Your ideas.
Not your identity.

Reviewed October 26, 2026. 57 named organizations: 12 government · 2 business · 14 k–12 education · 27 higher education · 2 healthcare. North Carolina organizations with published AI-specific privacy limits, including policies, official guidance and recommendations, approved-tool requirements, supplier rules, and a clinical AI-device restriction. Not a census or a count of blanket bans. One entry per named organization, not per rule, school, department, branch, or facility. Department-specific rules are labeled and counted once under their parent organization. State agencies are included only with separately cited publications; no other agencies are inferred from statewide coverage. The UNC System Office is counted only for its own administrative operations, separately from the universities. Advocate Health and its Atrium Health operations count as one organization.

Government · 12

• North Carolina Department of Information Technology ↗Published guidance prohibits personal or confidential information in public generative AI. Counted once, not once per covered agency.
• North Carolina Department of Health and Human Services ↗Its own September 2025 acceptable-use policy bars PII and confidential information from public AI tools and requires approval for installing public/free AI.
• Town of Nags Head ↗July 2026 personnel policy, page 38: employees must not put sensitive or confidential data into public generative AI; connecting town systems or data requires IT review.
• North Carolina Department of Commerce ↗The Division of Community Revitalization's PII policy bars PII in generative AI without explicit authorization and applicable security controls. Counted once for Commerce; the cited scope is DCR programs and partners.
• Buncombe County ↗The April 2026 acceptable-use policy allows only County-approved AI for work and prohibits putting PII, PHI, or criminal justice information into AI systems.
• City of Charlotte ↗Charlotte-Mecklenburg Police Department directive 800-001 prohibits employees from entering confidential information into third-party AI. Counted once for the city; the cited restriction applies to CMPD.
• Town of Cary ↗March 2026 independent-auditor RFP 354-FN26-23, page 52: published contractor terms prohibit using Cary data or derivatives with AI or machine learning. A procurement restriction, not a blanket employee AI ban.
• North Carolina Judicial Branch (Cabarrus Superior Court) ↗Cabarrus Superior Court Administrative Order 25-09, filed December 8, 2025, restricts confidential, privileged, sealed and other protected information in public AI absent reliable data-handling assurances. District-specific order; no other courts or law firms inferred.
• North Carolina State Bar ↗2024 Formal Ethics Opinion 1 requires lawyers to protect client confidentiality and use sufficiently secure AI; it advises generally avoiding client-specific information in public AI. Counted once as the issuing regulator, not as a count of law firms or an employee ban.
• City of Greensboro ↗City IT guidance prohibits uploading confidential information, PII, login credentials and city operational documents to AI chatbots; it also prohibits using chatbots to find private information about employees or residents.
• Union County ↗Employee guidance published through Centralina Regional Council bars employee information, software code and county proprietary data from ChatGPT and similar tools. A September 2025 county bulletin confirms updated guidance remains in use; this public copy predates that update.
• North Carolina Department of Public Instruction ↗Its January 2024 published school implementation guidance instructs users not to type, paste or upload PII into generative AI, including student IDs. Counted once as the issuing agency’s recommendations; no additional school districts are inferred from statewide reach.

Business · 2

• Truist ↗Supplier security specifications prohibit putting Truist or client sensitive information into a third-party vendor's open-source generative AI tool. This is a supplier restriction, not a blanket employee ban.
• SAS Institute ↗The Cary-headquartered company’s published employee GenAI policy summary requires privacy protection, safeguards for confidential information, and review of AI capabilities before onboarding. Counted as privacy and approval controls, not a prohibition on all AI use.

