Legislationsby Glyph
MaineMaineLD 61
An Act to Regulate Employer Surveillance to Protect Workers
Regulates employer electronic surveillance of employees to protect workers.
Privacy
264 on file · 181 became law · 49 still moving · 8 moved in 30 days
MaineCaliforniaCCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits
Regulations that give consumers rights to access and opt out of businesses' use of automated decisionmaking technology and require certain businesses to conduct risk assessments and annual cybersecurity audits.
ChinaChinaPresidential Order No. 61
Decision Amending the Cybersecurity Law
Amends the Cybersecurity Law to add a provision supporting AI research, infrastructure, ethics and risk monitoring, raise fines for network security violations, and align liability with the Data Security Law and Personal Information Protection Law.
VietnamVietnamLaw No. 91/2025/QH15
Law on Personal Data Protection
Sets a statutory framework for collecting, processing and transferring personal data in Viet Nam, replacing Decree 13/2023/ND-CP as the main personal data protection rule.
United Arab EmiratesChild Digital Safety Law
Requires digital platforms and internet service providers operating in or targeting the UAE to protect users under 18, including age verification, parental consent for data collection from children under 13, privacy-by-default settings and blocking children's access to online gambling.
European UnionEuropean UnionRegulation (EU) 2025/2518
GDPR Procedural Regulation (cross-border enforcement)
Adds harmonised procedural rules for how national data protection authorities cooperate and handle complaints in cross-border GDPR cases.
ChinaChinaCAC and SAMR Order No. 20
Measures for Certification of Personal Information Export
Sets out the certification route for transferring personal information out of China, including which handlers may use it, the certification bodies and process, and supervision of certified transfers.
New YorkNew YorkS 929 / A 2141
New York Health Information Privacy Act
Would have required consent before processing health information, given individuals access and deletion rights, and restricted sales of health data.
United NationsUnited NationsA/RES/80/215
Promotion and protection of human rights in the context of digital technologies (2025)
Updates the General Assembly's call for a human rights based approach to the design, development, deployment and use of digital technologies, including artificial intelligence.
United NationsUnited NationsA/RES/79/1 (annex I)
Global Digital Compact (Pact for the Future)
The Global Digital Compact, annexed to the Pact for the Future, sets shared objectives on closing digital divides, an inclusive and safe digital space, data governance and international AI governance, including the decision to create a scientific panel and global dialogue on AI.
United States (federal)United States (federal)H.R. 6291
Children and Teens’ Online Privacy Protection Act
House version of COPPA 2.0 extending online privacy protections to teens.
United States (federal)United States (federal)H.R. 6161
SEC Data Protection Act
A House bill in Congress, now in committee. Latest step: Referred to the House Committee on Financial Services.
MexicoMexicoLey Federal de Proteccion de Datos Personales en Posesion de
Mexico Federal Law on Protection of Personal Data Held by Private Parties (2025)
Replaces Mexico's 2010 private-sector data protection law and moves its oversight from the dissolved INAI to the Secretaria Anticorrupcion y Buen Gobierno.
MexicoMexicoLey General de Proteccion de Datos Personales en Posesion de
Mexico General Law on Protection of Personal Data Held by Obligated Subjects (2025)
Replaces the 2017 general law governing personal data held by public authorities and other obligated subjects, following the dissolution of INAI.
IndiaIndiaAct No. 22 of 2023
Digital Personal Data Protection Act, 2023
Sets rules for processing digital personal data, including consent, duties of data fiduciaries, rights of data principals and a Data Protection Board with power to impose penalties.
IndiaIndiaG.S.R. 846(E)
Digital Personal Data Protection Rules, 2025
Implements the DPDP Act 2023 with rules on notice, consent managers, security safeguards, breach intimation, children's data and the Data Protection Board, phased in over 18 months.
