South Carolina

2025 Act No. 58 (S.29), effective May 22, 2025, added a definition of 'morphed image' at Section 16-15-375(8), covering any visual depiction, including a computer or computer-generated image, that has been created, adapted, or modified to appear that an identifiable minor is engaged in sexual conduct or sexually explicit nudity.

The same act inserted that term into South Carolina's first, second, and third degree sexual exploitation of a minor offenses (Sections 16-15-395, 16-15-405, 16-15-410), so that producing, distributing, or possessing a morphed depiction of an identifiable minor is punished the same as a real photograph of that minor.

The act also added Section 16-15-412, restricting an arrest warrant for a morphed-image offense to one issued on a state grand jury true bill or a probable-cause finding from an Internet Crimes Against Children Task Force investigation conducted with the Attorney General's Office.

A person conducting business in South Carolina that owns or licenses computerized data including personal identifying information must disclose a breach of the security of the system to an affected South Carolina resident in the most expedient time possible and without unreasonable delay, where the breach creates a material risk of harm.

Personal identifying information is name plus a Social Security number, driver's license or state ID number, a financial account number with access credential, or another government-issued identifying number; biometric, genetic, or health data is not folded into this definition. If a business notifies more than 1,000 persons at one time, it must also notify the Consumer Protection Division of the Department of Consumer Affairs and nationwide consumer reporting agencies.

The current definition of personal identifying information took effect April 23, 2013; the notification duty itself took effect July 1, 2009. A resident injured by a violation may bring a civil action for damages (willful and knowing violations) or actual damages (negligent violations), seek an injunction, and recover attorney's fees, an express, direct private right of action rather than one reached indirectly through a deeming clause.

An administrative fine of $1,000 per affected resident is also available to the Department of Consumer Affairs for a knowing and willful violation.

The Age-Appropriate Design Code applies to a covered online service reasonably likely to be accessed by a minor (a person under 18). It is not a general controller or processor personal-data regime; it imposes design and data-minimization duties specifically toward minor users, including default privacy settings, limits on profiling, targeted advertising, and precise-geolocation collection for known minors, parental controls, and an annual public report by an independent auditor.

The Act was enacted as Act No. 96 of 2026 (H. 3431, the South Carolina Social Media Regulation Act on its own caption) and creates Chapter 80 of Title 39; it took effect immediately upon the Governor's approval on February 5, 2026. It is not to be confused with H. 3402, a different, still-pending bill sharing the short title 'Age-Appropriate Design,' which would have created Chapter 79 and never advanced past referral to House Judiciary.

The consolidated online Code of Laws has not yet published Chapter 80; the session-law text of Act No. 96 is the authoritative current source.

The Attorney General enforces Chapter 80. A covered online service is liable for treble the financial damages incurred as a result of a violation, and officers and employees of a covered online service may be held personally liable for willful and wanton violations.

The 30,353-character enacted text does not resolve whether the treble-damages remedy is available to a private plaintiff or is confined to a suit the Attorney General brings: no clause reads that an injured person may bring a civil action, the phrasing South Carolina's breach statute uses to grant one, and no clause reads that the chapter creates no private right of action, the phrasing Pennsylvania's and West Virginia's comparable proposed and dead bills use to foreclose one.

Whether a private right of action exists is therefore left unrecorded for this instrument; the treble-damages and personal-liability clauses read most naturally as remedies within the Attorney General's own suit given the enforcement section's framing naming only the Attorney General, and no construing case settles it.

Chapter 80 defines sensitive personal data to include a Social Security number, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of an individual's mail, email, or text messages, genetic data, biometric data for the purpose of uniquely identifying an individual, and health data.

'Biometric data' itself is never defined anywhere in the 30,353-character enacted text; the term appears exactly twice, once in this sensitive-data list and once in the publicly-available-data carve-out below, with no accompanying definitional entry among the chapter's twenty defined terms.

Whether the term excludes an identifier derived from a photograph, video, or audio recording therefore cannot be determined from the statutory text; there is no definitional clause to read as imposing or narrowing such an exclusion.

A narrower, separate carve-out excludes only 'biometric data collected by a covered online service about a minor without the minor's knowledge' from the chapter's definition of publicly available data, which does not address an adult's biometric data, or a knowingly collected minor's, drawn from a public recording.

Sections 16-16-10 through 16-16-40 make it unlawful to wilfully, knowingly, and maliciously access a computer, computer system, or computer network without authorization or for an unauthorized purpose to devise a scheme to defraud, obtain money or property by fraud, commit another crime, or to alter, damage, destroy, or modify data, programs, software, or operation, or introduce a computer contaminant; a separate misdemeanor, computer hacking, reaches unauthorized access, port scanning, or exceeding a granted permission regardless of financial gain or loss.

The offense is graded in three degrees by the dollar amount of gain or loss, from a felony (first degree, gain or loss exceeding ten thousand dollars) down to a misdemeanor (third degree, gain or loss of one thousand dollars or less, or computer hacking alone), and each computer, system, or network affected by a violation is a separate offense.

The owner or lessee of an affected computer system may also bring a civil action for compensatory damages, restitution, and attorney's fees, but only against a person already convicted under this chapter.

Requires a commercial entity that knowingly publishes material on a website, more than one third of which is material harmful to minors, to perform reasonable age verification of South Carolina visitors using a digitized identification card, a third party verification service, or a commercially reasonable method relying on transactional data.

Requires online services reasonably likely to be accessed by minors to set protective default privacy settings for known minors, offer opt outs from personalized recommendation systems, limit addictive design features and nighttime and school hours notifications, and undergo independent third party audits reported to the Attorney General. NetChoice sued days after enactment and a preliminary injunction motion is pending.