202 on file · 147 became law · 33 still moving · 5 moved in 30 days
Rhode IslandCreates a comprehensive consumer data privacy law giving Rhode Islanders rights over their personal data and requiring websites to disclose the personal data they collect and sell.
Rhode IslandSenate companion enacting the Rhode Island Data Transparency and Privacy Protection Act, a comprehensive consumer data privacy law.
United States (federal)Would create a comprehensive federal consumer data privacy standard with data minimization rules, rights to access, correct and delete data, and preemption of many state privacy laws.
New YorkBars online operators from collecting, using or selling personal data of users under 18 unless strictly necessary or with informed consent.
VermontWould have created a comprehensive consumer privacy law with a private right of action and a kids age-appropriate design code; the Governor vetoed it and the Senate sustained the veto.
MalawiSets rules in Malawi on the processing of personal data and the rights of data subjects.
European UnionAmends the eIDAS Regulation to require every member state to offer citizens and businesses a European Digital Identity Wallet, due by the end of 2026, for identification and sharing of electronic attestations.
MarylandCreates a comprehensive consumer data privacy law with strict data minimization rules, a ban on selling sensitive data and consumer rights to access, correct, delete and opt out; cross-filed with HB 567.
United States (federal)National security supplemental law whose Division H requires ByteDance to divest TikTok or face a U.S. ban and whose Division I bars data brokers from selling Americans' sensitive data to foreign adversaries.
United States (federal)Would bar law enforcement and intelligence agencies from buying Americans' personal data from data brokers without a court order.
MaineWould have enacted a comprehensive data privacy law with data minimization rules for Maine.
United States (federal)Bipartisan, bicameral discussion draft of a comprehensive federal data privacy law released by the chairs of the Senate Commerce and House Energy and Commerce committees.
KentuckyCreates a comprehensive consumer data privacy law giving consumers rights to access, correct, delete and obtain their data and to opt out of targeted advertising, sales and profiling, enforced by the Attorney General.
NevadaRequires entities that collect consumer health data to maintain a privacy policy and bars collecting or sharing that data without affirmative consent, with limits on geofencing around health facilities.
ChinaRelaxes China's data export rules by exempting several categories of cross-border transfers from security assessment, standard contract or certification requirements and letting free trade zones set negative lists.
United States (federal)Bars data brokers from selling or transferring Americans' sensitive personal data to foreign adversary countries or entities they control; its text was later enacted through H.R. 815.
JordanJordan's first comprehensive data protection law, requiring consent for most processing, granting access, correction and erasure rights, and creating a Personal Data Protection Board under the Ministry of Digital Economy and Entrepreneurship.
United States (federal)Standalone House bill requiring ByteDance to divest TikTok or face a U.S. app store and hosting ban; its text was later enacted through H.R. 815.
United States (federal)Directs the Justice Department to restrict transfers of Americans' bulk sensitive personal data and government related data to countries of concern.
Adds a digital trade protocol to the African Continental Free Trade Area Agreement, setting common rules on digital trade, cross-border data transfers, personal data protection and online consumer protection.
RwandaSets rules for processing personal data in Rwanda, gives data subjects rights, requires registration of data controllers and processors, and designates the National Cyber Security Authority as supervisory authority.
United NationsHuman Rights Council resolution on protecting the right to privacy against surveillance, data collection and the use of artificial intelligence and other digital technologies.
DelawareCreates a comprehensive consumer data privacy law giving Delaware residents rights over personal data and imposing duties on businesses that process it.
TexasRequires data brokers to register annually with the Secretary of State, post consumer notices and maintain a data security program, with civil penalties.
ChinaSets rules for providers offering generative AI services to the public in China, covering training data legality, content controls, labeling, user protection, security assessments and algorithm filing.
OregonRequires data brokers that collect, sell or license brokered personal data in Oregon to register annually with the Department of Consumer and Business Services.
OregonGives Oregon consumers rights to access, correct, delete and opt out of the sale, targeted advertising and profiling uses of their personal data, and sets duties for controllers and processors enforced by the Attorney General.
ConnecticutAdds consumer health data protections to the Connecticut Data Privacy Act and creates duties for online services that offer products or features to minors.
NigeriaEstablishes the Nigeria Data Protection Commission and sets rules for the lawful processing of personal data, data subject rights and cross-border data transfers.
FloridaCreates consumer data privacy rights for large controllers, limits government requests to social media platforms, and restricts how online platforms likely accessed by children use their data.
TennesseeCreates a comprehensive consumer data privacy law giving Tennessee residents rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data.
IndianaCreates a comprehensive consumer data privacy law giving Indiana consumers rights to confirm, correct, delete and obtain their personal data and to opt out of targeted advertising, sales and profiling.
WashingtonRequires consent before collecting or sharing consumer health data, bans selling it without signed authorization, restricts geofencing around health facilities and gives consumers a private right of action.
VietnamSets Viet Nam's first comprehensive personal data protection rules, defining basic and sensitive personal data and prohibiting the sale of personal data.
IowaCreates a comprehensive consumer data privacy law giving consumers rights to access, delete and obtain their data and to opt out of the sale of personal data and targeted advertising, enforced by the Attorney General.
Protocol to the Budapest Convention on enhanced international cooperation and direct disclosure of electronic evidence, including requests to service providers for subscriber information.
District of ColumbiaWould have barred users of algorithmic decision-making from making eligibility determinations in a discriminatory manner and required notices to affected individuals.
CaliforniaVoter-approved initiative that amended and expanded the CCPA with new consumer privacy protections and created the California Privacy Protection Agency.
KenyaEstablishes the Office of the Data Protection Commissioner and sets rules for processing personal data, data subject rights and transfers of personal data out of Kenya.
TanzaniaSets minimum requirements for collecting and processing personal data by public and private bodies and establishes the Personal Data Protection Commission.
Provides a common framework for African Union member states to harmonise data governance, enable cross-border data flows and build a shared continental data space.
ConnecticutCreates a comprehensive consumer data privacy law giving Connecticut residents rights to access, correct, delete and opt out of the sale, targeted advertising and profiling use of their personal data.
UtahEnacts a comprehensive consumer privacy law giving Utah residents rights to access, delete and opt out of the sale and targeted advertising use of their personal data.
United Arab EmiratesSets the UAE federal framework for processing personal data, including consent requirements, data subject rights and rules on cross-border transfers.
United NationsThe first global standard on AI ethics, a voluntary UNESCO recommendation setting values, principles and policy action areas for Member States on the ethical development and use of AI.
ColoradoCreates a comprehensive consumer data privacy law giving Colorado residents rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data.
South AfricaSets minimum conditions for the lawful processing of personal information by public and private bodies, establishes the Information Regulator and regulates direct marketing, automated decision making and cross-border transfers.
VirginiaCreates a comprehensive consumer data privacy framework giving Virginia residents rights to access, correct, delete and opt out of the sale, targeted advertising and profiling use of their personal data.
Sets the African Union plan to build an integrated digital single market in Africa by 2030 through digital infrastructure, skills, regulation and cybersecurity.
CaliforniaCreates the California Consumer Privacy Act, giving residents rights to know, delete and opt out of the sale of personal information that businesses collect about them.
Legislationsby Glyph