Consent requirements

A private entity collects, captures, purchases, receives through trade, otherwise obtains, stores, discloses, or profits from a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — or information derived from one and used to identify an individual — concerning an Illinois individual. Photographs, writing samples, written signatures, demographic data, physical descriptions, health-care-setting and HIPAA data, and Genetic Information Privacy Act materials are excluded by 740 ILCS 14/10; financial institutions subject to Title V of the Gramm-Leach-Bliley Act, Private Detective Act licensees, and State or local government contractors are excluded by 740 ILCS 14/25.

Law · In Force

Law · Pending

Controllers that conduct business in Colorado or deliver commercial products or services deliberately targeted to Colorado residents and meet the § 6-1-1304(1) thresholds; the thresholds do not apply to a controller processing any amount of biometric identifiers or biometric data.

Law · In Force

Controllers or processors conducting business in Delaware, or targeting products/services to Delaware residents, that meet the § 12D-103(a) consumer-volume/revenue thresholds.

Law · In Force

A large-platform controller ($1B+ global gross annual revenue and an ad-revenue-share, smart-speaker, or app-store limb, Fla. Stat. s. 501.702(9)(a)) conducting business in Florida or producing a product/service used by Florida residents. The s. 501.715 sensitive-data-sale notice/consent duty reaches a broader for-profit, Florida-nexus population regardless of the revenue/limb test (s. 501.702(9)(a)1.-3. only).

Law · In Force

Employers using AI to analyse video interviews of candidates for Illinois-based positions.

Law · In Force

Law · In Force

Controllers or processors conducting business in Iowa, or targeting products/services to Iowa residents, that meet the § 715D.2(1) consumer-volume/revenue thresholds (100,000 consumers, or 25,000 consumers with 50%+ revenue from data sales).

Law · In Force

Offering therapy or psychotherapy services in Maine — prohibits unlicensed AI-only therapy; licensed professionals may use AI for administrative or supplementary support only under written consent and professional-responsibility rules.

Law · In Force

A legal entity that conducts business in Washington, or produces or provides products or services targeted to consumers in Washington, and that alone or jointly determines the purpose and means of collecting, processing, sharing or selling consumer health data (RCW 19.373.010(23)) — including where the health status is inferred from data that is not itself health data (RCW 19.373.010(8)(b)(xiii)). RCW 19.373.070 and RCW 19.373.080 reach any person. Government agencies, tribal nations and contracted service providers processing on behalf of a government agency are outside both definitions.

Law · In Force

Controllers processing personal data of Minnesota consumers above applicability thresholds.

Law · In Force

Law · In Force

Law · In Force

Law · In Force

Unauthorized use of a person's forged digital likeness in Washington — AI-generated or altered audio or visual representation of an identifiable individual that is indistinguishable from genuine material and likely to deceive a reasonable person — civil liability under RCW 63.60.

Law · In Force

Offering or advertising therapy or psychotherapy in Rhode Island — prohibits unlicensed AI-only therapy; licensed professionals may use AI only for administrative or supplementary support with written consent when sessions are recorded or transcribed; bans AI emotional-attachment companions and independent therapeutic decisions.

Law · In Force

Law · In Force

Capture of a biometric identifier of an individual for a commercial purpose in Texas, or possession of one so captured. “Biometric identifier” is defined at Tex. Bus. & Com. Code § 503.001(a)(2) as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry — a closed list that does not reach derived “biometric information” or behavioural patterns, and “commercial purpose” is undefined. Since January 1, 2026 § 503.001(e)(2) excludes developing, training, evaluating, disseminating or otherwise offering AI models or systems unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and § 503.001(e)(1) and (e)(3) exclude financial-institution voiceprint data and enumerated security, fraud and abuse-investigation purposes.

Law · In Force

Controllers and processors conducting business in Texas or targeting Texas residents, excluding small-business and certain entity exemptions.

Law · In Force

Generation services distributing intimate AI imagery; large online covered platforms distributing GenAI content to Utah users; capture device manufacturers — provenance data, consent verification for counterfeit intimate images, and disclosure obligations under HB 276.

