Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Children and teen online privacy laws

Regulations worldwide that deal with children, with every phased deadline and the official source for each.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
EnactedIndia
India DPDP ActIndia's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.Next: Nov 13 Consent Manager registration rule in force (12 months) · in 17 days
AmendedEuropean Union
EU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 days
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In forceMalaysia
Malaysia Online Safety ActPuts duties on licensed application service providers and content application service providers to reduce users' exposure to harmful content. They must issue user guidelines, give users safety tools and reporting channels, protect child users, make priority harmful content (such as child sexual abuse material) inaccessible, and prepare an Online Safety Plan. An Online Safety Appeal Tribunal hears appeals.Next: Dec 28 Online Safety Plan due to MCMC · in 2 months
In forceUtah
Utah App Store Accountability ActApp stores must verify each user's age category, obtain parental consent for minor accounts and share age and consent status with developers. Developers must check age and consent through the app store and cannot enforce contracts against minors without consent. Parents of harmed minors can sue.Next: Dec 31 Private right of action begins · in 2 months
EnactedCalifornia
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months
In forceCalifornia
California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months
AmendedCalifornia
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
AmendedConnecticut
Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months
AmendedDelaware
Delaware Personal Data Privacy Act (DPDPA)Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.Next: Jan 1, 2027 Amended thresholds and third-party duties take effect · in 2 months
AmendedNew Hampshire
New Hampshire Privacy ActComprehensive consumer privacy law giving New Hampshire residents access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, universal opt-out signal support and data protection assessments. A 2026 amendment (HB 1460) bans selling the personal data of children under 13 starting in 2027.Next: Jan 1, 2027 Ban on selling personal data of children under 13 (HB 1460) · in 2 months
In forceUnited Arab Emirates
UAE Child Digital Safety LawSets child safety duties for internet service providers and digital platforms that operate in or target the UAE, from social media and games to e-commerce. Platforms may not process personal data of children under 13 without verifiable parental consent and must use age verification and risk-based controls. A 2026 Cabinet Resolution bars social media accounts for children under 15 and restricts accounts for 15 year olds.Next: Jan 1, 2027 Compliance deadline under the Decree by Law · in 2 months
EnactedVermont
Vermont Kids CodeCovered online businesses owe minors a minimum duty of care, must set high-privacy defaults and offer tools, and must avoid prohibited data and design practices. Age assurance data has privacy limits.Next: Jan 1, 2027 Takes effect · in 2 months
AmendedIndonesia
Indonesia PDP LawIndonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.Next: Jan 16, 2027 Implementing regulation GR 33/2026 takes effect · in 3 months
EnactedNew York
NY SAFE for Kids ActSocial media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.Next: Jan 25, 2027 Act and rules take effect · in 3 months
In forceEuropean Union
Digital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 months
AmendedMaryland
Maryland Online Data Privacy Act (MODPA)The strictest US state comprehensive privacy law: imposes data minimization limited to what is strictly necessary, bans the sale of sensitive data outright, and bans targeted advertising to and sale of data of consumers under 18 (known or should have known). Took effect Oct 1, 2025 but does not apply to personal data processing activities before April 1, 2026.Next: Apr 1, 2027 Discretionary 60-day cure period ends · in 5 months
AmendedEuropean Union
GDPRThe EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.Next: Apr 2, 2027 GDPR Procedural Regulation applies · in 5 months
In forceCalifornia
California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
In forceEuropean Union
EU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
In forceArkansas
Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026
AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceBrazil
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Minors Online Protection RegulationsChina's State Council regulation on online protection of minors. Platforms with huge numbers of minor users or significant influence on minors must run impact assessments, offer minor modes, set up independent oversight and publish annual reports. Handlers of minors' personal information must run annual compliance audits, and online services must have anti-addiction systems.In effect since Jan 1, 2024
