{"data":[{"id":"eu-csam-derogation-2026","jurisdiction":"European Union","jurisdiction_code":"EU","measure":"Voluntary CSAM scanning derogation from ePrivacy (Regulation (EU) 2026/1881)","topic":"encryption","status":"in-force","status_as_of":"2026-07-31","expires_on":"2028-04-03","operative_from":null,"summary":"The 2021 derogation that let providers voluntarily scan for child sexual abuse material expired on 3 April 2026 because the co-legislators did not agree an extension in time. A replacement regulation was adopted on 24 July 2026, published on 28 July 2026 and entered into force on 31 July 2026; it applies until 3 April 2028.","user_impact":"Providers may carry out voluntary CSAM detection under the derogation's conditions and applicable data-protection law until 3 April 2028. This is not a mandatory scanning duty and does not require providers to weaken end-to-end encryption.","sources":[{"label":"Regulation (EU) 2026/1881, Article 11 and recital 12","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601881","publisher":"Official Journal of the European Union","date":"2026-07-28"},{"label":"Regulation (EU) 2021/1232 record, marked no longer in force","url":"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32021R1232","publisher":"EUR-Lex","date":"2026-04-03"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"uk-vpn-age-checks-power","jurisdiction":"United Kingdom","jurisdiction_code":"GB","measure":"Children's Wellbeing and Schools Act 2026 s.70, power to extend age checks to internet services","topic":"age-verification","status":"in-force","status_as_of":"2026-04-29","expires_on":null,"operative_from":null,"summary":"Section 70 of the Children's Wellbeing and Schools Act 2026 came into force on 29 April 2026 under section 78(1)(b). It inserts a power to impose child-access restrictions on specified internet services by regulations; it does not itself impose VPN age checks.","user_impact":"Section 70 does not itself require VPN age checks. In its published consultation response, the government says it will not ban or age-gate VPNs, while keeping circumvention under review.","sources":[{"label":"Growing up in the online world: government response, updated 19 August 2026","url":"https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026","publisher":"GOV.UK","date":"2026-08-19"},{"label":"Children's Wellbeing and Schools Act 2026, section 70","url":"https://www.legislation.gov.uk/ukpga/2026/21/section/70","publisher":"legislation.gov.uk","date":"2026-04-29"},{"label":"Children's Wellbeing and Schools Act 2026, contents and enactment record","url":"https://www.legislation.gov.uk/ukpga/2026/21/contents","publisher":"legislation.gov.uk","date":"2026-04-29"},{"label":"Children's Wellbeing and Schools Act 2026, commencement section 78","url":"https://www.legislation.gov.uk/ukpga/2026/21/section/78/data.xht","publisher":"legislation.gov.uk","date":"2026-04-29"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"eu-dac8-crypto-reporting","jurisdiction":"European Union","jurisdiction_code":"EU","measure":"Crypto-asset transaction reporting by service providers (DAC8, Council Directive (EU) 2023/2226)","topic":"data-protection","status":"in-force","status_as_of":"2026-01-01","expires_on":null,"operative_from":null,"summary":"DAC8 amends the administrative cooperation directive to make reporting crypto-asset service providers collect and report customer and transaction data to tax authorities, which then exchange it between member states. EUR-Lex records the directive as in force, with member states required to adopt the rules by 31 December 2025 and apply them from 1 January 2026. Services that are not themselves crypto-asset service providers can still expose users through partners that are: Bitrefill states that its own gift-card and top-up purchases fall outside DAC8, while the partners issuing its EU card do fall in scope, so crypto top-ups of that card are expected to be reported in Estonia.","user_impact":"Reporting providers collect identifying details and reportable crypto-transaction information for 2026 activity; reporting and exchange follow in 2027, generally using annual aggregates by crypto-asset rather than a transaction-by-transaction list. Bitrefill says its EU card partner requires tax residence and TIN details: pre-2026 card customers must supply them by 31 December 2026 or crypto transactions will be blocked from 1 January 2027. Ordinary Bitrefill.com purchases and euro card spending are outside the card reporting described in its FAQ.","sources":[{"label":"Council Directive (EU) 2023/2226, dates of transposition and application","url":"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32023L2226","publisher":"EUR-Lex","date":"2023-10-24"},{"label":"How do new EU tax reporting rules (DAC8) affect the Bitrefill