Every country's data privacy law. One register.

The register

Click any column to sort. Every row links to a full profile: framework, marketing rules, transfers, penalties, primary sources and a live news wire. Machine-readable version at /data/register.json; model-readable at /llms.txt.

Where the world stands

The regulated world runs on opt-in, and the United States runs on opt-out. In the EU, UK, Brazil, China, Korea, Canada and most of the other 151 opt-in regimes, using personal data to target people requires permission first. In the US, an advertiser can target adults with personal data without prior consent, subject to opt-outs, disclosures, and opt-in islands for sensitive data, children, and (under the TCPA) every marketing call and text. The consent map and the GDPR vs US comparison lay out the full divide.

The next few months move the map again. California's governor vetoed the flat ban on selling sensitive personal data (AB 1542) on September 27 but signed the deletion expansion (SB 923) and the data broker bill (AB 883), and has until September 30 to act on the CIPA reform that would end pen-register tracking suits (SB 690). Connecticut's ban on selling precise geolocation data starts October 1. Chile's December 1 start date is in play after the government moved to push it back a year. Korea can now fine up to 10% of total revenue, Japan has enacted its APPI overhaul, and India's full DPDP duties and penalties arrive May 13, 2027. Brussels, meanwhile, is still negotiating the Digital Omnibus, the first serious attempt to amend the GDPR itself. Dates are on the calendar and developments on the news page.

Next on the calendar

The full 2025-2028 calendar →

Latest developments

All developments and live wires →