Skip to content
CUNICULA

State vs Privacy Tech Tracker

What each government has actually done to private communication and identity, with the legal status stated precisely and the primary source attached.

10Measures
5In force
2Under challenge
3Not yet binding
Every row was read against its primary source on 2026-08-06. A measure that is proposed, in negotiation, or passed but not yet applying imposes nothing on you today, and this page says so rather than collapsing all of it into “the law”.

Status words

PROPOSED
Introduced, tabled, or published as a draft. No legal force. Includes amendments that were moved but not carried.
IN NEGOTIATION
Formally under interinstitutional or inter-chamber negotiation. Text is not settled and no obligation exists yet.
PASSED, NOT YET APPLYING
Adopted or enacted, but the operative duty has not started applying yet.
IN FORCE
Adopted and the operative duty applies now.
UNDER CHALLENGE
In force or partly in force, and being litigated. The duty can change on a court timetable.
LAPSED
Was in force and has expired, been repealed, or been withdrawn.
DEFEATED
Rejected, voted down, or abandoned without adoption.

European Union

Voluntary CSAM scanning derogation from ePrivacy (Regulation (EU) 2026/1881)

IN FORCE
Topic
Encryption
Status as of
2026-07-28
Expires
2028-04-03
Last verified
2026-08-06

The 2021 derogation that let providers voluntarily scan for child sexual abuse material expired on 3 April 2026 because the co-legislators did not agree an extension in time. A replacement regulation was adopted on 24 July 2026 and published on 28 July 2026; it applies until 3 April 2028.

What you face todayVoluntary scanning by messaging providers is again lawful in the EU until April 2028. It is permissive, not mandatory, and it does not require any provider to weaken end-to-end encryption.

CSA Regulation ("Chat Control") mandatory detection orders

IN NEGOTIATION
Topic
Encryption
Status as of
2026-07-24
Last verified
2026-08-06

The Commission's May 2022 proposal for a permanent child sexual abuse regulation, which would allow detection orders, is still in interinstitutional negotiation. Regulation (EU) 2026/1881 records in its own recitals that those negotiations remain ongoing, which is why a further temporary derogation was needed.

What you face todayNo detection order and no mandatory scanning of end-to-end encrypted messages is in force anywhere in the EU. Claims that Chat Control has passed are wrong; the file is unfinished.

Louisiana, United States

Act 481 (HB 570), app-store age verification for minors

IN FORCE
Topic
Age verification
Status as of
2026-07-01
Last verified
2026-08-06

Louisiana HB 570 was signed by the governor on 30 June 2026, became Act 481, and took effect on 1 July 2026.

What you face todayApp stores serving Louisiana users must apply the state's age-category and parental-consent process for minor accounts.

Utah, United States

App Store Accountability Act (SB 142), app-store age verification and parental consent

IN FORCE
Topic
Age verification
Status as of
2026-05-06
Last verified
2026-08-06

Utah's SB 142 phased its sections in from 2025, with the core app-store verification and parental-consent duties in sections 13-75-201 and 13-75-202 effective 6 May 2026. Two challenges filed in the District of Utah in February 2026 were both dismissed by stipulation on 21 April 2026, so the law is in force and not currently under active challenge.

What you face todayApp stores serving Utah users must verify an age category and obtain parental consent for minor accounts. The enforcement section, 13-75-401, takes effect 31 December 2026.

India

Digital Personal Data Protection Rules, 2025 under the DPDP Act, 2023

IN FORCE
Topic
Data protection
Status as of
2025-11-13
Last verified
2026-08-06

The DPDP Act, 2023 was enacted on 11 August 2023 and the DPDP Rules were notified on 13 November 2025, with a corrigendum on 11 December 2025. The rules phase obligations in rather than starting them all at once.

What you face todayThis is a consent and data-protection regime, not an encryption mandate. It does not require providers to weaken encryption or retain message content.

United Kingdom

Online Safety Act age assurance duties for pornography and harmful content

IN FORCE
Topic
Age verification
Status as of
2025-07-25
Last verified
2026-08-06

The children's safety duties requiring highly effective age assurance became enforceable in July 2025, with the sixth commencement regulations bringing the remaining provisions into force on 25 July 2025.

What you face todaySites in scope must run age checks before serving adult content to UK users. VPNs remain legal for adults and no measure restricts adult VPN use; the government's own explainer directs its VPN concern at platforms, not at users.

Investigatory Powers Act s.253 technical capability notice served on Apple

UNDER CHALLENGE
Topic
Encryption
Status as of
2026-08-04
Last verified
2026-08-06

A technical capability notice reported in February 2025 led Apple to withdraw Advanced Data Protection for new UK users. Privacy International records that the first notice was withdrawn and a second one, targeting British users, was issued in October 2025; Apple's original challenge was then dismissed for a change in circumstances. Apple confirmed a fresh Investigatory Powers Tribunal complaint in August 2026.

What you face todayAdvanced Data Protection still cannot be switched on by new UK users, so iCloud backups, Drive, and Photos are held under keys Apple can access. The tribunal timetable is a case management hearing in September 2026, with the Privacy International claim listed for December 2026.

Apple Advanced Data Protection and the UK Technical Capability Notice

Children's Wellbeing and Schools Act 2026 s.70, power to extend age checks to internet services

PASSED, NOT YET APPLYING
Topic
Age verification
Status as of
2026-04-29
Last verified
2026-08-06

The House of Lords amendment on age assurance for VPN-style services did not stay a bare amendment. It became section 70 of the Children's Wellbeing and Schools Act 2026, enacted 29 April 2026, which is a regulation-making power rather than a duty that binds providers directly.

What you face todayNothing changes for VPN users until regulations are actually made under the power. No such regulations have been made, so there is no age-check duty on VPN providers today.

Texas, United States

App Store Accountability Act (SB 2420), app-store age verification and parental consent

UNDER CHALLENGE
Topic
Age verification
Status as of
2026-01-01
Last verified
2026-08-06

Texas SB 2420 took effect on 1 January 2026 and was challenged in the Western District of Texas by the Computer & Communications Industry Association and by student plaintiffs. The district court entered preliminary injunctions, the Fifth Circuit administratively stayed them on 28 May 2026, and granted a stay pending appeal on 4 June 2026. The appeal is live.

What you face todayBecause the injunctions are stayed, the statute is operative today. App stores serving Texas users must place users in an age category and obtain parental consent for minors, and developers receive the resulting category signal. A Fifth Circuit ruling can change this.

California, United States

AB 1043, operating-system age signals to applications

PASSED, NOT YET APPLYING
Topic
Age verification
Status as of
2025-10-13
Applies from
2027-01-01
Last verified
2026-08-06

AB 1043 was approved on 13 October 2025 as Chapter 675 and becomes operative on 1 January 2027. It works differently from the app-store statutes: the operating system collects a birth date at account setup and passes an age bracket signal to applications.

What you face todayNothing applies yet. From January 2027, California device owners are asked for a birth date at setup, and apps receive a bracket rather than the underlying date. Existing devices must be offered the same interface before 1 July 2027.

Statuses on this page change on legislative and court timetables, not on a publishing schedule. Each row carries its own verification date so a stale row is visible rather than silently wrong.