Card?","url":"https://help.bitrefill.com/hc/en-us/articles/33521210416146-How-do-new-EU-tax-reporting-rules-DAC8-affect-the-Bitrefill-Card","publisher":"Bitrefill","date":"2026-02-22"}],"related_articles":[],"related_services":["bitrefill"],"last_verified":"2026-10-22"},{"id":"in-dpdp-rules","jurisdiction":"India","jurisdiction_code":"IN","measure":"Digital Personal Data Protection Rules, 2025: institutional provisions in force, substantive duties phased","topic":"data-protection","status":"in-force","status_as_of":"2025-11-14","expires_on":null,"operative_from":null,"summary":"The DPDP Rules notification is dated 13 November 2025 and phases commencement: rules 1, 2 and 17–21 apply from Gazette publication, rule 4 after one year, and rules 3, 5–16, 22 and 23 after eighteen months. The Act's core processing and data-subject provisions are also deferred; this is not full commencement of the consent regime.","user_impact":"The core user-facing rules are not yet operative. They include consent and data-protection safeguards, but also minimum one-year retention of processed personal data, associated traffic data and processing logs under rule 8(3), once that rule commences. The rules do not direct providers to weaken encryption.","sources":[{"label":"The Digital Personal Data Protection Act, 2023 with DPDP Rules, 2025 and corrigendum","url":"https://www.indiacode.nic.in/handle/123456789/22037","publisher":"India Code, Government of India","date":"2025-12-11"},{"label":"DPDP Rules, GSR 846(E), commencement and retention provisions","url":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf","publisher":"Ministry of Electronics and Information Technology","date":"2025-11-13"},{"label":"DPDP Act commencement notification, GSR 843(E)","url":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf","publisher":"Ministry of Electronics and Information Technology","date":"2025-11-13"},{"label":"Ministry publication record: rules and enforcement timeline published 14 November 2025","url":"https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa","publisher":"Ministry of Electronics and Information Technology","date":"2025-11-14"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"uk-osa-age-assurance","jurisdiction":"United Kingdom","jurisdiction_code":"GB","measure":"Online Safety Act age assurance duties for pornography and harmful content","topic":"age-verification","status":"in-force","status_as_of":"2025-07-25","expires_on":null,"operative_from":null,"summary":"From 25 July 2025, services allowing pornography must use highly effective age assurance to prevent children accessing it, alongside the Online Safety Act's children's safety protections. SI 2025/888 separately ended the former video-sharing-platform regime by commencing section 210.","user_impact":"In-scope services must check age before allowing access to pornography and protect children from the most harmful content. VPNs remain legal in the UK; the government's explainer places anti-circumvention responsibilities on platforms rather than making adult VPN use unlawful.","sources":[{"label":"The Online Safety Act 2023 (Commencement No. 6) Regulations 2025, SI 2025/888","url":"https://www.legislation.gov.uk/uksi/2025/888/made","publisher":"legislation.gov.uk","date":"2025-07-17"},{"label":"Keeping children safe online: changes to the Online Safety Act explained","url":"https://www.gov.uk/government/news/keeping-children-safe-online-changes-to-the-online-safety-act-explained","publisher":"UK Government","date":"2025-08-01"},{"label":"Age checks for online safety: what users need to know","url":"https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-for-online-safety--what-you-need-to-know-as-a-user","publisher":"Ofcom","date":"2025-06-26"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"uk-tcn-apple-adp","jurisdiction":"United Kingdom","jurisdiction_code":"GB","measure":"Investigatory Powers Act s.253 technical capability notice served on Apple","topic":"encryption","status":"under-challenge","status_as_of":"2026-09-22","expires_on":null,"operative_from":null,"summary":"Apple no longer offers Advanced Data Protection to new UK users. Liberty's September case update confirms a second Apple challenge and a 17 September hearing. Its published submissions say the first notice was withdrawn and the original proceedings ended. The parties were awaiting a decision on whether the government could continue to neither confirm nor deny the second notice.","user_impact":"New UK users cannot enable Advanced Data Protection for iCloud Backup, Drive, Photos and the other affected categories. iMessage, FaceTime and categories encrypted end-to-end by default remain protected. The source check on 25 October found no later published outcome; the September case update is not a final ruling.","sources":[{"label":"Apple's current UK Advanced Data Protection availability notice","url":"https://support.apple.com/en-gb/122234","publisher":"Apple Support","date":"2025-09-23"},{"label":"Claimants' case-management submissions, IPT/25/83-86/CH","url":"https://www.libertyhumanrights.org.uk/wp-content/uploads/2026/09/IPT-25-83-86-NGO-Claimants-Submissions-for-the-CMC-on-17-September-202663.pdf","publisher":"Liberty