{"data":[{"id":"eu-csam-derogation-2026","jurisdiction":"European Union","jurisdiction_code":"EU","measure":"Voluntary CSAM scanning derogation from ePrivacy (Regulation (EU) 2026/1881)","topic":"encryption","status":"in-force","status_as_of":"2026-07-28","expires_on":"2028-04-03","operative_from":null,"summary":"The 2021 derogation that let providers voluntarily scan for child sexual abuse material expired on 3 April 2026 because the co-legislators did not agree an extension in time. A replacement regulation was adopted on 24 July 2026 and published on 28 July 2026; it applies until 3 April 2028.","user_impact":"Voluntary scanning by messaging providers is again lawful in the EU until April 2028. It is permissive, not mandatory, and it does not require any provider to weaken end-to-end encryption.","sources":[{"label":"Regulation (EU) 2026/1881, Article 11 and recital 12","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601881","publisher":"Official Journal of the European Union","date":"2026-07-28"},{"label":"Regulation (EU) 2021/1232 record, marked no longer in force","url":"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32021R1232","publisher":"EUR-Lex","date":"2026-04-03"}],"related_articles":[],"related_services":[],"last_verified":"2026-08-06"},{"id":"us-la-app-store-age-verification","jurisdiction":"Louisiana, United States","jurisdiction_code":"US-LA","measure":"Act 481 (HB 570), app-store age verification for minors","topic":"age-verification","status":"in-force","status_as_of":"2026-07-01","expires_on":null,"operative_from":null,"summary":"Louisiana HB 570 was signed by the governor on 30 June 2026, became Act 481, and took effect on 1 July 2026.","user_impact":"App stores serving Louisiana users must apply the state's age-category and parental-consent process for minor accounts.","sources":[{"label":"Louisiana HB 570 (2025 Regular Session) history, Act 481, effective 07/01/2026","url":"https://www.legis.la.gov/legis/BillInfo.aspx?s=25RS&b=HB570","publisher":"Louisiana State Legislature","date":"2026-06-30"}],"related_articles":[],"related_services":[],"last_verified":"2026-08-06"},{"id":"us-ut-app-store-age-verification","jurisdiction":"Utah, United States","jurisdiction_code":"US-UT","measure":"App Store Accountability Act (SB 142), app-store age verification and parental consent","topic":"age-verification","status":"in-force","status_as_of":"2026-05-06","expires_on":null,"operative_from":null,"summary":"Utah's SB 142 phased its sections in from 2025, with the core app-store verification and parental-consent duties in sections 13-75-201 and 13-75-202 effective 6 May 2026. Two challenges filed in the District of Utah in February 2026 were both dismissed by stipulation on 21 April 2026, so the law is in force and not currently under active challenge.","user_impact":"App stores serving Utah users must verify an age category and obtain parental consent for minor accounts. The enforcement section, 13-75-401, takes effect 31 December 2026.","sources":[{"label":"Utah SB 142 enrolled text, effective-date schedule","url":"https://le.utah.gov/Session/2025/bills/enrolled/SB0142.pdf","publisher":"Utah State Legislature","date":"2025-03-26"},{"label":"Computer & Communications Industry Association v. Brown, D. Utah, dismissed by stipulation","url":"https://www.courtlistener.com/docket/72238008/computer-communications-industry-association-v-brown/","publisher":"CourtListener","date":"2026-04-21"}],"related_articles":[],"related_services":[],"last_verified":"2026-08-06"},{"id":"eu-dac8-crypto-reporting","jurisdiction":"European Union","jurisdiction_code":"EU","measure":"Crypto-asset transaction reporting by service providers (DAC8, Council Directive (EU) 2023/2226)","topic":"data-protection","status":"in-force","status_as_of":"2026-01-01","expires_on":null,"operative_from":null,"summary":"DAC8 amends the administrative cooperation directive to make reporting crypto-asset service providers collect and report customer and transaction data to tax authorities, which then exchange it between member states. EUR-Lex records the directive as in force, with member states required to adopt the rules by 31 December 2025 and apply them from 1 January 2026. Services that are not themselves crypto-asset service providers can still expose users through partners that are: Bitrefill states that its own gift-card and top-up purchases fall outside DAC8, while the partners issuing its EU card do fall in scope, so crypto top-ups of that card are expected to be reported in Estonia.","user_impact":"Buying or exchanging crypto through an EU-facing reporting provider now creates a tax-authority record tying your identity to your transactions, and that record is exchanged across member states. It does not add an identity check at the point of sale, so a service can keep a light or unchanged sign-up flow while its reporting exposure grows. The obligation follows the provider, not the customer, which is why the reporting partner behind a product matters as much as the brand on it.","sources":[{"label":"Council Directive (EU) 2023/2226, dates of transposition and application","url":"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32023L2226","publisher":"EUR-Lex","date":"2023-10-24"},{"label":"How do new EU tax reporting rules (DAC8) affect the Bitrefill