264 on file · 181 became law · 49 still moving · 8 moved in 30 days
OregonExtends the Oregon Consumer Privacy Act to motor vehicle manufacturers and their affiliates that control or process personal data obtained from a consumer's use of a vehicle, regardless of volume thresholds.
AustraliaAmends the Privacy Act 1988 to require a Children's Online Privacy Code, add transparency duties for automated decisions, create a statutory tort for serious invasions of privacy and a criminal offence for doxxing.
NevadaWould have restricted processing of children's personal data by online services and required social media platforms to verify users' ages and obtain parental consent for minors.
NebraskaRequires covered online services likely to be used by minors to exercise reasonable care in design, limit data collection and use of minors' data, and set protective default settings.
ArizonaRequires commercial websites with a substantial share of sexual material harmful to minors to verify users' ages and bars retention of identifying data.
South CarolinaCreates the crime of unauthorized disclosure of intimate images, with graduated penalties.
New YorkRequires businesses to disclose when a price for goods or services was set by an algorithm using the consumer's personal data.
TexasAmended the Capture or Use of Biometric Identifier Act (Business and Commerce Code 503.001) to limit disclosure of commercially captured biometric identifiers and require their destruction within one year after the collection purpose expires; the act is enforced by the attorney general.
ChinaRequires personal information handlers to conduct regular compliance audits, with those processing data on more than 10 million people auditing at least every two years, and lets regulators order audits when risks arise.
North CarolinaWould create a comprehensive consumer data privacy law with added social media safety protections for minors.
AlabamaWould have created consumer data privacy rights and regulated how businesses process personal data.
European UnionFirst Digital Markets Act non-compliance decisions, fining Apple 500 million euros for breaching the anti-steering obligation on its App Store and Meta 200 million euros for its pay or consent model.
ArkansasRestricts collection and use of personal information of children and teens by online services, including limits on targeted advertising, and gives parents and teens data rights.
United NationsAsks the Human Rights Council Advisory Committee to draft recommended guidelines on applying the existing human rights framework to the design, development and use of neurotechnologies, for presentation at the Council's 64th session.
UtahRequires social media platforms to let Utah users export their data and to support interoperability so users can move their content and connections to other services.
North CarolinaWould create a comprehensive consumer data privacy law for North Carolina.
UtahRegulates mental health chatbots that use AI, with disclosure, advertising and user data protections for Utah users.
European UnionGives people control over and cross-border access to their electronic health data and sets a framework for the secondary use of health data for research, innovation and policy making.
NigeriaSets detailed compliance rules under the Nigeria Data Protection Act 2023, covering registration of major data controllers, compliance audit returns, data protection officers, impact assessments and fees.
KentuckyAmends the Kentucky Consumer Data Protection Act to exempt certain HIPAA-covered health care information and limited data sets and to clarify data protection assessments for profiling.
New JerseyCreates a comprehensive consumer data privacy law requiring notice of data collection and giving residents rights to access, correct, delete and opt out of the sale, targeted advertising and profiling uses of their personal data.
CanadaGovernment bill that would have enacted the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act; it died when Parliament was prorogued.
NebraskaOmnibus banking bill that adopted the Nebraska Data Privacy Act, a comprehensive consumer privacy law with rights to access, delete and opt out of sale, targeted advertising and profiling.
ChinaImplements the Cybersecurity Law, Data Security Law and Personal Information Protection Law with detailed rules on personal information handling, important data protection, cross-border data transfers and obligations of large online platforms.
New HampshireCreates a comprehensive consumer data privacy law giving residents rights to access, correct, delete and opt out of the sale, targeted advertising and profiling uses of their personal data.
CameroonSets Cameroon's first general framework for the protection of personal data.
United NationsCalls on States to respect and protect the right to privacy in the digital age, including in the context of surveillance, data collection and the design, use and governance of artificial intelligence.
ChileOverhauls Chile's personal data protection regime by amending Law 19.628, adding data subject rights such as portability, and creating an independent Personal Data Protection Agency.
BotswanaBotswana's updated data protection law governing the processing of personal data and the rights of data subjects.
IndonesiaSets rules on personal data types, data subject rights, processing, controller and processor obligations, cross-border transfers, administrative sanctions and a supervisory institution in Indonesia.
MontanaCreates a comprehensive consumer data privacy law giving Montana residents rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data.
CaliforniaClarifies that personal information under the CCPA can exist in various formats, including artificial intelligence systems capable of outputting personal information.
CaliforniaAdds neural data, meaning information generated by measuring nervous system activity, to the CCPA definition of sensitive personal information.
CanadaQuebec law modernizing public and private sector privacy rules in phases, adding privacy governance duties, privacy impact assessments, consent and transparency requirements and a data portability right.
Saudi ArabiaSaudi Arabia's comprehensive personal data protection law, supervised by SDAIA, governing processing and cross-border transfer of personal data with fines of up to SAR 5 million.
ZimbabweSets Zimbabwe's rules on personal data protection and cybercrime, with 2024 regulations on licensing data controllers and appointing data protection officers.
UtahRequires social media companies to use age assurance and apply default privacy and design protections to accounts of Utah minors.
United States (federal)The Ninth Circuit upheld the injunction against the California Age-Appropriate Design Code Act's requirement that businesses assess and mitigate risks of harmful content to children, and vacated the rest of the injunction.
IllinoisAmends BIPA so that repeated collection of the same person's biometric data by the same method counts as a single violation for damages, and allows electronic signatures for consent.
United States (federal)Senate package combining the Kids Online Safety Act and COPPA 2.0 that sets a duty of care for platforms toward minors and extends online privacy protections to teens.
EthiopiaEthiopia's first comprehensive data protection law, setting rules for collecting and processing personal data, data subject rights, and a supervisory authority.
United NationsHuman Rights Council resolution on protecting children from harm in the digital environment while respecting their rights online.
Sets common rules for African Union member states on electronic transactions, personal data protection, cybersecurity and cybercrime.
TexasComprehensive consumer data privacy law giving Texans rights to access, correct, delete and opt out of the sale, targeted advertising and profiling uses of their personal data, enforced by the attorney general.
MinnesotaCommerce omnibus that enacted the Digital Fair Repair Act requiring manufacturers to provide parts, tools and documentation for digital electronic equipment, and the Genetic Information Privacy Act governing direct-to-consumer genetic testing data.
Rhode IslandCreates a comprehensive consumer data privacy law giving Rhode Islanders rights over their personal data and requiring websites to disclose the personal data they collect and sell.
Rhode IslandSenate companion enacting the Rhode Island Data Transparency and Privacy Protection Act, a comprehensive consumer data privacy law.
United States (federal)Would create a comprehensive federal consumer data privacy standard with data minimization rules, rights to access, correct and delete data, and preemption of many state privacy laws.
New YorkBars online operators from collecting, using or selling personal data of users under 18 unless strictly necessary or with informed consent.
LouisianaProhibits social media companies from collecting minors' data to use for targeted advertising.
Legislationsby Glyph