Every country's data privacy law. One register.

The register

Click any column to sort. Every row links to a full profile: framework, marketing rules, transfers, penalties, primary sources and a live news wire. Machine-readable version at /data/register.json; model-readable at /llms.txt.

Where the world stands

The regulated world runs on opt-in, and the United States runs on opt-out. In the EU, UK, Brazil, China, Korea, Canada and most of the other 151 opt-in regimes, using personal data to target people requires permission first. In the US, an advertiser can target adults with personal data without prior consent, subject to opt-outs, disclosures, and opt-in islands for sensitive data, children, and (under the TCPA) every marketing call and text. The consent map and the GDPR vs US comparison lay out the full divide.

The next few months move the map again. California's governor vetoed the flat ban on selling sensitive personal data (AB 1542) but signed the deletion expansion (SB 923), the data broker bill (AB 883) and, on September 30, the CIPA reform that ends private pen-register tracking suits (SB 690), all effective January 1, 2027. Connecticut's ban on selling precise geolocation data took effect October 1. Chile's December 1 start date is in play after the government moved to push it back a year. Korea can now fine up to 10% of total revenue, Japan has enacted its APPI overhaul, and India's full DPDP duties and penalties arrive May 13, 2027. Brussels, meanwhile, is still negotiating the Digital Omnibus, the first serious attempt to amend the GDPR itself. Dates are on the calendar and developments on the news page.

Next on the calendar

The full 2025-2028 calendar →

Latest developments

All developments and live wires →