Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Online safety laws

Regulations worldwide that deal with online safety, with every phased deadline and the official source for each.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
In forceMalaysia
Malaysia Online Safety ActPuts duties on licensed application service providers and content application service providers to reduce users' exposure to harmful content. They must issue user guidelines, give users safety tools and reporting channels, protect child users, make priority harmful content (such as child sexual abuse material) inaccessible, and prepare an Online Safety Plan. An Online Safety Appeal Tribunal hears appeals.Next: Dec 28 Online Safety Plan due to MCMC · in 2 months
In forceUtah
Utah App Store Accountability ActApp stores must verify each user's age category, obtain parental consent for minor accounts and share age and consent status with developers. Developers must check age and consent through the app store and cannot enforce contracts against minors without consent. Parents of harmed minors can sue.Next: Dec 31 Private right of action begins · in 2 months
EnactedCalifornia
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months
In forceCalifornia
California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months
In forceUnited Arab Emirates
UAE Child Digital Safety LawSets child safety duties for internet service providers and digital platforms that operate in or target the UAE, from social media and games to e-commerce. Platforms may not process personal data of children under 13 without verifiable parental consent and must use age verification and risk-based controls. A 2026 Cabinet Resolution bars social media accounts for children under 15 and restricts accounts for 15 year olds.Next: Jan 1, 2027 Compliance deadline under the Decree by Law · in 2 months
EnactedVermont
Vermont Kids CodeCovered online businesses owe minors a minimum duty of care, must set high-privacy defaults and offer tools, and must avoid prohibited data and design practices. Age assurance data has privacy limits.Next: Jan 1, 2027 Takes effect · in 2 months
EnactedNew York
NY SAFE for Kids ActSocial media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.Next: Jan 25, 2027 Act and rules take effect · in 3 months
In forceEuropean Union
Digital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 months
In forceCalifornia
California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
In forceVietnam
Vietnam Cybersecurity Law 2025A single cybersecurity law that replaces both the Law on Network Information Security (2015) and the Cybersecurity Law (2018) from 1 July 2026. It covers cybersecurity protection, the security of information systems by classification level, cybersecurity products and services, and the duties of domestic and foreign organisations. Systems and products approved under the old laws have 12 months to meet the new requirements.Next: Jul 1, 2027 Transition ends for existing systems and products · in 8 months
In forceEuropean Union
EU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceBrazil
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023
In forceChina
China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023
In forceChina
China Minors Online Protection RegulationsChina's State Council regulation on online protection of minors. Platforms with huge numbers of minor users or significant influence on minors must run impact assessments, offer minor modes, set up independent oversight and publish annual reports. Handlers of minors' personal information must run annual compliance audits, and online services must have anti-addiction systems.In effect since Jan 1, 2024
ProposedUnverifiedEuropean Union
EU KIDS ActA legislative initiative designed to restrict social media platforms' access to children within the European Union.No date set
In forceEuropean Union
EU Political Advertising Regulation (TTPA)Sets EU-wide transparency rules for paid political advertising, including labels, transparency notices and a public ad repository. Online targeting and ad delivery using personal data is only allowed with explicit consent, on data collected from the person, and never using special category data or profiling.In effect since Oct 10, 2025
AmendedHong Kong
Hong Kong PDPOHong Kong's privacy law for public and private data users, built on six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. Amendments in 2012 added direct marketing rules. The 2021 amendment made doxxing a crime and gave the Privacy Commissioner powers to investigate, prosecute and order removal of doxxing content.In effect since Dec 20, 1996
In forceIndia
India IT Rules amendment on synthetic contentAmends India's IT Rules 2021 to regulate synthetically generated information (AI-made or AI-altered audio, images and video). Intermediaries that enable such content must label it prominently, keep labels and metadata from being removed, and significant social media intermediaries must get a user declaration and verify it. Takedown clocks are cut sharply: 3 hours after a court or government order, 36 hours for certain grievances, and 2 hours for intimate or morphed images.In effect since Feb 20, 2026
