 3431)
In force since , under challenge in court.
A sensitive categories rule binding private bodies.
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Treat biometric data processed to uniquely identify a minor as sensitive personal data requiring this chapter's heightened, minor-protective design duties.
- Do not assume a recording-derived faceprint or voiceprint is excluded from 'biometric data' here. The chapter never defines the term, so no exclusion or clawback can be confirmed either way from the statutory text.
- Do not treat a minor's biometric data collected without the minor's knowledge as publicly available data, even if drawn from an otherwise public source.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
NetChoice, LLC v. Wilson, No. 3:26-cv-00543 (D.S.C.), challenges the Act, and NetChoice moved for a preliminary injunction on .
- As of
- Under challenge
- Yes
- Open questions
- Does "biometric data for the purpose of uniquely identifying an individual" in Section 39-80-10(18)(g) reach a faceprint or voiceprint derived from a photograph, video or audio recording, when Section 39-80-10 defines no term "biometric data"?
- When is biometric data "collected by a covered online service about a minor without the minor's knowledge" under Section 39-80-10(16)(b), and whose notice or consent supplies the minor's knowledge?
What it makes you log
Logging duty
Section 39-80-10(18) only defines sensitive personal data (identifiers, account credentials, precise geolocation, origin and belief categories, message contents, genetic data, biometric data and health data) for the other sections of Chapter 80. It requires no log or record, names no audit, and gives no party a right to a record. The paragraph states no territorial clause. The chapter's reach clause, the definition of a covered online service as one that conducts business in this State (39-80-10(4)(a)), is in another paragraph this row does not cite.
- Kind
- None
- As of
What this law does
Chapter 80 defines sensitive personal data to include a Social Security number, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of an individual's mail, email, or text messages, genetic data, biometric data for the purpose of uniquely identifying an individual, and health data.
'Biometric data' itself is never defined anywhere in the 30,353-character enacted text; the term appears exactly twice, once in this sensitive-data list and once in the publicly-available-data carve-out below, with no accompanying definitional entry among the chapter's twenty defined terms.
Whether the term excludes an identifier derived from a photograph, video, or audio recording therefore cannot be determined from the statutory text; there is no definitional clause to read as imposing or narrowing such an exclusion.
A narrower, separate carve-out excludes only 'biometric data collected by a covered online service about a minor without the minor's knowledge' from the chapter's definition of publicly available data, which does not address an adult's biometric data, or a knowingly collected minor's, drawn from a public recording.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .