Consent requirements

Processing of personal data in the DRC or targeting Congolese data subjects.

Law · In Force

CITRA-licensed telecommunications and IT service providers collecting, processing, or storing personal data and user content in Kuwait.

Regulation · In Force

Controllers and processors collecting or processing personal data in Ghana.

Law · In Force

Processing of personal data in Seychelles or by controllers established in Seychelles.

Law · In Force

Processing of personal data in São Tomé and Príncipe or targeting local data subjects.

Law · In Force

Processing of Egyptian personal data by controllers or processors inside or outside Egypt.

Law · In Force

Collection, processing, retention, or use of personal data in Lebanon whether by electronic means or otherwise — prior declaration or licence to Ministry of Economy and Trade unless exempt.

Law · In Force

Processing of personal data in Angola or by controllers targeting Angolan data subjects.

Law · In Force

Processing of personal data in Equatorial Guinea or targeting Equatoguinean data subjects.

Law · In Force

Processing of personal data in Burkina Faso or by controllers targeting Burkinabé data subjects.

Law · In Force

Processing of personal data in Gabon or targeting Gabonese data subjects.

Law · In Force

Processing of personal data in Chad or targeting Chadian data subjects.

Law · In Force

Processing of personal data in Algeria or by controllers targeting Algerian data subjects.

Law · In Force

Processing of personal data in the Republic of the Congo or targeting Congolese data subjects.

Law · In Force

Processing of personal data in Senegal or by controllers targeting Senegalese data subjects.

Law · In Force

Processing of personal data in Mali or targeting Malian data subjects.

Law · In Force

Processing of personal data in Côte d'Ivoire or targeting Ivorian data subjects.

Law · In Force

Processing of personal data in Madagascar or targeting Malagasy data subjects.

Law · In Force

Processing of personal data in Mauritania or targeting Mauritanian data subjects.

Law · In Force

Processing of personal data in Benin or targeting Beninese data subjects.

Law · In Force

Processing of personal data in Togo or targeting Togolese data subjects.

Law · In Force

Processing of personal data in Niger or targeting Nigerien data subjects.

Law · In Force

Processing of personal data in Tunisia or targeting Tunisian data subjects.

Law · In Force

Processing of personal data in Morocco or by controllers targeting Moroccan data subjects.

Law · In Force

Processing of personal data of individuals in Qatar by controllers or processors, including extraterritorial processing targeting Qatari residents.

Law · In Force

Processing of personal data in Bahrain or of Bahraini residents by controllers established inside or outside the Kingdom.

Law · In Force

Processing of personal data of Jordanian citizens and residents, including data collected before enactment; cross-border transfers subject to Council adequacy rules.

Law · In Force

Processing of personal data in Rwanda or targeting Rwandan data subjects.

Law · In Force

Business operators handling personal information in Japan or providing services to individuals in Japan.

Law · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Processing of digital personal data within India, or processing outside India in connection with offering goods or services to data principals in India.

Law · Partially In Force

Any controller or processor handling personal data of individuals in Indonesia, including extraterritorially.

Law · In Force

Collection, processing, and protection of personal data by database owners and operators in Kazakhstan; data localization requirements for personal data databases.

Law · In Force

Personal data records owners and processors in the Kyrgyz digital environment — registration in the state register, consent and digital-data rules under the Digital Code; automatic decision-making provisions for AI systems.

Law · In Force

Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.

Law · In Force

Collection, storage, processing, or publication of personal information by public bodies or body corporates in Nepal; constitutional privacy right under Article 28.

Law · In Force

Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.

Law · In Force

Processing of personal data of Bangladeshi citizens, residents, or data subjects connected to Bangladesh; extraterritorial reach for controllers/processors outside Bangladesh.

Law · In Force

Any personal information controller handling personal information of individuals in Korea.

Law · In Force

Processing personal information of individuals in China or providing products/services to individuals in China.

Law · In Force

Providers offering deep synthesis services including deepfakes, voice cloning, and synthetic media in China.