In forceIndonesia
Indonesia PP 17/2025 (Child Protection Online)Implements the child protection provisions added to Indonesia's Electronic Information and Transactions Law by Law No. 1 of 2024. It sets rules for how electronic system operators must protect children who use their products and services, how the government supervises them, and which administrative sanctions apply. Ministries and the public also have defined roles.In effect since Mar 27, 2025
AmendedKenya
Kenya Computer Misuse and Cybercrimes ActKenya's main cybercrime law. It creates offences such as unauthorised access, interference, cyber harassment and false publication, sets up a National Computer and Cybercrimes Co-ordination Committee, and requires critical infrastructure owners to report threatening incidents. The 2025 amendment adds identity theft rules and lets the Committee order websites or apps that promote unlawful activity, child sexual content, terrorism or extremism to be blocked.In effect since May 30, 2018
In forceLouisiana
Louisiana app store age verification lawApp stores must use age verification methods, affiliate minor accounts with a parent account and give parents consent disclosures before minors use apps. Developers have matching duties to use age and consent data and protect it.In effect since Jul 1, 2026
In forceMaryland
Maryland Kids CodeOnline products reasonably likely to be accessed by children must be designed in the best interests of children, use high-privacy defaults and avoid certain data collection and profiling. Covered entities must complete data protection impact assessments.In effect since Oct 1, 2024
In forceNebraska
Nebraska Kids CodeCovered online services must use reasonable care to avoid harms to minors from design features, provide default privacy and safety tools, and designate a compliance officer.In effect since Jan 1, 2026
AmendedPakistan
Pakistan PECAPakistan's main cybercrime law, covering unauthorised access, data interference, cyber stalking and related offences, plus investigation powers. The 2025 amendment creates a Social Media Protection and Regulatory Authority that enlists social media platforms, orders removal or blocking of unlawful content, and can block non-compliant platforms. It also adds a Social Media Protection Tribunal, a new National Cyber Crime Investigation Agency, and an offence of spreading false information.No date set
In forceSingapore
Singapore Online Safety (Relief and Accountability) ActCreates a Commissioner of Online Safety, supported by the Online Safety Commission (OSC), who can direct platforms, posters and group administrators to stop or limit specified online harms. The first phase covers online harassment, doxxing, online stalking, intimate image abuse and image-based child abuse; eight further harm categories, including inauthentic material abuse, will be brought in later. The Act also creates statutory torts so victims can sue communicators, administrators and prescribed platforms in court.In effect since Jun 29, 2026
In forceSouth Africa
South Africa Cybercrimes ActCreates cybercrime offences such as unlawful access, interception, interference with data and systems, cyber fraud, extortion, and malicious communications including harmful intimate images. It also sets rules for search, seizure and cross-border cooperation. The duty for electronic communications service providers and financial institutions to report cybercrime (section 54) has not yet commenced.In effect since Dec 1, 2021
In forceUnited States (Federal)
TAKE IT DOWN ActCriminalizes knowingly publishing non-consensual intimate images, including AI-generated 'digital forgeries', and threats to do so. Covered platforms must set up a notice-and-removal process and remove reported content, plus known identical copies, within 48 hours of a valid request.In effect since May 19, 2025
EnactedTexas
Texas App Store Accountability ActApp stores must verify user ages, link minor accounts to a parent and obtain parental consent before minors download or buy apps. Developers must use the app store's age and consent signals. A federal court has preliminarily enjoined enforcement.In effect since Jan 1, 2026
In forceUnited Kingdom
UK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025
AmendedVirginia
Virginia VCDPAThe second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.In effect since Jan 1, 2023

Upcoming deadlines

ComplianceDec 28 · in 2 months
Malaysia Online Safety ActOnline Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material changes.Malaysia
EnforcementDec 31 · in 2 months
Utah App Store Accountability ActPrivate right of action beginsSection 13-75-401 takes effect.Utah
Takes effectJan 1, 2027 · in 2 months