and Privacy International","date":"2026-09-17"},{"label":"Liberty's case update after the September hearing","url":"https://www.libertyhumanrights.org.uk/issue/why-were-challenging-the-uk-governments-attempts-to-break-encryption/","publisher":"Liberty","date":"2026-09-22"},{"label":"Liberty confirms Apple's second complaint","url":"https://www.libertyhumanrights.org.uk/issue/liberty-responds-to-apples-new-legal-challenge-against-uk-governments-secret-access-orders/","publisher":"Liberty","date":"2026-08-04"},{"label":"Apple issues new challenge against UK order for access to private user data","url":"https://www.bbc.co.uk/news/articles/cvg0kk3ek2vo","publisher":"BBC News","date":"2026-08-04"},{"label":"Investigatory Powers Act 2016 s.253, technical capability notices","url":"https://www.legislation.gov.uk/ukpga/2016/25/section/253","publisher":"legislation.gov.uk","date":"2016-11-29"}],"related_articles":["uk-apple-adp-technical-capability-notice"],"related_services":[],"last_verified":"2026-10-25"},{"id":"us-tx-app-store-age-verification","jurisdiction":"Texas, United States","jurisdiction_code":"US-TX","measure":"App Store Accountability Act (SB 2420), app-store age verification and parental consent","topic":"age-verification","status":"under-challenge","status_as_of":"2026-07-06","expires_on":null,"operative_from":null,"summary":"The Fifth Circuit's 4 June order stayed the injunctions against Texas SB 2420 while the appeal continued. On 6 July, the Supreme Court denied an application to lift that stay. CCIA's 3 August update said appeal arguments were scheduled for 4 August. No later merits decision was found in the published sources checked on 25 October.","user_impact":"The verified orders allowed Texas to enforce app-store age checks and parental-consent requirements during the appeal. A stay is not a final decision on the law. The current record does not establish a later appeal outcome.","sources":[{"label":"CCIA case update before the 4 August appeal hearing","url":"https://ccianet.org/news/2026/08/ccia-presents-arguments-why-texas-app-store-law-likely-violates-first-amendment/","publisher":"Computer & Communications Industry Association","date":"2026-08-03"},{"label":"Fifth Circuit stay order, consolidated appeals 25-51073 and 26-50001","url":"https://www.ca5.uscourts.gov/opinions/pub/26/26-50001-CV0.pdf","publisher":"U.S. Court of Appeals for the Fifth Circuit","date":"2026-06-04"},{"label":"Supreme Court order denying the application to vacate the stay, 25A1390","url":"https://www.supremecourt.gov/orders/courtorders/070626zr1_dc8f.pdf","publisher":"Supreme Court of the United States","date":"2026-07-06"},{"label":"Texas SB 2420 bill history, 89th Legislature","url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420","publisher":"Texas Legislature Online","date":"2025-05-27"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-25"},{"id":"us-la-app-store-age-verification","jurisdiction":"Louisiana, United States","jurisdiction_code":"US-LA","measure":"Act 185 (HB 977, 2026), replacing Act 481 (HB 570, 2025), app-store age verification and parental consent","topic":"age-verification","status":"passed","status_as_of":"2026-05-15","expires_on":null,"operative_from":"2027-07-01","summary":"Act 481 was signed on 30 June 2025 with a planned 1 July 2026 start. Act 185 (HB 977), signed on 15 May 2026, prevented Act 481 from taking effect and replaced it with app-store and developer requirements commencing on 1 July 2027.","user_impact":"These app-store age-category and parental-consent duties do not apply yet. From 1 July 2027, covered stores must verify age categories and obtain parental consent for minors' downloads, purchases, access to pre-loaded applications and enabling in-app purchases, subject to the replacement Act's terms.","sources":[{"label":"Louisiana HB 570 (2025 Regular Session) history, Act 481, original schedule superseded by Act 185","url":"https://www.legis.la.gov/legis/BillInfo.aspx?s=25RS&b=HB570","publisher":"Louisiana State Legislature","date":"2025-06-30"},{"label":"Act 185 enacted text, sections 1, 5 and 6","url":"https://www.legis.la.gov/legis/ViewDocument.aspx?d=1475238","publisher":"Louisiana State Legislature","date":"2026-05-15"},{"label":"Louisiana HB 977 (2026 Regular Session) history, Act 185","url":"https://www.legis.la.gov/legis/BillInfo.aspx?s=26RS&b=HB977","publisher":"Louisiana State Legislature","date":"2026-05-15"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"us-ut-app-store-age-verification","jurisdiction":"Utah, United States","jurisdiction_code":"US-UT","measure":"App Store Accountability Act (SB 142, as amended by HB 498), app-store age verification and parental consent","topic":"age-verification","status":"passed","status_as_of":"2026-03-18","expires_on":null,"operative_from":"2027-05-06","summary":"Utah's HB 498, signed on 18 March 2026, amended the App Store Accountability Act and