Regulation · In Force

Collection, processing, storage, and protection of personal data by public and private entities in Tajikistan; information security facility certification requirements.

Law · In Force

Telecommunications service providers — written-consent disclosure limits, communication confidentiality, purpose-limited collection/use of customer information, and security safeguards; sectoral only, not economy-wide DPA.

Law · In Force

Telecommunications service providers — consent-based collection/use/disclosure of user information, confidentiality of communications, and TCSI oversight; sectoral only, not economy-wide DPA.

Law · In Force

Processing of personal information by data controllers and processors in Tonga — lawful basis, consent, data-subject rights including portability, cross-border transfer standards, Privacy Commission supervision.

Law · Pending

Processing and protection of personal data in Uzbekistan regardless of means used, including information technologies; extraterritorial application to operators processing Uzbek personal data.

Law · In Force

Processing of personal data in Costa Rica or targeting Costa Rican data subjects.

Law · In Force

Processing of personal data in the Dominican Republic or targeting Dominican data subjects.

Law · In Force

Processing of personal data by individuals or entities established in Argentina.

Law · In Force

Processing of personal data by private parties in Mexico.

Law · In Force

Processing of personal data in El Salvador by public or private controllers.

Law · In Force

Processing of personal data in public and private data files in Nicaragua.

Law · Partially In Force

Processing of personal data in Panama or targeting Panamanian data subjects.

Law · In Force

Processing of personal data in Paraguay or targeting Paraguayan data subjects.

Law · In Force

Processing personal health information by health information custodians in Ontario including AI.

Law · In Force

Use of personal information by organisations in Bermuda.

Law · In Force

Section 4(1): the Act applies to every organization and in respect of all personal information — there is no commercial-activity threshold, which is the principal contrast with PIPEDA. "Organization" under s. 1(1)(i) includes corporations, unincorporated associations, trade unions, partnerships and individuals acting in a commercial capacity, but not an individual acting in a personal or domestic capacity. Personal employee information is squarely in scope under ss. 15, 18 and 21, so workforce and hiring AI is covered without any federal-work limb. Excluded: public bodies (s. 4(2)); personal or domestic, artistic or literary, and journalistic purposes (s. 4(3)(a)-(c)); business contact information used to contact an individual about their business responsibilities (s. 4(3)(d)); information subject to the Protection of Privacy Act (s. 4(3)(e)) or to the Health Information Act (s. 4(3)(f)); and the further exclusions in s. 4(3)(g)-(o). Non-profit organizations are outside the Act under s. 56(2) except for personal information handled in connection with a commercial activity (s. 56(3)). Federal works, undertakings and businesses remain under PIPEDA, and PIPEDA continues to govern interprovincial and international flows; SOR/2004-219 exempts everything else occurring within Alberta.

Law · In Force

Private organizations that collect, use, or disclose personal information in British Columbia; applies regardless of commercial character (contrast with PIPEDA).

Law · In Force

Processing of personal data in Peru or of Peruvian data subjects by public or private controllers, including automated processing and cross-border transfers.

Law · In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Processing of personal data in Uruguay or by controllers targeting Uruguayan data subjects.

Law · In Force

A private entity collects, captures, purchases, receives through trade, otherwise obtains, stores, discloses, or profits from a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — or information derived from one and used to identify an individual — concerning an Illinois individual. Photographs, writing samples, written signatures, demographic data, physical descriptions, health-care-setting and HIPAA data, and Genetic Information Privacy Act materials are excluded by 740 ILCS 14/10; financial institutions subject to Title V of the Gramm-Leach-Bliley Act, Private Detective Act licensees, and State or local government contractors are excluded by 740 ILCS 14/25.

Law · In Force

Employers using AI to analyse video interviews of candidates for Illinois-based positions.

Law · In Force

Offering therapy or psychotherapy services in Maine — prohibits unlicensed AI-only therapy; licensed professionals may use AI for administrative or supplementary support only under written consent and professional-responsibility rules.

Law · In Force

Controllers processing personal data of Minnesota consumers above applicability thresholds.

