Amends Article 29 of GS Chapter 115C, adding a new section, GS 115C-402.10, as the title indicates.

Provides definitions for terms as they apply in this section. Identifies an eligible student as one who has reached the age of 18 years; defines personally identifiable student data as defined in GS 115C-402.5(a)(4); and defines online service as an Internet website, online service, instructional software or application, mobile application, or cloud computing service designed, marketed, and used for public school purposes. Provides additional terms and definitions, including a definition for student-centered content as materials created by a student such as audio files, essays, research reports, portfolios, creative writing, music, photography, audio files, and account information that enables ongoing possession and control by the student.

Defines an operator as the operator of an online service with actual knowledge that the online service is used for public school purposes. Specifies the requirements for operators to (1) implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information; (2) to protect such information from unauthorized access, destruction, use, modification, or disclosure; and (3) delete a student's covered information when requested.

Subsection (c) of GS 115C-402.10 prohibits an operator from engaging in any of the following activities with its online service: (1) targeted advertising when it is based on any covered information; (2) use of covered information to discriminate or allow discrimination against a student; (3) sale of covered information; and (4) knowing disclosure of covered information, but provides specified exceptions to that disclosure. Defines covered information as meaning personally identifiable student data or student records in any media format that is created or provided by a student, the student's parent or legal guardian, an employee or agent of the public school or local school administrative unit to an operator or information gathered by an operator via operation of an online service. Makes engaging in any of the prohibited actions specified under this subsection punishable as provided in GS 115C-401.1(c) and GS 115C-401.1(d).

Provides additional specifications permitting an operator's internal use of information, contracts for online services including the required provisions of such contracts, and the use of student covered information when the student's identity is not included. Provides that noncompliant contracts under the requirements of this section are void. Sets out the limits of the application of the provisions in this act.

Provides that if the provisions of this section conflict with the terms of a contract in effect before July 1, 2015, the provisions of this statute do not apply to the local board of education or the operator subject to the contract until the expiration, amendment, or renewal of the contract.

Makes this act effective July 1, 2015.