Law · Pending

Nonconsensual commercial use of simulated personal identity (picture, video likeness, voice, audiovisual appearance) created via generative AI, computer animation, or digital manipulation in advertising, fundraising, solicitation, or commerce — includes distribution of tools primarily designed for unauthorized commercial identity use.

Law · In Force

Law · In Force

Law · In Force

Processing of personal data by a person ordinarily resident or with a place of business in Bahrain, or by any person using means located in Bahrain for more than the mere transit of data.

Law · In Force

Processing of personal data in the context of the activities of a controller or processor on Beninese territory, or of persons who are in Benin where the activities relate to offering them goods or services or to monitoring their behaviour in Benin (art. 381).

Law · In Force

CITRA-licensed telecommunications and IT service providers collecting, processing, or storing personal data and user content in Kuwait.

Regulation · In Force

Controllers and processors collecting or processing personal data in Ghana.

Law · In Force

Processing of personal data in Seychelles or by controllers established in Seychelles.

Law · In Force

Processing of personal data in São Tomé and Príncipe or targeting local data subjects.

Law · In Force

Collection, processing, retention, or use of personal data in Lebanon whether by electronic means or otherwise — prior declaration or licence to Ministry of Economy and Trade unless exempt.

Law · In Force

Processing of personal data by any person or entity of the public, private or cooperative sector, where the controller is seated in Angola, is established there, is subject to Angolan law by public or private international law, or has recourse to processing means situated in Angolan territory including hosting, collection, registration or transit (art. 3.º).

Law · In Force

Processing of personal data in Equatorial Guinea or targeting Equatoguinean data subjects.

Law · In Force

Processing of personal data where the controller is established in Burkina Faso, whatever the place of implementation, or where a controller or processor not established there implements processing operations from the national territory, transit data excepted, or falls under Burkina Faso by virtue of public international law (art. 3).

Law · In Force

Processing of personal data in Senegal or by controllers targeting Senegalese data subjects.

Law · In Force

Processing of personal data in Mali or targeting Malian data subjects.

Law · In Force

Processing of personal data in Côte d'Ivoire or targeting Ivorian data subjects.

Law · In Force

Processing of personal data in Madagascar or targeting Malagasy data subjects.

Law · In Force

Processing of personal data in Mauritania or targeting Mauritanian data subjects.

Law · In Force

Processing of personal data in Togo or targeting Togolese data subjects.

Law · In Force

Processing of personal data in Niger or targeting Nigerien data subjects.

Law · In Force

Collection, processing, transmission, storage or use of personal data by a natural person, by the State, by decentralised administrative entities or by legal persons of public or private law; processing implemented by a controller on the territory of the Republic of the Congo or in any place where the law of that country applies; or processing implemented by a controller, established in Congo or not, which has recourse to means of processing situated on Congolese territory, excluding means used only for transit (art. 2).

Law · In Force

Processing of personal data in Tunisia or targeting Tunisian data subjects.

Law · In Force

Processing of personal data in Morocco or by controllers targeting Moroccan data subjects.

Law · In Force

Processing of personal data of individuals in Qatar by controllers or processors, including extraterritorial processing targeting Qatari residents.

Law · In Force

Processing of personal data of Jordanian citizens and residents, including data collected before enactment; cross-border transfers subject to Council adequacy rules.

Law · In Force

Processing of personal data in Rwanda or targeting Rwandan data subjects.

Law · In Force

Business operators handling personal information in Japan or providing services to individuals in Japan.

Law · In Force

Section 1(2): processing of personal data by or about a Bangladeshi citizen, resident or person working or temporarily present in Bangladesh; processing carried on inside Bangladesh other than in transit; or processing outside Bangladesh in connection with offering goods or services to, or monitoring or profiling, a data subject located in Bangladesh. No entity, revenue or record-count threshold.

Law · Partially In Force

Applying deep synthesis technology — deep learning, virtual reality and other generative-synthesis algorithms producing or significantly altering text, image, audio, video or virtual-scene information — to provide internet information services within the territory of the PRC (article 2, with the technology classes defined in article 23). No revenue, headcount or sector threshold.