TaiwanTaiwanPresidential Order Hua-Zong-Yi-Jing-Zi No. 11400114521
Personal Data Protection Act Amendment
Amends Taiwan's Personal Data Protection Act to make the new Personal Data Protection Commission the competent authority, require breach notification and reporting, mandate data protection officers in public agencies and create an inspection regime for government bodies.
United NationsUnited NationsUNESCO Recommendation on the Ethics of Neurotechnology
Recommendation on the Ethics of Neurotechnology
A UNESCO standard-setting recommendation, mandated by the 42nd General Conference in November 2023, that gives Member States shared values, principles and concrete policy actions for the ethical development and use of neurotechnology.
EgyptExecutive Regulations of the Personal Data Protection Law
Implementing rules for Law No. 151 of 2020 that set out licensing and permit procedures, controls and standards for processing personal data, and breach notification to the Personal Data Protection Center within 72 hours.
EgyptPersonal Data Protection Law
Egypt's comprehensive data protection law regulating electronic processing of personal data, requiring licences for controllers and processors, and creating the Personal Data Protection Center as regulator.
CaliforniaCaliforniaAB 1043
Digital Age Assurance Act
Requires operating system providers to collect a user's age at account setup and send an age bracket signal to app stores and developers, beginning January 1, 2027.
European UnionEuropean UnionRegulation (EU) 2024/900
Regulation on transparency and targeting of political advertising
Requires political advertisements to be labelled with sponsor and funding information, creates an EU repository of online political ads, and restricts targeting and ad delivery techniques that use personal data.
European UnionEuropean UnionOJ C/2025/5519
DSA Guidelines on the Protection of Minors Online
Commission guidelines under Article 28 of the Digital Services Act setting out measures online platforms accessible to minors should take to ensure a high level of privacy, safety and security, including age assurance methods and protections against grooming, harmful content and exploitative commercial practices.
CaliforniaCaliforniaAB 566
California Opt Me Out Act
Requires web browsers to include a consumer setting that sends an opt-out preference signal to businesses, beginning January 1, 2027.
CaliforniaCaliforniaSB 361
Data Brokers: Data Collection and Deletion
Requires data brokers registering with the California Privacy Protection Agency to disclose more of the personal information they collect, such as government ID numbers, login information and citizenship data.
MontanaMontanaSB 297
Montana Consumer Data Privacy Act amendments
Amends the Montana Consumer Data Privacy Act by lowering applicability thresholds, adding protections for minors' data and expanding attorney general enforcement.
MontanaMontanaSB 163
Privacy protections for biometric, genetic and neural data
Amends Montana privacy law to cover neurotechnology data alongside biometric and genetic data, requiring consent and limiting disclosure.
CanadaCanadaBill C-2 (45th Parliament, 1st Session)
Strong Borders Act
Omnibus government bill on border security and related security measures, including new search and information access powers, which remains at second reading while related border measures were enacted separately in Bill C-12.
United States (federal)United States (federal)H.R. 2808
Homebuyers Privacy Protection Act
Limits when credit reporting agencies may sell consumer credit reports as mortgage trigger leads to third parties.
European UnionEuropean UnionC-413/23 P (ECLI:EU:C:2025:645)
EDPS v SRB (pseudonymised data)
Court of Justice judgment holding that pseudonymised data are not in all cases and for every person personal data, since pseudonymisation may prevent recipients other than the controller from identifying the data subject, and setting aside the General Court's ruling in T-557/20.
TexasTexasSB 2610
Cybersecurity safe harbor for businesses
Bars exemplary damages in data breach lawsuits against businesses with fewer than 250 employees that maintained a qualifying cybersecurity program.
TexasTexasSB 1188
Electronic health records and AI in health care
Sets electronic health record requirements, including storage of records in the United States, and allows practitioners to use AI for diagnostic recommendations only if they review AI-generated records and disclose the use to patients.
TexasTexasHB 130
Genetic information security
Bars covered facilities and companies from using genome sequencers or software produced by foreign adversaries and from storing Texans' genome sequencing data in foreign adversary countries, with civil penalties and a private right of action.