Law · In Force

Unauthorized use of a person's forged digital likeness in Washington — AI-generated or altered audio or visual representation of an identifiable individual that is indistinguishable from genuine material and likely to deceive a reasonable person — civil liability under RCW 63.60.

Law · In Force

Offering or advertising therapy or psychotherapy in Rhode Island — prohibits unlicensed AI-only therapy; licensed professionals may use AI only for administrative or supplementary support with written consent when sessions are recorded or transcribed; bans AI emotional-attachment companions and independent therapeutic decisions.

Law · In Force

Capture of a biometric identifier of an individual for a commercial purpose in Texas, or possession of one so captured. “Biometric identifier” is defined at Tex. Bus. & Com. Code § 503.001(a)(2) as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry — a closed list that does not reach derived “biometric information” or behavioural patterns, and “commercial purpose” is undefined. Since January 1, 2026 § 503.001(e)(2) excludes developing, training, evaluating, disseminating or otherwise offering AI models or systems unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and § 503.001(e)(1) and (e)(3) exclude financial-institution voiceprint data and enumerated security, fraud and abuse-investigation purposes.

Law · In Force

Controllers and processors conducting business in Texas or targeting Texas residents, excluding small-business and certain entity exemptions.

Law · In Force

Generation services distributing intimate AI imagery; large online covered platforms distributing GenAI content to Utah users; capture device manufacturers — provenance data, consent verification for counterfeit intimate images, and disclosure obligations under HB 276.

Law · In Force

Nonconsensual commercial use of simulated personal identity (picture, video likeness, voice, audiovisual appearance) created via generative AI, computer animation, or digital manipulation in advertising, fundraising, solicitation, or commerce — includes distribution of tools primarily designed for unauthorized commercial identity use.

Law · In Force

Regulated entities collecting, sharing, or selling consumer health data of Washington residents outside HIPAA.

Law · In Force

Collection and processing of personal data in Azerbaijan; operators must register information systems with the Ministry.

Law · In Force

Processing of personal data in Belarus by controllers and processors; extraterritorial reach for Belarusian data subjects where applicable.

Law · In Force

Processing of personal data of individuals in Russia by operators, including extraterritorial operators targeting Russian data subjects; localization rules apply under Law 242-FZ.

Law · In Force

Processing of personal data in Moldova or by Moldovan controllers and processors.

Law · In Force

Processing of personal data in Georgia or using technical means in Georgia; extraterritorial reach for Georgian data subjects.

Law · In Force

Processing of personal data in Ukraine or of Ukrainian data subjects by controllers and processors.

Law · In Force

Processing by controllers in Montenegro or using equipment situated in Montenegro (limited extraterritorial reach).

Law · In Force

Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral.

Regulation · In Force

Operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13.

Law · In Force

Educational agencies and institutions receiving US Department of Education funds, and vendors acting as school officials with legitimate educational interest.

Law · In Force

Entities making outbound calls using AI-generated or cloned voices to US telephone numbers.

Regulation · In Force

Covered platforms hosting user-generated content; persons publishing nonconsensual intimate visual depictions or AI deepfakes via interactive computer services in interstate commerce.

Law · Partially In Force

Organisations that collect, use, or disclose personal data in Singapore, regardless of where established.

Law · In Force

Collection, use or disclosure of personal information in the course of commercial activities in Canada (s. 4(1)(a)), or of employee or job-applicant information in connection with the operation of a federal work, undertaking or business (s. 4(1)(b)). Excluded: government institutions under the Privacy Act, personal or domestic handling by an individual, and handling exclusively for journalistic, artistic or literary purposes (s. 4(2)); business contact information used solely for work-related communication (s. 4.01). Under s. 26(2)(b) intra-provincial commercial activity in Quebec, Alberta and British Columbia is exempted where the substantially similar provincial statute applies (SOR/2003-374, SOR/2004-219, SOR/2004-220), leaving interprovincial and international flows and federal works, undertakings and businesses federally governed.

Law · In Force