In forceChina
China PIPLChina's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.In effect since Nov 1, 2021
AmendedColorado
Colorado Privacy Act (CPA)Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.In effect since Jul 1, 2023
AmendedUnited States (Federal)
COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000
ProposedUnverifiedEuropean Union
EU KIDS ActA legislative initiative designed to restrict social media platforms' access to children within the European Union.No date set
In forceFlorida
Florida Digital Bill of RightsPrivacy law aimed at very large tech companies: access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data, voice/face recognition limits, data retention schedules and protections for known children. Separately, any for-profit business that sells sensitive data must post a notice, and the sale-of-sensitive-data consent rule applies beyond the big-tech controllers.In effect since Jul 1, 2024
In forceIndonesia
Indonesia PP 17/2025 (Child Protection Online)Implements the child protection provisions added to Indonesia's Electronic Information and Transactions Law by Law No. 1 of 2024. It sets rules for how electronic system operators must protect children who use their products and services, how the government supervises them, and which administrative sanctions apply. Ministries and the public also have defined roles.In effect since Mar 27, 2025
AmendedJapan
Japan APPIJapan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.In effect since Apr 1, 2005
In forceLouisiana
Louisiana app store age verification lawApp stores must use age verification methods, affiliate minor accounts with a parent account and give parents consent disclosures before minors use apps. Developers have matching duties to use age and consent data and protect it.In effect since Jul 1, 2026
In forceMaryland
Maryland Kids CodeOnline products reasonably likely to be accessed by children must be designed in the best interests of children, use high-privacy defaults and avoid certain data collection and profiling. Covered entities must complete data protection impact assessments.In effect since Oct 1, 2024
AmendedMontana
Montana Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights and mandatory recognition of opt-out preference signals. SB 297 (2025) lowered thresholds, removed the cure period, added minors' protections that apply regardless of size, and lets the AG demand data protection assessments in investigations.In effect since Oct 1, 2024
In forceNebraska
Nebraska Kids CodeCovered online services must use reasonable care to avoid harms to minors from design features, provide default privacy and safety tools, and designate a compliance officer.In effect since Jan 1, 2026
AmendedNew Jersey
New Jersey NJDPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, consent for targeted advertising/sale/profiling of known 13-17 year olds, universal opt-out signal support and data protection assessments. It has no revenue-share floor for the smaller threshold, and the Division of Consumer Affairs has rulemaking authority. A June 2026 law (A5328) bans selling sensitive data and creates a data broker registry.In effect since Jan 15, 2025
In forceNew York
NY Child Data Protection ActOnline operators may not collect, use, share or sell personal data of users under 18 unless it is strictly necessary for the service or they obtain informed consent. It covers sites and apps directed to minors or with actual knowledge that a user is a minor.In effect since Jun 20, 2025
In forceOntario, Canada
Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025
AmendedOregon
Oregon OCPAComprehensive consumer privacy law with access (including a list of specific third parties data was shared with), correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, universal opt-out signals and data protection assessments. Unusually, it covers nonprofits. 2025 amendments ban selling precise geolocation data and data of consumers under 16, and bring all motor vehicle manufacturers into scope.In effect since Jul 1, 2024
In forceSingapore
Singapore Online Safety (Relief and Accountability) ActCreates a Commissioner of Online Safety, supported by the Online Safety Commission (OSC), who can direct platforms, posters and group administrators to stop or limit specified online harms. The first phase covers online harassment, doxxing, online stalking, intimate image abuse and image-based child abuse; eight further harm categories, including inauthentic material abuse, will be brought in later. The Act also creates statutory torts so victims can sue communicators, administrators and prescribed platforms in court.In effect since Jun 29, 2026
In forceUnited States (Federal)
TAKE IT DOWN ActCriminalizes knowingly publishing non-consensual intimate images, including AI-generated 'digital forgeries', and threats to do so. Covered platforms must set up a notice-and-removal process and remove reported content, plus known identical copies, within 48 hours of a valid request.In effect since May 19, 2025