TexasTexasSB 1343
Data broker notice requirements
Updates the notice that data brokers must post on their websites and include with their Texas registration statements.
TexasTexasSB 2121
Data broker regulation amendments
Broadens the definition of data broker to any business that collects, processes or transfers personal data it did not collect directly from the individual, removing the principal-revenue test from the 2023 law.
BrazilBrazilResolucao CD/ANPD No. 19/2024
ANPD International Data Transfer Regulation
Sets rules under the LGPD for international transfers of personal data and approves standard contractual clauses that controllers using contractual clauses must adopt.
IsraelIsraelPrivacy Protection Law (Amendment No. 13), 5784-2024
Israel Privacy Protection Law Amendment No. 13
Comprehensively amends Israel's Privacy Protection Law, updating core definitions, narrowing database registration duties, requiring privacy officers for certain bodies and giving the Privacy Protection Authority administrative enforcement powers including financial sanctions.
MississippiMississippiHB 1126
Walker Montgomery Protecting Children Online Act
Requires digital service providers to register users' ages, obtain parental consent for minors, limit collection of minors' data and mitigate harms to minors, and adds morphed images of children to the child exploitation crime.
MinnesotaMinnesotaHF 4757
Minnesota Consumer Data Privacy Act (2024 commerce omnibus)
Omnibus commerce and cannabis bill that enacted the Minnesota Consumer Data Privacy Act (Minn. Stat. chapter 325O), giving consumers rights to access, correct, delete and port their personal data, opt out of targeted advertising, sale and profiling, and question the result of significant profiling decisions, enforced by the attorney general.
United States (federal)United States (federal)H.R. 1919
Anti-CBDC Surveillance State Act
Would bar the Federal Reserve from offering accounts or products directly to individuals or issuing a central bank digital currency.
MexicoMexicoDecree reforming the Constitution on organic simplification
Mexico constitutional reform on organic simplification (INAI and IFT dissolution)
Amends the Mexican Constitution to eliminate several autonomous bodies, including the transparency and data protection institute INAI and the Federal Telecommunications Institute (IFT), transferring their functions to government agencies.
ChinaChinaMPS Order No. 173
Measures for the Administration of National Network Identity Authentication Public Services
Creates a voluntary state-run online identity system that issues citizens a network ID number and network certificate so they can verify their identity to platforms without handing over ID card details, while platforms must keep other verification options.
United NationsUnited NationsA/HRC/RES/59/11
New and emerging digital technologies and human rights (2025)
Human Rights Council resolution calling for a holistic approach to the human rights impacts of new and emerging digital technologies and for national digital legislation to comply with international human rights law.
SwitzerlandSwitzerlandSR 235.1
Revised Federal Act on Data Protection (FADP)
Totally revised Swiss data protection act governing processing of personal data by private persons and federal bodies, aligned more closely with European standards.
LouisianaLouisianaHB 570
App store age verification (Act 481 of 2025)
Requires app stores to verify users ages and obtain parental consent for minors, and sets related duties for app developers.
ConnecticutConnecticutSB 1295
An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts
Omnibus act that amends the Connecticut Data Privacy Act and adds rules for social media platforms, online services, gaming and consumer contracts.
OregonOregonHB 2008
Ban on sale of precise geolocation data and minors' data
Amends the Oregon Consumer Privacy Act to bar controllers from selling precise geolocation data and the personal data of consumers under 16.
FloridaFloridaSB 868
Social Media Use by Minors
Would have required social media platforms to decrypt end-to-end encrypted messages under a warrant and let parents view all messages on a minor's account.
VermontVermontS.69
Vermont Age-Appropriate Design Code (Act 63 of 2025)
Requires online services likely to be accessed by minors to meet a minimum duty of care, set high-privacy defaults for minors and avoid design features that drive compulsive use.
MichiganMichiganSB 359
Personal Data Privacy Act
Would create a comprehensive Personal Data Privacy Act governing how businesses collect and process consumer personal data.