Card?","url":"https://help.bitrefill.com/hc/en-us/articles/33521210416146-How-do-new-EU-tax-reporting-rules-DAC8-affect-the-Bitrefill-Card","publisher":"Bitrefill","date":"2026-02-22"}],"related_articles":[],"related_services":["bitrefill"],"last_verified":"2026-08-08"},{"id":"in-dpdp-rules","jurisdiction":"India","jurisdiction_code":"IN","measure":"Digital Personal Data Protection Rules, 2025 under the DPDP Act, 2023","topic":"data-protection","status":"in-force","status_as_of":"2025-11-13","expires_on":null,"operative_from":null,"summary":"The DPDP Act, 2023 was enacted on 11 August 2023 and the DPDP Rules were notified on 13 November 2025, with a corrigendum on 11 December 2025. The rules phase obligations in rather than starting them all at once.","user_impact":"This is a consent and data-protection regime, not an encryption mandate. It does not require providers to weaken encryption or retain message content.","sources":[{"label":"The Digital Personal Data Protection Act, 2023 with DPDP Rules, 2025 and corrigendum","url":"https://www.indiacode.nic.in/handle/123456789/22037","publisher":"India Code, Government of India","date":"2025-12-11"}],"related_articles":[],"related_services":[],"last_verified":"2026-08-06"},{"id":"uk-osa-age-assurance","jurisdiction":"United Kingdom","jurisdiction_code":"GB","measure":"Online Safety Act age assurance duties for pornography and harmful content","topic":"age-verification","status":"in-force","status_as_of":"2025-07-25","expires_on":null,"operative_from":null,"summary":"The children's safety duties requiring highly effective age assurance became enforceable in July 2025, with the sixth commencement regulations bringing the remaining provisions into force on 25 July 2025.","user_impact":"Sites in scope must run age checks before serving adult content to UK users. VPNs remain legal for adults and no measure restricts adult VPN use; the government's own explainer directs its VPN concern at platforms, not at users.","sources":[{"label":"The Online Safety Act 2023 (Commencement No. 6) Regulations 2025, SI 2025/888","url":"https://www.legislation.gov.uk/uksi/2025/888/made","publisher":"legislation.gov.uk","date":"2025-07-17"},{"label":"Keeping children safe online: changes to the Online Safety Act explained","url":"https://www.gov.uk/government/news/keeping-children-safe-online-changes-to-the-online-safety-act-explained","publisher":"UK Government","date":"2025-07-25"}],"related_articles":[],"related_services":[],"last_verified":"2026-08-06"},{"id":"uk-tcn-apple-adp","jurisdiction":"United Kingdom","jurisdiction_code":"GB","measure":"Investigatory Powers Act s.253 technical capability notice served on Apple","topic":"encryption","status":"under-challenge","status_as_of":"2026-08-04","expires_on":null,"operative_from":null,"summary":"A technical capability notice reported in February 2025 led Apple to withdraw Advanced Data Protection for new UK users. Privacy International records that the first notice was withdrawn and a second one, targeting British users, was issued in October 2025; Apple's original challenge was then dismissed for a change in circumstances. Apple confirmed a fresh Investigatory Powers Tribunal complaint in August 2026.","user_impact":"Advanced Data Protection still cannot be switched on by new UK users, so iCloud backups, Drive, and Photos are held under keys Apple can access. The tribunal timetable is a case management hearing in September 2026, with the Privacy International claim listed for December 2026.","sources":[{"label":"Apple's current UK Advanced Data Protection availability notice","url":"https://support.apple.com/en-gb/122234","publisher":"Apple Support","date":"2025-09-23"},{"label":"PI Apple TCN challenge, IPT/25/83/CH, status open","url":"https://privacyinternational.org/legal-action/pi-apple-tcn-challenge","publisher":"Privacy International","date":"2026-08-01"},{"label":"Apple issues new challenge against UK order for access to private user data","url":"https://www.bbc.co.uk/news/articles/cvg0kk3ek2vo","publisher":"BBC News","date":"2026-08-04"},{"label":"Investigatory Powers Act 2016 s.253, technical capability notices","url":"https://www.legislation.gov.uk/ukpga/2016/25/section/253","publisher":"legislation.gov.uk","date":"2016-11-29"}],"related_articles":["uk-apple-adp-technical-capability-notice"],"related_services":[],"last_verified":"2026-09-18"},{"id":"us-tx-app-store-age-verification","jurisdiction":"Texas, United States","jurisdiction_code":"US-TX","measure":"App Store Accountability Act (SB 2420), app-store age verification and parental consent","topic":"age-verification","status":"under-challenge","status_as_of":"2026-01-01","expires_on":null,"operative_from":null,"summary":"Texas SB 2420 set a 1 January 2026 start date. The district court blocked enforcement, but the Fifth Circuit lifted the injunctions in June. CCIA's 3 August update confirms that the Supreme Court declined to intervene and that the appeal was set for argument on 4 August.","user_impact":"The latest cited case update permits enforcement while the appeal continues. The law requires app-store age checks and parental consent for minors. No later ruling is recorded here; the court docket was unavailable during this review.","sources":[{"label":"CCIA case update before the 4 August appeal hearing","url":"https://ccianet.org/news/2026/08/ccia-presents-arguments-why-texas-app-store-law-likely-violates-first-amendment/","publisher":"Computer & Communications Industry