EnactedTexas
Texas App Store Accountability ActApp stores must verify user ages, link minor accounts to a parent and obtain parental consent before minors download or buy apps. Developers must use the app store's age and consent signals. A federal court has preliminarily enjoined enforcement.In effect since Jan 1, 2026
AmendedUnited Kingdom
UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018
In forceUnited Kingdom
UK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025
In forceVietnam
Vietnam PDPLVietnam's first statute on personal data protection, replacing Decree 13/2023. It covers consent, data subject rights, processing and transfer impact assessments filed with the regulator, cross-border transfers, breach reporting, and bans on buying and selling personal data. Decree 356/2025 took effect alongside it and details DPIA/TIA and DPO requirements.In effect since Jan 1, 2026
AmendedVirginia
Virginia VCDPAThe second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.In effect since Jan 1, 2023

Upcoming deadlines

Transition endsNov 13 · in 17 days
India DPDP ActConsent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.India
ComplianceDec 2 · in 36 days
EU AI ActNew bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).European Union
ComplianceDec 10 · in 44 days
Australia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.Australia
ComplianceDec 10 · in 44 days
Australia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).Australia
ComplianceDec 28 · in 2 months
Malaysia Online Safety ActOnline Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material changes.Malaysia
EnforcementDec 31 · in 2 months
Utah App Store Accountability ActPrivate right of action beginsSection 13-75-401 takes effect.Utah
Takes effectJan 1, 2027 · in 2 months
California Digital Age Assurance ActAge signal duties beginOS providers must offer the age interface at account setup and developers must request signals.California
ComplianceJan 1, 2027 · in 2 months
California SB 976 addictive feedsAge assurance duty and AG rulesOperators must reasonably determine users are not minors; AG regulations on age assurance and parental consent due.California
ComplianceJan 1, 2027 · in 2 months
CCPA / CPRAADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).California
ComplianceJan 1, 2027 · in 2 months
CCPA / CPRABrowsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).California
ComplianceJan 1, 2027 · in 2 months
Connecticut Data Privacy Act (CTDPA)Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).Connecticut
Takes effectJan 1, 2027 · in 2 months
Delaware Personal Data Privacy Act (DPDPA)Amended thresholds and third-party duties take effectApplicability drops to 10,000 consumers (or 5,000 + 20% revenue from sale) and new third-party duties (12D-107A) apply.Delaware
Takes effectJan 1, 2027 · in 2 months
New Hampshire Privacy ActBan on selling personal data of children under 13 (HB 1460)HB 1460 (2026, ch. 168) prohibits controllers from selling the personal data of a child under 13.New Hampshire
ComplianceJan 1, 2027 · in 2 months
UAE Child Digital Safety LawCompliance deadline under the Decree by LawArticle 18: those covered must comply within one year from entry into force. The Cabinet may extend this.United Arab Emirates
Takes effectJan 1, 2027 · in 2 months
Vermont Kids CodeTakes effect9 V.S.A. sections 2449a to 2449j effective.Vermont
ComplianceJan 16, 2027 · in 3 months
Indonesia PDP LawImplementing regulation GR 33/2026 takes effectDetailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.Indonesia
Takes effectJan 25, 2027 · in 3 months
NY SAFE for Kids ActAct and rules take effect180 days after State Register publication.New York
ReportingFeb 18, 2027 · in 4 months
Digital Services ActDSA SME impact reportCommission report under Article 91 on effects on SMEs.European Union
EnforcementApr 1, 2027 · in 5 months
Maryland Online Data Privacy Act (MODPA)Discretionary 60-day cure period endsThe Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1, 2027 (Com. Law 14-4614).Maryland
EnforcementApr 2, 2027 · in 5 months
GDPRGDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).European Union
ComplianceMay 13, 2027 · in 7 months
India DPDP ActMain data fiduciary obligations apply (18 months)Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.India
ComplianceJun 30, 2027 · in 8 months
UAE Child Digital Safety LawSocial media platforms' transition endsArticle 8 of Cabinet Resolution No. 106 of 2026 gives platforms 12 months from entry into force to comply.United Arab Emirates
ComplianceJul 1, 2027 · in 8 months
California Digital Age Assurance ActDeadline for existing devices and appsOS providers must offer the age interface for accounts set up before 2027, and developers must request signals for earlier installs.California
ReportingJul 1, 2027 · in 8 months
