AI and data laws

Moving311Enacted704

311 moving · 704 enacted

Data

202 on file · 147 became law · 33 still moving · 5 moved in 30 days

China
Chinaunverified

AI Legislation

China proposed rules governing artificial intelligence that span data, computing, algorithms, deepfakes, and privacy.

Proposed
Canada
Canadaunverified

EU-Canada Digital Trade Agreement

The agreement facilitates cross border data flows and strengthens regulatory cooperation between Canada and the European Union.

Adopted
European Union
European Unionunverified

Digital Legislation Overhaul Package

The Council of the European Union agreed on its negotiating position regarding updates to data protection, cookie, data sharing, and incident reporting rules.

Passed one chamber
United States (federal)
United States (federal)unverified

GSA LLM Clause

The General Services Administration issued a procurement clause barring language models from training on government data.

In force
Delaware
DelawareHB 380

Delaware Personal Data Privacy Act Amendments

Amends the Delaware Personal Data Privacy Act to align it with other states' laws, including lowering the applicability threshold to entities processing data of at least 15,000 consumers.

Enacted
United States (federal)
United States (federal)H.R. 10616

Public Access to HHS Health Data Act of 2026

A House bill in Congress, now in committee. Latest step: Referred to the Committee on Energy and Commerce, and in addition to the Committees on Ways and Means, Education and Workforce, and Natural Resources, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the c.

In committee
United Nations
United NationsA/RES/79/243

UN Convention against Cybercrime

A global treaty requiring parties to criminalize certain offences committed through information and communications technology systems and to cooperate on sharing electronic evidence of serious crimes, which enters into force 90 days after the 40th ratification.

Adopted
United States (federal)
United States (federal)H.R. 10578

To authorize certain labor market data collection activities and to improve Federal measurement of the workforce impacts of artificial intelligence, and for other purposes.

A House bill in Congress, now in committee. Latest step: Referred to the Committee on Education and Workforce, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

In committee
Japan
JapanAct No. 56 of 2026

Act on the Protection of Personal Information Amendment

Amends Japan's personal information law to allow data sharing without consent for statistics and AI development, strengthen protections for children under 16 and facial feature data, and introduce administrative surcharges for serious violations.

In force
European Union
European UnionRegulation (EU) 2023/2854

Data Act

Sets rules on who can access and use data generated by connected products and related services, on business-to-government data sharing in exceptional need, and on switching between cloud and data processing services.

In force
South Korea
South KoreaAct No. 21445

Personal Information Protection Act Amendment

Amends PIPA after large data breaches to make company heads ultimately responsible for data protection, require notice of possible breaches, mandate privacy certification for large handlers, and allow fines of up to 10 percent of total revenue for repeated or massive violations.

In force
California
CaliforniaSB 362

Delete Act

Requires data brokers to register with the California Privacy Protection Agency and to process consumer deletion requests submitted through a single state-run deletion mechanism.

In force
European Union
European UnionRegulation (EU) 2022/1925

Digital Markets Act

Sets obligations and prohibitions for large online platforms designated as gatekeepers, such as bans on self-preferencing and anti-steering, and requirements on interoperability and data use.

In force
Hawaii
HawaiiHB 1753

Relating to Social Media (account deletion)

Requires certain social media platforms to let users delete their accounts and permanently erase associated personal information, and bars deceptive practices that obstruct deletion.

Enacted
United States (federal)
United States (federal)No. 25-112

Chatrie v. United States

The Supreme Court held that police conducted a Fourth Amendment search when they obtained a suspect's Google location history through a geofence warrant, and vacated and remanded the Fourth Circuit's judgment.

Ruled
Pennsylvania
PennsylvaniaHB 78

Consumer Data Privacy Act

Would create a comprehensive consumer data privacy law giving Pennsylvanians rights to access, correct, delete and opt out of the sale of their personal data.

Passed one chamber
Canada
CanadaBill C-22 (45th Parliament, 1st Session)

Lawful Access Act, 2026

Government bill giving law enforcement new tools to obtain subscriber information and other data from electronic service providers in investigations.

Passed one chamber
Massachusetts
MassachusettsS 2619

Massachusetts Data Privacy Act

Would create a comprehensive consumer data privacy law with data minimization rules and limits on selling sensitive data such as location data; the Senate passed S.2619, the engrossed version of S.2516 and S.2608, and the House passed its own amended text.

Passed both
Canada
CanadaBill C-36 (45th Parliament, 1st Session)

Protecting Privacy and Consumer Data Act (Bill C-36)

Government bill that would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA to modernize federal private sector privacy law, including protections for children's data.

Introduced
United States (federal)
United States (federal)S. 4742

AI DATA Act

A Senate bill in Congress, now in committee. Latest step: Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

In committee
New York
New YorkA 9349-B / S 8623-B

Surveillance Pricing Prohibition

Would ban using algorithms and consumers' personal data to charge different customers different prices for the same goods or services, with exceptions such as loyalty programs.

Passed both
Ohio
OhioHB 801

Ohio Privacy Act

Would enact the Ohio Privacy Act, a comprehensive consumer data privacy law.

In committee
Minnesota
MinnesotaHF 3794unverified

Ban on surveillance-based price and wage discrimination

Would prohibit companies from using data obtained through observation, inference or surveillance to set individualized prices for customers or wages for employees, with exceptions for loyalty programs and group discounts.

Failed
Oklahoma
OklahomaSB 546

Oklahoma consumer data privacy law

Creates a comprehensive consumer data privacy law giving Oklahomans rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data, with data protection assessments and Attorney General enforcement.

Enacted