California Digital Age Assurance ActAge signal duties beginOS providers must offer the age interface at account setup and developers must request signals.California
ComplianceJan 1, 2027 · in 2 months
California SB 976 addictive feedsAge assurance duty and AG rulesOperators must reasonably determine users are not minors; AG regulations on age assurance and parental consent due.California
ComplianceJan 1, 2027 · in 2 months
UAE Child Digital Safety LawCompliance deadline under the Decree by LawArticle 18: those covered must comply within one year from entry into force. The Cabinet may extend this.United Arab Emirates
Takes effectJan 1, 2027 · in 2 months
Vermont Kids CodeTakes effect9 V.S.A. sections 2449a to 2449j effective.Vermont
Takes effectJan 25, 2027 · in 3 months
NY SAFE for Kids ActAct and rules take effect180 days after State Register publication.New York
ReportingFeb 18, 2027 · in 4 months
Digital Services ActDSA SME impact reportCommission report under Article 91 on effects on SMEs.European Union
ComplianceJun 30, 2027 · in 8 months
UAE Child Digital Safety LawSocial media platforms' transition endsArticle 8 of Cabinet Resolution No. 106 of 2026 gives platforms 12 months from entry into force to comply.United Arab Emirates
ComplianceJul 1, 2027 · in 8 months
California Digital Age Assurance ActDeadline for existing devices and appsOS providers must offer the age interface for accounts set up before 2027, and developers must request signals for earlier installs.California
ReportingJul 1, 2027 · in 8 months
California SB 243 (companion chatbots)First annual report to Office of Suicide PreventionOperators begin annual reporting on crisis referrals and detection protocols.California
Transition endsJul 1, 2027 · in 8 months
Vietnam Cybersecurity Law 2025Transition ends for existing systems and productsInformation systems classified under the 2015 law, and security products already in use, must meet the new law's conditions within 12 months of its effective date.Vietnam
ReportingFeb 1, 2028 · in 15 months
EU CSAM Interim RegulationCommission implementation reportCommission report on implementation, including proportionality and error rates (Article 9).European Union
SunsetApr 3, 2028 · in 17 months
EU CSAM Interim RegulationInterim derogation expiresThe Regulation applies until this date.European Union

Past deadlines

EnforcementSep 12 · 45 days ago
Australia Social Media Minimum AgeStrengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for platforms doubles from 30,000 to 60,000 penalty units, and eSafety gains new information-gathering powers.Australia
EnforcementAug 31 · 57 days ago
Digital Services ActChatGPT designated as VLOSE; Reddit and Roblox as VLOPsCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January 2027) to meet VLOP/VLOSE obligations.European Union
Takes effectJul 31 · 3 months ago
EU CSAM Interim RegulationNew interim regulation enters into forcePublished in the OJ on 2026-07-28; enters into force on the third day.European Union
MilestoneJul 29 · 3 months ago
NY SAFE for Kids ActRules published in State RegisterStarts the 180-day clock.New York
Transition endsJul 28 · 3 months ago
NY SAFE for Kids ActFinal SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.New York
Takes effectJul 15 · 3 months ago
China Anthropomorphic AI MeasuresAnthropomorphic AI measures take effectAI disclosure, usage reminders, minor protection, data and security assessment duties apply.China
Takes effectJul 1 · 4 months ago
Virginia VCDPABan on selling precise geolocation data (SB 338)Controllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.Virginia
Takes effectJul 1 · 4 months ago
Vietnam Cybersecurity Law 2025Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.Vietnam
EnforcementJul 1 · 4 months ago
Nebraska Kids CodeCivil penalties availableAG may begin actions to recover civil penalties.Nebraska
Takes effectJul 1 · 4 months ago
Malaysia Online Safety ActOnline Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.Malaysia
Takes effectJul 1 · 4 months ago
Louisiana app store age verification lawTakes effectSection 5: act effective July 1, 2026.Louisiana
Takes effectJun 30 · 4 months ago
UAE Child Digital Safety LawSocial media minimum age resolution takes effectCabinet Resolution No. 106 of 2026 applies from the day after publication in Official Gazette No. 826 on 29 June 2026.United Arab Emirates
Takes effectJun 29 · 4 months ago
Singapore Online Safety (Relief and Accountability) ActOSC begins operations and first provisions commenceOSC starts taking reports for five harms, and the statutory torts for those harms take effect.Singapore
ComplianceMay 19 · 5 months ago
TAKE IT DOWN ActPlatform notice-and-removal process requiredCovered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment).United States (Federal)
ComplianceMay 6 · 6 months ago
Utah App Store Accountability ActApp store and developer duties applySections 13-75-201 and 13-75-202 take effect.Utah
EnforcementMay 6 · 6 months ago