California SB 243 (companion chatbots)First annual report to Office of Suicide PreventionOperators begin annual reporting on crisis referrals and detection protocols.California
ComplianceAug 2, 2027 · in 9 months
EU AI ActLegacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).European Union
ComplianceDec 2, 2027 · in 13 months
EU AI ActHigh-risk obligations apply to Annex III systemsChapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.European Union
ComplianceDec 31, 2027 · in 14 months
CCPA / CPRARisk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).California
ReportingFeb 1, 2028 · in 15 months
EU CSAM Interim RegulationCommission implementation reportCommission report on implementation, including proportionality and error rates (Article 9).European Union
ReportingApr 1, 2028 · in 17 months
CCPA / CPRAFirst risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.California
ReportingApr 1, 2028 · in 17 months
CCPA / CPRACybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).California
SunsetApr 3, 2028 · in 17 months
EU CSAM Interim RegulationInterim derogation expiresThe Regulation applies until this date.European Union
ComplianceAug 2, 2028 · in 21 months
EU AI ActHigh-risk obligations apply to Annex I product-embedded systemsChapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.European Union
ComplianceOct 1, 2028 · in 23 months
Connecticut Data Privacy Act (CTDPA)Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.Connecticut
ReportingApr 1, 2029 · in 2.4 years
CCPA / CPRACybersecurity audit due: revenue $50M-$100MFirst cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).California
ReportingApr 1, 2030 · in 3.4 years
CCPA / CPRACybersecurity audit due: revenue under $50MFirst cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.California
ComplianceAug 2, 2030 · in 3.8 years
EU AI ActPublic-authority high-risk systems must complyProviders and deployers of high-risk AI systems intended for use by public authorities that were placed on the market before the Chapter III application date must comply (Art 111(2), as replaced by the Omnibus).European Union
ComplianceDec 31, 2030 · in 4.2 years
EU AI ActLarge-scale EU IT systems must complyAI systems that are components of the large-scale IT systems in Annex X (e.g. SIS, VIS, Eurodac, EES, ETIAS) placed on the market before 2 Aug 2027 must be brought into compliance (Art 111(1)).European Union

Past deadlines

Takes effectOct 1 · 26 days ago
Connecticut Data Privacy Act (CTDPA)PA 26-64 (SB 4) amendments take effectProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.Connecticut
EnforcementSep 12 · 45 days ago
Australia Social Media Minimum AgeStrengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for platforms doubles from 30,000 to 60,000 penalty units, and eSafety gains new information-gathering powers.Australia
EnforcementAug 31 · 57 days ago
Digital Services ActChatGPT designated as VLOSE; Reddit and Roblox as VLOPsCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January 2027) to meet VLOP/VLOSE obligations.European Union
Takes effectAug 2 · 3 months ago
EU AI ActGeneral application: transparency obligations, GPAI fines, most other rulesThe AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content) and Commission fines on GPAI providers (Art 101) apply. Not deferred by the Omnibus.European Union
ComplianceAug 1 · 3 months ago
Connecticut Data Privacy Act (CTDPA)Profiling impact assessments applyImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended).Connecticut
Takes effectJul 31 · 3 months ago
EU CSAM Interim RegulationNew interim regulation enters into forcePublished in the OJ on 2026-07-28; enters into force on the third day.European Union
MilestoneJul 29 · 3 months ago
NY SAFE for Kids ActRules published in State RegisterStarts the 180-day clock.New York
Transition endsJul 28 · 3 months ago
NY SAFE for Kids ActFinal SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.New York
Transition endsJul 27 · 3 months ago
EU AI ActDigital Omnibus on AI enters into forceRegulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply from this date (new Art 113(d)).European Union
MilestoneJul 17 · 3 months ago
Japan APPI2026 APPI amendment act promulgatedAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.Japan
Takes effectJul 15 · 3 months ago
China Anthropomorphic AI MeasuresAnthropomorphic AI measures take effectAI disclosure, usage reminders, minor protection, data and security assessment duties apply.China
Takes effectJul 1 · 4 months ago
Virginia VCDPABan on selling precise geolocation data (SB 338)Controllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.Virginia
EnforcementJul 1 · 4 months ago
New Jersey NJDPAMandatory 30-day cure period expiresThe Division's duty to issue a cure notice before enforcement ends on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b)).New Jersey
EnforcementJul 1 · 4 months ago
Nebraska Kids CodeCivil penalties availableAG may begin actions to recover civil penalties.Nebraska
Takes effectJul 1 · 4 months ago
Malaysia Online Safety ActOnline Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.Malaysia
