AI and data laws

Moving311Enacted704

311 moving · 704 enacted

Privacy

264 on file · 181 became law · 49 still moving · 8 moved in 30 days

China
Chinaunverified

AI Legislation

China proposed rules governing artificial intelligence that span data, computing, algorithms, deepfakes, and privacy.

Proposed
United Kingdom
United KingdomBill 4295

Personal Data (Digital Twins) Bill

A bill to make provision about the regulation of software or algorithms which use or hold personal data for the purpose of modelling the preferences or behaviours of a person; to make provision about the rights of individuals in respect of the holding and use of their personal data by such software

In committee
European Union
European Unionunverified

Digital Legislation Overhaul Package

The Council of the European Union agreed on its negotiating position regarding updates to data protection, cookie, data sharing, and incident reporting rules.

Passed one chamber
Delaware
DelawareHB 380

Delaware Personal Data Privacy Act Amendments

Amends the Delaware Personal Data Privacy Act to align it with other states' laws, including lowering the applicability threshold to entities processing data of at least 15,000 consumers.

Enacted
California
CaliforniaSB 923

Consumer Privacy: Deletion Requests

Would expand the CCPA right to delete to all personal information a business has collected about a consumer and require businesses to offer an online method for submitting privacy requests.

Enacted
United Nations
United NationsA/RES/79/243

UN Convention against Cybercrime

A global treaty requiring parties to criminalize certain offences committed through information and communications technology systems and to cooperate on sharing electronic evidence of serious crimes, which enters into force 90 days after the 40th ratification.

Adopted
United States (federal)
United States (federal)H.R. 10515

To establish a human-centered Federal framework for artificial intelligence in education and the workforce, promote the ethical and responsible teaching and learning of artificial intelligence, provide for equitable access to artificial intelligence-ready workforce development, safeguard student and

A House bill in Congress, now in committee. Latest step: Referred to the Committee on Education and Workforce, and in addition to the Committees on Science, Space, and Technology, and Ways and Means, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee.

In committee
Japan
JapanAct No. 56 of 2026

Act on the Protection of Personal Information Amendment

Amends Japan's personal information law to allow data sharing without consent for statistics and AI development, strengthen protections for children under 16 and facial feature data, and introduce administrative surcharges for serious violations.

In force
South Korea
South KoreaAct No. 21445

Personal Information Protection Act Amendment

Amends PIPA after large data breaches to make company heads ultimately responsible for data protection, require notice of possible breaches, mandate privacy certification for large handlers, and allow fines of up to 10 percent of total revenue for repeated or massive violations.

In force
California
CaliforniaAB 2246

Online Services Accessed by Children

Repeals the enjoined Age-Appropriate Design Code Act and replaces it with similar duties requiring online services likely to be accessed by children to take reasonable steps to prevent specified risks of harm.

Enacted
France
FranceDecision n. 2026-911 DC

Constitutional Council decision on the under-15 social media ban

Constitutional Council decision striking down the law's blanket ban on social network access for under-15s as a disproportionate restriction on freedom of expression and communication, citing the lack of any parental authorization, service-specific risk assessment or legal safeguards for age verification data.

Ruled
New Jersey
New JerseyA4015

New Jersey Kids Code Act

Codifies the New Jersey Age-Appropriate Design Code, requiring online services to limit collection of children's data, set high-privacy defaults for minors and restrict engagement-maximizing features.

Enacted
California
CaliforniaSB 362

Delete Act

Requires data brokers to register with the California Privacy Protection Agency and to process consumer deletion requests submitted through a single state-run deletion mechanism.

In force
United States (federal)
United States (federal)H.R. 9716

PRIVACY Act

A House bill in Congress, now in committee. Latest step: Referred to the Committee on the Judiciary, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

In committee
Hawaii
HawaiiHB 1753

Relating to Social Media (account deletion)

Requires certain social media platforms to let users delete their accounts and permanently erase associated personal information, and bars deceptive practices that obstruct deletion.

Enacted
United States (federal)
United States (federal)No. 25-112

Chatrie v. United States

The Supreme Court held that police conducted a Fourth Amendment search when they obtained a suspect's Google location history through a geofence warrant, and vacated and remanded the Fourth Circuit's judgment.

Ruled
Pennsylvania
PennsylvaniaHB 78

Consumer Data Privacy Act

Would create a comprehensive consumer data privacy law giving Pennsylvanians rights to access, correct, delete and opt out of the sale of their personal data.

Passed one chamber
Canada
CanadaBill C-22 (45th Parliament, 1st Session)

Lawful Access Act, 2026

Government bill giving law enforcement new tools to obtain subscriber information and other data from electronic service providers in investigations.

Passed one chamber
Massachusetts
MassachusettsS 2619

Massachusetts Data Privacy Act

Would create a comprehensive consumer data privacy law with data minimization rules and limits on selling sensitive data such as location data; the Senate passed S.2619, the engrossed version of S.2516 and S.2608, and the House passed its own amended text.

Passed both
Canada
CanadaBill C-36 (45th Parliament, 1st Session)

Protecting Privacy and Consumer Data Act (Bill C-36)

Government bill that would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA to modernize federal private sector privacy law, including protections for children's data.

Introduced