Regulation · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Processing of digital personal data within India, or processing outside India in connection with offering goods or services to data principals in India.

Law · Partially In Force

Carrying out generative artificial intelligence pre-training or fine-tuning data processing activities for a service provided in China (clause 1). No revenue, headcount or sector threshold. Adoption is voluntary: the standard is a recommended national standard and creates no legal duty of its own.

Standard · In Force

Data users controlling the collection, holding, processing, or use of personal data in or from Hong Kong, including AI-driven profiling and automated processing.

Ordinance · Partially In Force

Any controller or processor handling personal data of individuals in Indonesia, including extraterritorially.

Law · In Force

Collection, processing, and protection of personal data by database owners and operators in Kazakhstan; data localization requirements for personal data databases.

Law · In Force

Personal data records owners and processors in the Kyrgyz digital environment — registration in the state register, consent and digital-data rules under the Digital Code; automatic decision-making provisions for AI systems.

Law · In Force

Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.

Law · In Force

Collection, storage, processing, or publication of personal information by public bodies or body corporates in Nepal; constitutional privacy right under Article 28.

Law · In Force

Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.

Law · In Force

Any personal information controller handling personal information of individuals in Korea.

Law · In Force

Processing personal information of individuals in China or providing products/services to individuals in China.

Law · In Force

Collection, processing, storage, and protection of personal data by public and private entities in Tajikistan; information security facility certification requirements.

Law · In Force

Telecommunications service providers — written-consent disclosure limits, communication confidentiality, purpose-limited collection/use of customer information, and security safeguards; sectoral only, not economy-wide DPA.

Law · In Force

Telecommunications service providers — consent-based collection/use/disclosure of user information, confidentiality of communications, and TCSI oversight; sectoral only, not economy-wide DPA.

Law · In Force

A data controller or data processor located in Thailand, whatever the location of the processing; or a controller or processor located outside Thailand that offers goods or services to data subjects in Thailand, whether or not payment is made, or that monitors their behaviour taking place in Thailand (s. 5).

Law · In Force

Processing of personal information by data controllers and processors in Tonga — lawful basis, consent, data-subject rights including portability, cross-border transfer standards, Privacy Commission supervision.

Law · Pending

Processing and protection of personal data in Uzbekistan regardless of means used, including information technologies; extraterritorial application to operators processing Uzbek personal data.

Law · In Force

An organization, as defined in s. 1(1)(i), that collects, uses or discloses personal information about an individual in Alberta (s. 4(1)). There is no commercial-activity threshold and no size threshold. The Act does not apply to a public body (s. 4(2)) or to the purpose-based exclusions in s. 4(3), each of which applies only where the stated purpose is the sole purpose.

Law · In Force

The organization is a data controller established in The Bahamas and the data are processed in the context of that establishment (s. 4 (1) (a)), or it is not so established but uses equipment in The Bahamas to process personal data otherwise than for transit (s. 4 (1) (b)), in which case s. 4 (2) additionally requires nomination of a representative established in The Bahamas. Section 4 (3) deems four categories to be established in The Bahamas: an individual ordinarily resident there; a body incorporated or registered under Bahamian law; a partnership or unincorporated association formed under Bahamian law; and any person maintaining an office, branch or agency there through which he carries on a business activity or a regular practice. Section 3 binds the Crown, with the head of a government agency deemed to be the controller. There is no revenue, headcount or sector threshold. Section 5 excludes five categories of data, not classes of organization.

Law · In Force

Private organizations that collect, use, or disclose personal information in British Columbia; applies regardless of commercial character (contrast with PIPEDA).

Law · In Force

An organisation that uses personal information in Bermuda, where the information is used wholly or partly by automated means or forms, or is intended to form, part of a structured filing system (s. 3). An organisation is any individual, entity or public authority that uses personal information (s. 2), and the Act binds the Crown (s. 50).