Association","date":"2026-08-03"},{"label":"Computer & Communications Industry Association v. Paxton, W.D. Tex. 1:25-cv-01660, Fifth Circuit stay of the preliminary injunctions pending appeal","url":"https://www.courtlistener.com/docket/71664632/computer-communications-industry-association-v-paxton/","publisher":"CourtListener","date":"2026-06-04"},{"label":"Texas SB 2420 bill history, 89th Legislature","url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420","publisher":"Texas Legislature Online","date":"2025-05-27"}],"related_articles":[],"related_services":[],"last_verified":"2026-09-18"},{"id":"uk-vpn-age-checks-power","jurisdiction":"United Kingdom","jurisdiction_code":"GB","measure":"Children's Wellbeing and Schools Act 2026 s.70, power to extend age checks to internet services","topic":"age-verification","status":"passed","status_as_of":"2026-04-29","expires_on":null,"operative_from":null,"summary":"The House of Lords amendment on age assurance for VPN-style services did not stay a bare amendment. It became section 70 of the Children's Wellbeing and Schools Act 2026, enacted 29 April 2026, which is a regulation-making power rather than a duty that binds providers directly.","user_impact":"Section 70 does not itself require VPN age checks. In its published consultation response, the government says it will not ban or age-gate VPNs, while keeping circumvention under review.","sources":[{"label":"Growing up in the online world: government response, updated 19 August 2026","url":"https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026","publisher":"GOV.UK","date":"2026-08-19"},{"label":"Children's Wellbeing and Schools Act 2026, section 70","url":"https://www.legislation.gov.uk/ukpga/2026/21/section/70","publisher":"legislation.gov.uk","date":"2026-04-29"},{"label":"Children's Wellbeing and Schools Act 2026, contents and enactment record","url":"https://www.legislation.gov.uk/ukpga/2026/21/contents","publisher":"legislation.gov.uk","date":"2026-04-29"}],"related_articles":[],"related_services":[],"last_verified":"2026-09-18"},{"id":"us-ca-age-signal","jurisdiction":"California, United States","jurisdiction_code":"US-CA","measure":"AB 1043, operating-system age signals to applications","topic":"age-verification","status":"passed","status_as_of":"2025-10-13","expires_on":null,"operative_from":"2027-01-01","summary":"AB 1043 was approved on 13 October 2025 as Chapter 675 and becomes operative on 1 January 2027. Operating-system providers must offer an account-setup interface for a user's birth date, age, or both, and pass an age bracket to applications.","user_impact":"The duty starts in January 2027. Apps receive an age bracket rather than the underlying birth date. Existing devices must be offered the age-entry interface before 1 July 2027.","sources":[{"label":"California AB 1043, Chapter 675, Civil Code s.1798.505","url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043","publisher":"California Legislative Information","date":"2025-10-13"}],"related_articles":[],"related_services":[],"last_verified":"2026-09-18"},{"id":"eu-csar-detection-orders","jurisdiction":"European Union","jurisdiction_code":"EU","measure":"CSA Regulation (\"Chat Control\") mandatory detection orders","topic":"encryption","status":"negotiating","status_as_of":"2026-07-24","expires_on":null,"operative_from":null,"summary":"The Commission's May 2022 proposal for a permanent child sexual abuse regulation, which would allow detection orders, is still in interinstitutional negotiation. Regulation (EU) 2026/1881 records in its own recitals that those negotiations remain ongoing, which is why a further temporary derogation was needed.","user_impact":"The proposed detection-order system is not an adopted EU-wide requirement. Separate temporary rules allow providers to carry out voluntary detection. These are different measures.","sources":[{"label":"Regulation (EU) 2026/1881, recital 11: \"The interinstitutional negotiations on that proposal are still ongoing.\"","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601881","publisher":"Official Journal of the European Union","date":"2026-07-28"}],"related_articles":[],"related_services":[],"last_verified":"2026-09-18"}],"meta":{"total":11,"api_version":"1.3","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","attribution":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","cite_guide_url":"https://cunicula.com/en/cite","dataset_url":"https://cunicula.com/api/v1/dataset","schema_version":"1.1.0","last_verified":"2026-09-18","status_definitions":{"proposed":"Introduced, tabled, or published as a draft. No legal force. Includes amendments that were moved but not carried.","negotiating":"Formally under interinstitutional or inter-chamber negotiation. Text is not settled and no obligation exists yet.","passed":"Adopted or enacted, but the operative duty has not started applying yet.","in-force":"Adopted and the operative duty applies now.","under-challenge":"In force or partly in force, and being litigated. The duty can change on a court timetable.","lapsed":"Was in force and has expired, been repealed, or been withdrawn.","defeated":"Rejected, voted down, or abandoned without adoption."},"filters":{},"scope":"Selected encryption, age-verification, and data-protection measures with explicit legal status, primary sources, and present-day effect. This is not a complete global legislation database."}}