Texas App Store Accountability ActStay pending appeal deniedDistrict court keeps the injunction in place during the state's appeal.Texas
ReportingApr 11 · 7 months ago
UK Online Safety ActFee notification window closes (2026/27)Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.United Kingdom
SunsetApr 3 · 7 months ago
EU CSAM Interim RegulationPrevious interim regulation expiresRegulation (EU) 2021/1232, as extended by Regulation (EU) 2024/1307, applied until this date.European Union
ComplianceApr 1 · 7 months ago
Maryland Kids CodeData protection impact assessments dueCovered entities must complete DPIAs by this date.Maryland
Takes effectApr 1 · 7 months ago
China Minors Online Protection RegulationsMeasures identifying large or influential platforms for minors take effectPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.China
Takes effectMar 17 · 7 months ago
Brazil ECA DigitalECA Digital in forceArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.Brazil
Takes effectMar 1 · 8 months ago
China Minors Online Protection RegulationsClassification measures for content harmful to minors take effectImplementing measures classify online information that may affect minors' physical and mental health.China
MilestoneFeb 27 · 8 months ago
Virginia VCDPASB 854 preliminarily enjoined (NetChoice v. Jones)E.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed.Virginia
Takes effectFeb 20 · 8 months ago
India IT Rules amendment on synthetic contentSynthetic content rules take effectSGI labeling, user declaration and verification duties, and the shorter 3 hour, 36 hour and 2 hour takedown timelines apply.India
ReportingJan 10 · 10 months ago
EU Political Advertising Regulation (TTPA)Member States notify sanction rulesDeadline for Member States to notify the Commission of their sanction rules under Article 25(3).European Union
Takes effectJan 1 · 10 months ago
Virginia VCDPAUnder-16 social media time limit (SB 854) takes effectSocial media platforms must use commercially reasonable age determination and cap users under 16 at 1 hour/day unless a parent consents. A preliminary injunction issued Feb 27, 2026 bars enforcement.Virginia
Takes effectJan 1 · 10 months ago
UAE Child Digital Safety LawChild Digital Safety Law takes effectEffective date shown on the official legislation portal. Published in Official Gazette No. 809 (supplement 1) on 14 October 2025.United Arab Emirates
Takes effectJan 1 · 10 months ago
Texas App Store Accountability ActScheduled effective date (enjoined)Statutory effective date; not enforceable while the injunction stands.Texas
Takes effectJan 1 · 10 months ago
Nebraska Kids CodeOperative dateAct becomes operative.Nebraska
Takes effectJan 1 · 10 months ago
Malaysia Online Safety ActOnline Safety Act and first regulations in forceThe Act and the Period, Fees, Form of Undertaking and Appeal Tribunal regulations take effect.Malaysia
ReportingJan 1 · 10 months ago
Digital Services ActDSA first harmonised transparency reporting cycleFirst full annual reporting period (to 2026-12-31) under the harmonised templates for all intermediary services.European Union
Takes effectJan 1 · 10 months ago
California SB 243 (companion chatbots)Chatbot safeguards applyAI disclosure, suicide and self-harm protocols, and minor protections apply.California
EnforcementDec 23, 2025 · 10 months ago
Texas App Store Accountability ActPreliminary injunctionW.D. Tex. (CCIA v. Paxton) enjoins the AG from implementing or enforcing SB 2420 on First Amendment grounds.Texas
Takes effectDec 10, 2025 · 11 months ago
Australia Social Media Minimum AgeSocial media minimum age obligation appliesAge-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.Australia
MilestoneNov 25, 2025 · 11 months ago
Singapore Online Safety (Relief and Accountability) ActAct assented toPassed by Parliament on 5 November 2025 and assented to by the President on 25 November 2025.Singapore
ReportingNov 17, 2025 · 11 months ago
Digital Services ActDSA review report on VLOP scope and interplayCommission report under Article 91 on Article 33 scope and interaction with other laws.European Union
Takes effectNov 4, 2025 · 12 months ago
Kenya Computer Misuse and Cybercrimes Act2025 amendments commenceComputer Misuse and Cybercrimes (Amendment) Act No. 17 of 2025: assented 15 October 2025, published 21 October 2025, commenced 4 November 2025.Kenya
Takes effectOct 29, 2025 · 12 months ago
Digital Services ActDSA delegated act on researcher data access in forceDelegated Regulation (EU) 2025/2050 sets the procedure for vetted researchers to access VLOP and VLOSE data under Article 40(4). Published in the OJ on 2025-10-09; in force on the 20th day.European Union
MilestoneOct 13, 2025 · 12 months ago
California SB 243 (companion chatbots)SB 243 signedSB 243 chaptered (ch. 677).California
MilestoneOct 13, 2025 · 12 months ago
California Digital Age Assurance ActSigned by GovernorChaptered as Chapter 675, Statutes of 2025.California