Law · In Force

Any public or private file, register or database of personal data in the Dominican Republic that makes the data susceptible of processing, and every later use of those data (arts. 2 and 3), other than the four art. 4 exclusions (domestic files, State investigation and intelligence files, deceased persons, data of legal persons and professional contact data); credit-information duties attach to the Sociedades de Información Crediticia, their data furnishers and their users or subscribers (Chapter III and Chapter IV, Section III).

Law · In Force

Processing of personal data by individuals or entities established in Argentina.

Law · In Force

Personal data appearing in an automated or manual database of a public or private body, processed or later used so as to produce effects within the national territory of Costa Rica, or to which Costa Rican legislation applies by reason of a contract or under international law (Ley art. 2; Reglamento art. 3). No size, revenue, consumer-count or sector threshold. The only general carve-out is a database kept for exclusively internal, personal or domestic purposes that is not sold or otherwise commercialised.

Law · In Force

Processing of personal data by private parties in Mexico.

Law · In Force

Processing of personal data in El Salvador by public or private controllers.

Law · In Force

Processing of personal data in public and private data files in Nicaragua.

Law · Partially In Force

Processing of personal data in Panama or targeting Panamanian data subjects.

Law · In Force

Processing of personal data in Paraguay or targeting Paraguayan data subjects.

Law · In Force

Processing personal health information by health information custodians in Ontario including AI.

Law · Partially In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Processing of personal data in Uruguay or by controllers targeting Uruguayan data subjects.

Law · In Force

Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral.

Regulation · In Force

Emergency departments deploying AI for triage, diagnosis, documentation, or operational decision support.

Guidance · In Force

Operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13.

Law · In Force

Educational agencies and institutions receiving US Department of Education funds, and vendors acting as school officials with legitimate educational interest.

Law · In Force

Entities making outbound calls using AI-generated or cloned voices to US telephone numbers.

Regulation · In Force

Covered platforms hosting user-generated content; persons publishing nonconsensual intimate visual depictions or AI deepfakes via interactive computer services in interstate commerce.

Law · In Force

Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.

Law · Partially In Force

Processing of personal data by state administration or local self-government bodies, state or community institutions or organisations, or legal or natural persons, within the scope of art. 1(1).

Law · In Force

Processing of personal data with the use of means of automation, or without them where the data can be searched or accessed by set criteria, by an operator or authorised person as defined in art. 1, within the scope of art. 2(1); excluding processing by natural persons for exclusively personal, family or household use and data classified as state secrets (art. 2(2)).

Law · In Force

Processing of personal data of individuals in Russia by operators, including extraterritorial operators targeting Russian data subjects; localization rules apply under Law 242-FZ.

Law · In Force

Collection or processing of personal data about a natural person in the Republic of Azerbaijan by a state or local self-government body or by a legal or natural person, other than collection and processing by a natural person exclusively for personal and family needs (art. 3.3) and the national-security and state-secret cases left to other legislation by art. 3.2.

Law · In Force

Processing by controllers in Montenegro or using equipment situated in Montenegro (limited extraterritorial reach).

Law · In Force

Any person transmitting or instigating unsolicited electronic-mail communications for direct-marketing purposes to a recipient in the UK.

Statutory Instrument · In Force

Organisations that collect, use, or disclose personal data in Singapore, regardless of where established.

Law · In Force

Collection, use or disclosure of personal information in the course of commercial activities in Canada (s. 4(1)(a)), or of employee or job-applicant information in connection with the operation of a federal work, undertaking or business (s. 4(1)(b)). Excluded: government institutions under the Privacy Act, personal or domestic handling by an individual, and handling exclusively for journalistic, artistic or literary purposes (s. 4(2)); business contact information used solely for work-related communication (s. 4.01). Under s. 26(2)(b) intra-provincial commercial activity in Quebec, Alberta and British Columbia is exempted where the substantially similar provincial statute applies (SOR/2003-374, SOR/2004-219, SOR/2004-220), leaving interprovincial and international flows and federal works, undertakings and businesses federally governed.

Law · In Force

Processing of personal data of individuals in Switzerland, regardless of where the controller is established.

Law · In Force