North Carolina website legal requirements

No single North Carolina statute is titled 'website requirements'. Instead, a business site sits where several ordinary laws meet — laws about what businesses may claim, about access for disabled customers, about personal data, and about selling at retail. Here are the ones we have read at the source, grouped by the question each answers.

What you may say. The state's broadest commercial rule (G.S. 75-1.1 — unfair or deceptive acts unlawful) is simple: unfair methods of competition and unfair or deceptive acts in or affecting commerce are unlawful. A website is commerce, so testimonials, awards, 'licensed and insured' badges and statistics on it must all be true. Federally, the FTC's truth-in-advertising rules require claims to be truthful and evidence-based, apply to internet advertising as to every other medium, and treat bait-and-switch — advertising something you do not intend to sell — as illegal.

Who must be able to use it. The Justice Department's position is that the ADA applies to websites of public-facing businesses: Title III for businesses open to the public, Title II for state and local government. For private businesses there is no binding DOJ technical standard, and the Department points to WCAG. For public entities there now is: the 2024 rule sets WCAG 2.1 Level AA, with compliance dates in April 2027 or April 2028 depending on population, and it applies even when a private web design company built and maintains the page. Dare County's own site offers services from permits and parcel data to occupancy taxes online — the kind of workflow the rule covers.

What data you hold. The state's definition (G.S. 75-66 — what counts as personal information) treats as protected personal information as a name combined with items such as a Social Security, driver's licence or passport number, account or card numbers, a PIN, biometric data or passwords. Under G.S. 75-65, a breach of that information requires notice to affected residents without unreasonable delay. And under G.S. 75-64, a business holding it must protect it at and after disposal, including electronic records. A site that collects less has less to protect.

Whether you sell. Before selling at retail, a business needs a certificate of registration from the Department of Revenue under G.S. 105-164.29, and the state's general rate is 4.75 percent before local add-ons. That applies to what your store sells; it is a separate step from forming your company.

Whether children use it. If the site is directed at children under 13, COPPA requires a privacy policy even when nothing is collected.

Truthful claims, an accessible site, careful data handling, and registration before retail sales. None of it is exotic, and all of it is cheaper to build in than to fix after a complaint.