The laws, and what they mean in practice
Privacy, AI and cybersecurity laws that shape digital trust work, from the GDPR to every US state privacy law. Each entry says who it applies to, who enforces it and when, in plain words, with the sources. Free for everyone.
Regulatory Watch follows new rules, enforcement and court decisions as they happen.
European Union 1
United Kingdom 1
US federal 1
US states 24
CCPA/CPRA
The most detailed US state privacy law and the only one with a dedicated privacy regulator. It covers employee and business-to-business data, requires opt-outs from selling and sharing, and has its own regulations on automated decision-making.
Since 1 Jan 2020 · Guide in progress In force · VirginiaVCDPA
The template for most later state laws: consumer rights, opt-outs from targeted advertising, sale and profiling, opt-in consent for sensitive data, and data protection assessments.
Since 1 Jan 2023 · Guide in progress In force · ColoradoCPA
Virginia-style law with detailed Attorney General rules, including requirements to honor universal opt-out signals.
Since 1 Jul 2023 · Guide in progress In force · ConnecticutCTDPA
Virginia-style law, amended to broaden coverage and strengthen rules on sensitive data and minors.
Since 1 Jul 2023 · Guide in progress In force · UtahUCPA
One of the more business-friendly state laws, with narrower rights and higher thresholds.
Since 31 Dec 2023 In force · TexasTDPSA
No revenue or volume threshold: it reaches almost every business that is not a small business, which makes it one of the broadest state laws in practice.
Since 1 Jul 2024 · Guide in progress In force · OregonOCPA
Virginia-style law that also gives consumers the right to learn the specific third parties their data was disclosed to.
Since 1 Jul 2024 · Guide in progress In force · MontanaMCDPA
Virginia-style law with relatively low thresholds, reflecting the state's population.
Since 1 Oct 2024 In force · FloridaFDBR
Narrow in who it covers, but strict for the largest technology companies it targets.
Since 1 Jul 2024 · Guide in progress In force · IowaICDPA
A narrower Virginia-style law with fewer consumer rights.
Since 1 Jan 2025 In force · DelawareDPDPA
Virginia-style law with low thresholds and coverage of many nonprofits.
Since 1 Jan 2025 In force · New HampshireNHDPA
Virginia-style law with thresholds scaled to a small state.
Since 1 Jan 2025 In force · New JerseyNJDPA
Virginia-style law with broad sensitive-data definitions and rulemaking by the Division of Consumer Affairs.
Since 15 Jan 2025 · Guide in progress In force · NebraskaNDPA
Texas-style law without a volume threshold, applying to most businesses that are not small businesses.
Since 1 Jan 2025 In force · TennesseeTIPA
High thresholds, and an affirmative defense for businesses that follow the NIST Privacy Framework.
Since 1 Jul 2025 In force · MinnesotaMCDPA
Adds rights other states lack, including the right to question the result of a profiling decision and to see the list of third parties that received data.
Since 31 Jul 2025 · Guide in progress In force · MarylandMODPA
The strictest state law on data minimization: collection must be reasonably necessary for the service, and selling sensitive data is prohibited.
Since 1 Oct 2025 · Guide in progress In force · IndianaICDPA
Virginia-style law, in force from 2026.
Since 1 Jan 2026 In force · KentuckyKCDPA
Virginia-style law, in force from 2026.
Since 1 Jan 2026 In force · Rhode IslandRIDTPPA
Virginia-style law with unusual website disclosure duties and no cure period.
Since 1 Jan 2026 Enacted, not yet in force · OklahomaOCDPA
Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
From 1 Jan 2027 Enacted, not yet in force · LouisianaLDPA
Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
From 1 Jan 2027 Enacted, not yet in force · AlabamaAPDPA
Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
From 1 May 2027 Enacted, not yet in force · VermontVDPOSA
Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
From 1 Jan 2028Rest of world 10
PIPEDA
Canada's federal private-sector privacy law, built on ten fair information principles.
Since 1 Jan 2001 In force · QCLaw 25
The strictest privacy law in Canada, with privacy impact assessments for transfers and GDPR-level fines.
Since 22 Sep 2022 In forceLGPD
Brazil's GDPR-inspired law, with ten legal bases and a national authority.
Since 18 Sep 2020 In forcePIPL
China's comprehensive privacy law, with strict rules on consent and cross-border transfers.
Since 1 Nov 2021 In forceAPPI
Japan's privacy law, recognized by the EU as adequate.
Since 1 Apr 2005 In forcePDPA (SG)
Consent-based privacy law with mandatory breach notification since 2021.
Since 2 Jul 2014 In forcePOPIA
South Africa's comprehensive privacy law, based on eight conditions for lawful processing.
Since 1 Jul 2021 In forcenFADP
Switzerland's revised law, closely aligned with the GDPR, with fines aimed at responsible individuals.
Since 1 Sep 2023 In forcePrivacy Act (AU)
Australia's privacy law, built on the thirteen Australian Privacy Principles, now in a period of reform.
Since 1 Jan 1989 Enacted, not yet in forceDPDP Act
India's comprehensive privacy law, consent-centered, with duties for significant data fiduciaries.
See detailsThis library explains laws for practitioners. It is not legal advice, and laws change: check the sources on each page and take advice from counsel before acting.