K–12 education · 14

• Wilkes County Schools ↗District guidelines say PII, confidential information, and sensitive information must never be entered into generative AI tools or large language models.
• Charlotte-Mecklenburg Schools ↗District guidance prohibits confidential or sensitive information, including student data, in AI systems unless specifically approved for that purpose with required privacy and security controls.
• Winston-Salem/Forsyth County Schools ↗The January 2026 district announcement limits secondary students to selected AI platforms meeting district safety, data privacy, and appropriate-use requirements. This is conditional access, not a blanket ban.
• Stokes County Schools ↗Policy 3221 directs students and staff never to enter their own or others' personal information into generative AI and requires checking tool compliance with technology staff.
• McDowell County Schools ↗Staff AI guidance directs educators to avoid entering PII or confidential information, including student and staff information, into AI systems.
• Pamlico County Schools ↗District AI literacy guidance directs users to avoid PII or confidential information in AI systems, including contact details, demographics, and rosters.
• New Hanover County Schools ↗District guidance prohibits confidential information and PII in generative AI, prohibits unapproved wearable/ambient AI, and disallows agentic AI on district-connected accounts because of student-data concerns.
• Wake County Public School System ↗The district's Library Media Services May 2026 guidance says entering PII into AI tools is not recommended. Counted as an official privacy recommendation, not a binding prohibition.
• Ashe County Schools ↗District guidance limits AI feedback submissions to work without personally identifiable information. Its published AI dashboard also reproduces state guidance against entering PII.
• Cabarrus County Schools ↗District AI guidelines tell students not to enter personal information into AI platforms and prohibit violating privacy by entering personal or sensitive data. Approved tools and assignment-specific permission are also required.
• Camden County Schools ↗The 2025–26 handbook’s AI guidelines, printed page 69, advise avoiding sensitive data such as student IDs, grades, signatures and account credentials in AI tools. Users must review data practices and consult district technology staff when security is uncertain.
• Granville County Public Schools ↗The district’s AI FAQ says tools collecting unnecessary personal information are not allowed. AI tools undergo data-privacy, bias and educational-value review before approval, alongside district privacy requirements.
• Greensboro Day School ↗School AI guidance permits only vetted services, requires data minimization and prohibits sharing PII under its responsible-use policy. It identifies a limited allowance for necessary student names in approved tools using school accounts.
• Durham Academy ↗Its published faculty/staff AI framework marks sensitive-data handling and surveillance as high-risk “Red Light” uses to avoid. Counted as official risk guidance, not a blanket AI ban.

Higher education · 27

• NC State University ↗Sensitive-data use depends on approved tools; other uses of Red or Purple data require an IT purchase compliance review.
• North Carolina A&T State University ↗Confidential data is prohibited in generative AI; sensitive data requires approved tools, department authorization, and anonymization where possible.
• Duke University ↗Only public-classified data may be submitted to public AI tools. This university source excludes Duke University Health System.
• Central Piedmont Community College ↗Restricted or sensitive information cannot enter public or unapproved AI tools. Sensitive-data use in approved platforms still requires applicable IT approval.
• Appalachian State University ↗Guidance bars sensitive or confidential information from AI chat interfaces not approved for that data and restricts unauthorized tools.
• UNC Charlotte ↗The security checklist directs users not to enter confidential, legally restricted, or Level 3 university data into AI tools.
• UNC Greensboro ↗Sensitive and nonpublic data require the stated exceptions or written review and approval; unapproved AI tools must not receive protected information.
• East Carolina University ↗Protected institutional data requires approved tools or locally operated tools on ECU-managed devices; ChatGPT research use requires case-specific approval.
• UNC Wilmington ↗Responsible-use guidance directs users to avoid entering sensitive or regulated university data into publicly available AI tools.
• Western Carolina University ↗The student guide describes limits on sensitive and FERPA-protected information in AI systems and use of university-approved tools with privacy protections.
• Winston-Salem State University ↗Published guidance says never to enter confidential, sensitive, or FERPA-protected information into AI tools while broader institutional guidelines are being developed.
• Fayetteville State University ↗Copilot Chat approval covers only data tiers 0 and 1; confidential and restricted data are not approved.
• UNC Pembroke ↗Section 4.6 prohibits university protected or sensitive data in public AI without express authorization and requires appropriate risk assessment.
• Wake Technical Community College ↗College policy requires written CIO consent before confidential institutional or FERPA-protected student data is submitted to, ingested by, or used to train generative AI.
• Durham Technical Community College ↗The AI section directs both employees and students to avoid putting personal, confidential, or sensitive data into public AI tools.
• Elon University ↗AI data-security guidance requires the data owner's permission before confidential information or sensitive university data is shared.
• Wake Forest University ↗Guidance directs users to approved tools for university data and prohibits pasting sensitive student, personal, medical, or research data into free or personal AI accounts.
• Davidson College ↗Internal and restricted data require college-provided platforms; confidential data requires Information Security review. The policy was last reviewed in March 2026.
• North Carolina Central University ↗ITS guidance prohibits confidential and highly restricted data in AI tools, requires approved tools for university work, and bars personal AI accounts from processing university data.
• University of North Carolina at Chapel Hill ↗Staff guidance requires Information Security risk assessment and Data Governance Oversight Group approval before sensitive information may enter a generative AI tool.
• UNC System Office ↗The System Office's Amplify rules prohibit protected identifiers, financial account information, and HIPAA-, GLBA-, and CJIS-protected data. Counts the administrative office only, separately from universities.
• Alamance Community College ↗Its academic AI guide directs students and faculty never to enter confidential or personal data into AI tools.
• Beaufort County Community College ↗Policy 6.28 prohibits staff and faculty from processing sensitive college data in unauthorized AI/cloud services and prohibits AI recording of meetings.
• Carteret Community College ↗Policy 5.19, approved May 2026, bars confidential, regulated, proprietary, or otherwise protected data from public AI tools.
• Rowan-Cabarrus Community College ↗The college library's AI safety guidance directs users not to share personal, confidential, or sensitive information with AI. This is published guidance, not a campus-wide AI ban.
• Asheville-Buncombe Technical Community College ↗Radiography clinical procedures prohibit AI-enabled or recording-capable wearables in clinical and confidential areas because of PHI capture risks. This is a program/device restriction; Cloak does not address wearable recording.
• Campbell University ↗The School of Osteopathic Medicine's published 2025–26 bulletin permits course-content uploads only to Campbell-authenticated Copilot, citing intellectual property and data privacy. It prohibits those uploads to open AI systems; scope is that school.