postponed the core app-store and developer duties in sections 13-76-201 and 13-76-202 to 6 May 2027. CCIA reports that it voluntarily dismissed its challenge in April 2026 after the amendment removed state-agency enforcement.","user_impact":"The core age-category verification and parental-consent duties do not apply yet. They begin on 6 May 2027, with existing-account verification due within 12 months after those obligations take effect. The amended private-action provisions also begin on 6 May 2027.","sources":[{"label":"Utah SB 142 enrolled text, effective-date schedule","url":"https://le.utah.gov/Session/2025/bills/enrolled/SB0142.pdf","publisher":"Utah State Legislature","date":"2025-03-26"},{"label":"Computer & Communications Industry Association v. Brown, D. Utah, dismissed by stipulation","url":"https://www.courtlistener.com/docket/72238008/computer-communications-industry-association-v-brown/","publisher":"CourtListener","date":"2026-04-21"},{"label":"HB 498 enrolled text, operative dates and enforcement amendments","url":"https://le.utah.gov/Session/2026/bills/enrolled/HB0498.pdf","publisher":"Utah State Legislature","date":"2026-03-18"},{"label":"HB 498 bill history","url":"https://le.utah.gov/~2026/bills/static/HB0498.html","publisher":"Utah State Legislature","date":"2026-03-18"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"us-ca-age-signal","jurisdiction":"California, United States","jurisdiction_code":"US-CA","measure":"AB 1043, operating-system age signals to applications","topic":"age-verification","status":"passed","status_as_of":"2025-10-13","expires_on":null,"operative_from":"2027-01-01","summary":"AB 1043 was approved on 13 October 2025 as Chapter 675 and becomes operative on 1 January 2027. Operating-system providers must offer an account-setup interface for a user's birth date, age, or both, and pass an age bracket to applications.","user_impact":"The duty starts in January 2027. Apps receive an age bracket rather than the underlying birth date. Existing devices must be offered the age-entry interface before 1 July 2027.","sources":[{"label":"California AB 1043, Chapter 675, Civil Code s.1798.505","url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043","publisher":"California Legislative Information","date":"2025-10-13"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"},{"id":"eu-csar-detection-orders","jurisdiction":"European Union","jurisdiction_code":"EU","measure":"CSA Regulation (\"Chat Control\") mandatory detection orders","topic":"encryption","status":"negotiating","status_as_of":"2026-07-24","expires_on":null,"operative_from":null,"summary":"The Commission's May 2022 proposal for a permanent child sexual abuse regulation remains under interinstitutional negotiation. Parliament's Legislative Observatory still records the file as awaiting its first-reading position; Parliament's September 2026 update describes ongoing trilogue negotiations. The proposed detection-order system is not an adopted EU-wide requirement.","user_impact":"The proposed detection-order system is not an adopted EU-wide requirement. Separate temporary rules allow providers to carry out voluntary detection. These are different measures.","sources":[{"label":"Regulation (EU) 2026/1881, recital 11: \"The interinstitutional negotiations on that proposal are still ongoing.\"","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601881","publisher":"Official Journal of the European Union","date":"2026-07-28"},{"label":"Combating child sexual abuse online, September 2026 update","url":"https://www.europarl.europa.eu/legislative-train/spotlight-JD22/file-combating-child-sexual-abuse-online","publisher":"European Parliament","date":"2026-09-20"}],"related_articles":[],"related_services":[],"last_verified":"2026-10-22"}],"meta":{"total":11,"api_version":"1.3","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","attribution":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","cite_guide_url":"https://cunicula.com/en/cite","dataset_url":"https://cunicula.com/api/v1/dataset","schema_version":"1.1.0","last_verified":"2026-09-18","status_definitions":{"proposed":"Introduced, tabled, or published as a draft. No legal force. Includes amendments that were moved but not carried.","negotiating":"Formally under interinstitutional or inter-chamber negotiation. Text is not settled and no obligation exists yet.","passed":"Adopted or enacted, but the operative duty has not started applying yet.","in-force":"Adopted and the operative duty applies now.","under-challenge":"In force or partly in force, and being litigated. The duty can change on a court timetable.","lapsed":"Was in force and has expired, been repealed, or been withdrawn.","defeated":"Rejected, voted down, or abandoned without adoption."},"filters":{},"scope":"Selected encryption, age-verification, and data-protection measures with explicit legal status, primary sources, and present-day effect. This is not a complete global legislation database."}}