The laws, and what they mean in practice

Privacy, AI and cybersecurity laws that shape digital trust work, from the GDPR to every US state privacy law. Each entry says who it applies to, who enforces it and when, in plain words, with the sources. Free for everyone.

Regulatory Watch follows new rules, enforcement and court decisions as they happen.

All 75 European Union 12 United Kingdom 1 US federal 12 US states 40 Rest of world 10

Privacy AI Health Children Biometrics Cybersecurity Breach notification Data brokers Marketing Financial International transfers

In force Coming into force Challenged or stayed

European Union 1

In force

DSA

Content moderation, transparency, a ban on ads targeted using sensitive data or at minors based on profiling, and risk assessments for very large platforms.

Since 17 Feb 2024

US federal 1

In force

COPPA

Verifiable parental consent before collecting personal information from children under 13, with notice, access and deletion rights for parents.

Since 21 Apr 2000 · Guide in progress

US states 2

Challenged in court · California

CA AADC

Would require child-protective defaults and assessments for services likely to be used by children. Its enforceability is being decided in court.

See details Enacted, not yet in force · New York

SAFE for Kids Act

Limits addictive algorithmic feeds and overnight notifications for minors without parental consent.

See details

This library explains laws for practitioners. It is not legal advice, and laws change: check the sources on each page and take advice from counsel before acting.