Takes effectJul 1 · 4 months ago
Louisiana app store age verification lawTakes effectSection 5: act effective July 1, 2026.Louisiana
Takes effectJul 1 · 4 months ago
Connecticut Data Privacy Act (CTDPA)PA 25-113 (SB 1295) amendments take effectThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure in privacy notices.Connecticut
Takes effectJul 1 · 4 months ago
Arkansas COPPA 2.0Takes effectSection 3: effective on and after July 1, 2026.Arkansas
Takes effectJun 30 · 4 months ago
UAE Child Digital Safety LawSocial media minimum age resolution takes effectCabinet Resolution No. 106 of 2026 applies from the day after publication in Official Gazette No. 826 on 29 June 2026.United Arab Emirates
Takes effectJun 30 · 4 months ago
New Jersey NJDPAA5328 sensitive data sale ban takes effectA5328, signed June 30, 2026, prohibits selling sensitive personal data; the ban took effect on signing.New Jersey
Takes effectJun 29 · 4 months ago
Singapore Online Safety (Relief and Accountability) ActOSC begins operations and first provisions commenceOSC starts taking reports for five harms, and the statutory torts for those harms take effect.Singapore
ComplianceMay 19 · 5 months ago
TAKE IT DOWN ActPlatform notice-and-removal process requiredCovered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment).United States (Federal)
ComplianceMay 6 · 6 months ago
Utah App Store Accountability ActApp store and developer duties applySections 13-75-201 and 13-75-202 take effect.Utah
EnforcementMay 6 · 6 months ago
Texas App Store Accountability ActStay pending appeal deniedDistrict court keeps the injunction in place during the state's appeal.Texas
ComplianceApr 22 · 6 months ago
COPPA RuleFull compliance with amended COPPA RuleOperators must comply with all amended provisions (separate third-party disclosure consent, written retention policy, written security program, updated notices); excludes Safe Harbor provisions 312.11(d)(1), (d)(4) and (g), which had earlier dates.United States (Federal)
ReportingApr 11 · 7 months ago
UK Online Safety ActFee notification window closes (2026/27)Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.United Kingdom
SunsetApr 3 · 7 months ago
EU CSAM Interim RegulationPrevious interim regulation expiresRegulation (EU) 2021/1232, as extended by Regulation (EU) 2024/1307, applied until this date.European Union
ComplianceApr 1 · 7 months ago
Maryland Online Data Privacy Act (MODPA)MODPA applies to personal data processingThe act applies to personal data processing activities from April 1, 2026 (Section 2 of ch. 455).Maryland
ComplianceApr 1 · 7 months ago
Maryland Kids CodeData protection impact assessments dueCovered entities must complete DPIAs by this date.Maryland
Takes effectApr 1 · 7 months ago
China Minors Online Protection RegulationsMeasures identifying large or influential platforms for minors take effectPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.China
Takes effectMar 17 · 7 months ago
Brazil ECA DigitalECA Digital in forceArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.Brazil
Takes effectMar 1 · 8 months ago
China Minors Online Protection RegulationsClassification measures for content harmful to minors take effectImplementing measures classify online information that may affect minors' physical and mental health.China
MilestoneFeb 27 · 8 months ago
Virginia VCDPASB 854 preliminarily enjoined (NetChoice v. Jones)E.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed.Virginia
Takes effectJan 1 · 10 months ago
Virginia VCDPAUnder-16 social media time limit (SB 854) takes effectSocial media platforms must use commercially reasonable age determination and cap users under 16 at 1 hour/day unless a parent consents. A preliminary injunction issued Feb 27, 2026 bars enforcement.Virginia
Takes effectJan 1 · 10 months ago
Vietnam PDPLPDPL and Decree 356/2025 take effectPersonal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.Vietnam
Takes effectJan 1 · 10 months ago
UAE Child Digital Safety LawChild Digital Safety Law takes effectEffective date shown on the official legislation portal. Published in Official Gazette No. 809 (supplement 1) on 14 October 2025.United Arab Emirates
Takes effectJan 1 · 10 months ago
Texas App Store Accountability ActScheduled effective date (enjoined)Statutory effective date; not enforceable while the injunction stands.Texas
Takes effectJan 1 · 10 months ago
Oregon OCPASale ban on precise geolocation and under-16 data (HB 2008)Selling precise geolocation (1,750-ft radius) and the personal data of consumers the controller knows or willfully disregards are under 16 is prohibited.Oregon
ComplianceJan 1 · 10 months ago
Oregon OCPAUniversal opt-out signals must be honoredControllers must honor opt-out preference signals such as Global Privacy Control.Oregon
EnforcementJan 1 · 10 months ago
Oregon OCPACure period sunsetsThe AG's 30-day notice-and-cure requirement expires; enforcement can proceed without a cure opportunity.Oregon