# Digital Privacy Regulations
> The Worldwide Register of Data Privacy Law. Data privacy and data protection law for all 193 UN member states plus the EU, Hong Kong, Macau and Taiwan, with an advertiser and marketer lens: consent models, marketing rules, cross-border transfers, penalties.

Updated: 2026-09-28

## Core pages
- [The register (all 197 jurisdictions)](https://digitalprivacyregs.com/)
- [Consent models: opt-in vs opt-out worldwide](https://digitalprivacyregs.com/consent-models.html)
- [US state privacy laws tracker](https://digitalprivacyregs.com/us-states.html)
- [GDPR vs US comparison](https://digitalprivacyregs.com/gdpr-vs-us.html)
- [Cross-border transfers](https://digitalprivacyregs.com/transfers.html)
- [EU adequacy list](https://digitalprivacyregs.com/adequacy.html)
- [Biggest fines and penalty ceilings](https://digitalprivacyregs.com/penalties.html)
- [Compliance calendar 2025-2028](https://digitalprivacyregs.com/calendar.html)
- [Questions, answered](https://digitalprivacyregs.com/questions.html)
- [Glossary](https://digitalprivacyregs.com/glossary.html)
- [News and developments](https://digitalprivacyregs.com/news.html)

## Language editions
- The English edition is the version of record. Translated editions of every page: [Español](https://digitalprivacyregs.com/es/), [Français](https://digitalprivacyregs.com/fr/), [Deutsch](https://digitalprivacyregs.com/de/), [Português](https://digitalprivacyregs.com/pt/).

## Data
- [register.json (structured data, all jurisdictions)](https://digitalprivacyregs.com/data/register.json)
- [llms-full.txt (one-line summaries of every jurisdiction)](https://digitalprivacyregs.com/llms-full.txt)
- [RSS feed](https://digitalprivacyregs.com/feed.xml)

## Key facts (as of 2026-09-28)
- The regulated world runs on opt-in consent for targeted advertising; the United States runs on opt-out for adults and non-sensitive data.
- US exceptions to opt-out: sensitive data (opt-in in most state laws), children, and marketing calls/texts (opt-in under the TCPA). Email is opt-out under CAN-SPAM.
- 24 US states have enacted comprehensive privacy laws; 20 are in effect in 2026.
- India's DPDP Act phases: Board provisions in force 13 Nov 2025; consent managers 13 Nov 2026; substantive duties, enforcement powers and penalties 13 May 2027.
- Chile's Law 21.719 is legally due to apply 1 Dec 2026; a government bill filed 1 Sep 2026 would move the date to 1 Dec 2027.
- California's governor vetoed AB 1542 (sensitive-data sale ban) on 27 Sep 2026 and signed SB 923 (deletion of third-party data) and AB 883 (data brokers), effective 1 Jan 2027; SB 690 (CIPA pen-register reform) awaits action by 30 Sep 2026.
- Japan's APPI amendment (Act No. 56 of 2026) was promulgated 17 Jul 2026 and phases in from 17 Jan 2027 to 17 Jul 2028.
- South Korea can fine up to 10% of total revenue for the most serious PIPA violations from September 2026.
- The Irish DPC fined Google EUR 403M over location data on 21 Sep 2026; cumulative GDPR fines reached EUR 7.1B by January 2026 (DLA Piper).
- The UK's Data (Use and Access) Act 2025 main data provisions commenced 5 Feb 2026; EU adequacy renewed to 27 Dec 2031.
- The EU Digital Omnibus data package (GDPR/ePrivacy amendments) remains under negotiation; adoption not before late 2026.