Healthcare · 2

• Advocate Health (including Atrium Health) ↗The enterprise Code of Conduct prohibits unapproved generative AI tools from interacting with confidential or restricted data. Counted once for the parent organization, including its NC Atrium Health operations; not once per hospital.
• Labcorp ↗February 2026 Code of Conduct, page 18: employees may use only AI tools vetted for privacy, security, and protection of sensitive and personal information. Burlington-headquartered company; no global employee count is added.

Population subtotal · 14 universities

267,382 student enrollments across 14 cited universities. Fall 2025 enrollment subtotal for 14 explicitly sourced universities only. Not the number blocked from AI, unique NC residents, actual Cloak users, or a deduplicated population. Excludes employees and all organizations without a selected enrollment figure. The UNC System figures are preliminary; all selected counts refer to fall 2025.

NC State University: 39,259 · North Carolina A&T State University: 15,275 · Duke University: 17,325 · Appalachian State University: 21,798 · UNC Charlotte: 32,207 · UNC Greensboro: 18,682 · East Carolina University: 27,153 · UNC Wilmington: 19,895 · Western Carolina University: 11,845 · Winston-Salem State University: 4,972 · Fayetteville State University: 7,623 · UNC Pembroke: 8,089 · North Carolina Central University: 9,160 · University of North Carolina at Chapel Hill: 34,099.

If everyone used Cloak

If every student represented by the 267,382 enrollments used ChatGPT with Cloak: 267,382 × 4.28 prompts/day × 8.5% = approximately 97,274 sensitive prompts per day, or 35,504,854 per year at the same daily rate. An illustrative full-use scenario, not observed adoption or measured prevention. It treats each enrollment as one user, assumes institutionally permitted use, and holds both study rates constant. The population is not deduplicated. Cloak can reduce exposure of identifiers it detects; the share of these sensitive messages it could fully protect has not been measured. This is not a compliance guarantee.

Epoch AI reports 4.28 prompts per calendar day among weekly active panelists in July 2025, from a selected US YouGov panel of 5,000 people who used ChatGPT in 2026. Harmonic found sensitive information in 8.5% of tens of thousands of business prompts across five AI tools in Q4 2024. Its nearly-one-in-ten finding covers customer, employee, legal/financial, security and code data, not PII alone. Combining these different populations gives a scenario, not a measured NC student rate. Annual volume uses 365 days and is rounded only after multiplication. No byte-size or detection-success assumption is made. Epoch AI: prompt frequency ↗ · Harmonic: sensitive prompt study ↗

No count is assigned to unnamed organizations, academic-integrity-only bans, or historical media reports without sufficiently current qualifying evidence. Recommendations and limited-scope rules are identified explicitly. Inclusion does not imply Cloak can satisfy or remove a rule: approved-tool, clinical-device, and other requirements remain applicable. Listed organizations are not represented as Cloak customers, partners, endorsers, or adopters. Truist confirms its Charlotte headquarters. Download the source register ↗