264 on file · 181 became law · 49 still moving · 8 moved in 30 days
VermontWould have created a comprehensive consumer privacy law with a private right of action and a kids age-appropriate design code; the Governor vetoed it and the Senate sustained the veto.
United States (federal)Would bar the Federal Reserve from issuing a central bank digital currency directly to individuals.
MalawiSets rules in Malawi on the processing of personal data and the rights of data subjects.
ColoradoAmends the Colorado Privacy Act to require written policies, notice and consent before collecting biometric identifiers, with retention and deletion rules.
ColoradoAmends the Colorado Privacy Act to add heightened duties for online services that process the personal data of minors, including limits on targeted advertising, data sales and retention.
Continental policy setting principles on children's safety, privacy and participation online, guiding member states in building national child online protection and empowerment programmes.
European UnionAmends the eIDAS Regulation to require every member state to offer citizens and businesses a European Digital Identity Wallet, due by the end of 2026, for identification and sharing of electronic attestations.
MarylandRequires online products reasonably likely to be accessed by children to complete data protection impact assessments, provide privacy protections and avoid certain data collection and sharing practices; cross-filed with SB 571.
MarylandCreates a comprehensive consumer data privacy law with strict data minimization rules, a ban on selling sensitive data and consumer rights to access, correct, delete and opt out; cross-filed with HB 567.
United States (federal)Directs the National Science Foundation to support research on privacy enhancing technologies.
United States (federal)National security supplemental law whose Division H requires ByteDance to divest TikTok or face a U.S. ban and whose Division I bars data brokers from selling Americans' sensitive data to foreign adversaries.
United States (federal)Reauthorizes Section 702 of the Foreign Intelligence Surveillance Act for two years with changes to FBI query procedures and oversight.
United States (federal)Would bar law enforcement and intelligence agencies from buying Americans' personal data from data brokers without a court order.
MinnesotaWould have required online businesses likely to be accessed by children to assess and mitigate risks to minors and set high-privacy defaults, with attorney general enforcement.
MaineWould have enacted a comprehensive data privacy law with data minimization rules for Maine.
ColoradoAdds biological and neural data to the sensitive data protected under the Colorado Privacy Act, the first state law to cover neural data.
United States (federal)Bipartisan, bicameral discussion draft of a comprehensive federal data privacy law released by the chairs of the Senate Commerce and House Energy and Commerce committees.
KentuckyCreates a comprehensive consumer data privacy law giving consumers rights to access, correct, delete and obtain their data and to opt out of targeted advertising, sales and profiling, enforced by the Attorney General.
NevadaRequires entities that collect consumer health data to maintain a privacy policy and bars collecting or sharing that data without affirmative consent, with limits on geofencing around health facilities.
ChinaRelaxes China's data export rules by exempting several categories of cross-border transfers from security assessment, standard contract or certification requirements and letting free trade zones set negative lists.
United States (federal)Bars data brokers from selling or transferring Americans' sensitive personal data to foreign adversary countries or entities they control; its text was later enacted through H.R. 815.
OklahomaWould have set out rights for Oklahomans when interacting with AI, including disclosure and consent over use of their data and likeness.
JordanJordan's first comprehensive data protection law, requiring consent for most processing, granting access, correction and erasure rights, and creating a Personal Data Protection Board under the Ministry of Digital Economy and Entrepreneurship.
United States (federal)Directs the Justice Department to restrict transfers of Americans' bulk sensitive personal data and government related data to countries of concern.
Adds a digital trade protocol to the African Continental Free Trade Area Agreement, setting common rules on digital trade, cross-border data transfers, personal data protection and online consumer protection.
United States (federal)Requires U.S. Customs and Border Protection to protect personal information of individuals in vessel manifests for household goods shipments.
United NationsAffirms that human rights must be protected online and offline and calls for an open, safe, secure and inclusive digital technology environment, including human rights safeguards for artificial intelligence.
United States (federal)Would extend children's online privacy protections to teens under 17, ban targeted advertising to minors and tighten the COPPA knowledge standard.
MontanaProhibits TikTok from operating in Montana and bars app stores from offering it to Montana users, with daily penalties for violations.
RwandaSets rules for processing personal data in Rwanda, gives data subjects rights, requires registration of data controllers and processors, and designates the National Cyber Security Authority as supervisory authority.
United NationsHuman Rights Council resolution on protecting the right to privacy against surveillance, data collection and the use of artificial intelligence and other digital technologies.
DelawareCreates a comprehensive consumer data privacy law giving Delaware residents rights over personal data and imposing duties on businesses that process it.
TexasRequires data brokers to register annually with the Secretary of State, post consumer notices and maintain a data security program, with civil penalties.
OregonRequires data brokers that collect, sell or license brokered personal data in Oregon to register annually with the Department of Consumer and Business Services.
OregonGives Oregon consumers rights to access, correct, delete and opt out of the sale, targeted advertising and profiling uses of their personal data, and sets duties for controllers and processors enforced by the Attorney General.
United NationsHuman Rights Council resolution asking States and companies to address the human rights risks of new and emerging digital technologies, including artificial intelligence, across their life cycle.
LouisianaRequires social media platforms to verify ages and obtain parental consent before minors under 16 can open accounts, and limits data collection and messaging for minors.
ConnecticutAdds consumer health data protections to the Connecticut Data Privacy Act and creates duties for online services that offer products or features to minors.
NigeriaEstablishes the Nigeria Data Protection Commission and sets rules for the lawful processing of personal data, data subject rights and cross-border data transfers.
FloridaCreates consumer data privacy rights for large controllers, limits government requests to social media platforms, and restricts how online platforms likely accessed by children use their data.
ConnecticutRequires inventories and impact assessments of AI systems used by state agencies and sets policies for state government use of AI.
TennesseeCreates a comprehensive consumer data privacy law giving Tennessee residents rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data.
IndianaCreates a comprehensive consumer data privacy law giving Indiana consumers rights to confirm, correct, delete and obtain their personal data and to opt out of targeted advertising, sales and profiling.
WashingtonRequires consent before collecting or sharing consumer health data, bans selling it without signed authorization, restricts geofencing around health facilities and gives consumers a private right of action.
VietnamSets Viet Nam's first comprehensive personal data protection rules, defining basic and sensitive personal data and prohibiting the sale of personal data.
United States (federal)Bars federal agencies from operational use of commercial spyware that poses national security or counterintelligence risks.
IowaCreates a comprehensive consumer data privacy law giving consumers rights to access, delete and obtain their data and to opt out of the sale of personal data and targeted advertising, enforced by the Attorney General.
Protocol to the Budapest Convention on enhanced international cooperation and direct disclosure of electronic evidence, including requests to service providers for subscriber information.
CaliforniaVoter-approved initiative that amended and expanded the CCPA with new consumer privacy protections and created the California Privacy Protection Agency.
KenyaEstablishes the Office of the Data Protection Commissioner and sets rules for processing personal data, data subject rights and transfers of personal data out of Kenya.
Legislationsby Glyph