What each government has actually done to private communication and identity, with the legal status stated precisely and the primary source attached.
Direct captures from official legislation, rulemaking and regulator sources. Each run records the source, retrieval date and response hash. Paused sources keep their last verified records and original retrieval dates. Last update: .
United States · Office of the Federal Register
Latest returned: Privacy Act of 1974; Systems of Records (Rulemaking, ).
European Union · Publications Office of the European Union
Latest returned: Judgment of the Court (First Chamber) of 3 September 2026.#A et autres v Latvijas Republikas Saeima.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016... (Judgment, ).
United Kingdom · The National Archives
Latest returned: The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (Legislation, ).
United Kingdom · UK Parliament
Latest returned: Protection of Children (Digital Safety and Data Protection) Bill (Bill, ).
United Kingdom · Information Commissioner's Office
Latest returned: Ogi Networks Limited (Regulator action, ).
Capture stateCollection paused: the UK privacy regulator blocks automated access and its enforcement RSS feed is unavailable. Records retain their last successful retrieval date.
Australia · Office of Parliamentary Counsel (Commonwealth of Australia)
Latest returned: Privacy Regulations 2025 (Legislation, ).
Australia · Office of the Australian Information Commissioner
Latest returned: Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) (Regulator decision, ).
Canada · Office of the Privacy Commissioner of Canada
Latest returned: Compliance Letter to the Office of the Privacy Commissioner of Canada (“OPC”) by Loblaw Companies Limited (“Loblaw”) (Regulator decision, ).
The 2021 derogation that let providers voluntarily scan for child sexual abuse material expired on 3 April 2026 because the co-legislators did not agree an extension in time. A replacement regulation was adopted on 24 July 2026, published on 28 July 2026 and entered into force on 31 July 2026; it applies until 3 April 2028.
What you face todayProviders may carry out voluntary CSAM detection under the derogation's conditions and applicable data-protection law until 3 April 2028. This is not a mandatory scanning duty and does not require providers to weaken end-to-end encryption.
DAC8 amends the administrative cooperation directive to make reporting crypto-asset service providers collect and report customer and transaction data to tax authorities, which then exchange it between member states. EUR-Lex records the directive as in force, with member states required to adopt the rules by 31 December 2025 and apply them from 1 January 2026. Services that are not themselves crypto-asset service providers can still expose users through partners that are: Bitrefill states that its own gift-card and top-up purchases fall outside DAC8, while the partners issuing its EU card do fall in scope, so crypto top-ups of that card are expected to be reported in Estonia.
What you face todayReporting providers collect identifying details and reportable crypto-transaction information for 2026 activity; reporting and exchange follow in 2027, generally using annual aggregates by crypto-asset rather than a transaction-by-transaction list. Bitrefill says its EU card partner requires tax residence and TIN details: pre-2026 card customers must supply them by 31 December 2026 or crypto transactions will be blocked from 1 January 2027. Ordinary Bitrefill.com purchases and euro card spending are outside the card reporting described in its FAQ.
The Commission's May 2022 proposal for a permanent child sexual abuse regulation remains under interinstitutional negotiation. Parliament's Legislative Observatory still records the file as awaiting its first-reading position; Parliament's September 2026 update describes ongoing trilogue negotiations. The proposed detection-order system is not an adopted EU-wide requirement.
What you face todayThe proposed detection-order system is not an adopted EU-wide requirement. Separate temporary rules allow providers to carry out voluntary detection. These are different measures.
Section 70 of the Children's Wellbeing and Schools Act 2026 came into force on 29 April 2026 under section 78(1)(b). It inserts a power to impose child-access restrictions on specified internet services by regulations; it does not itself impose VPN age checks.
What you face todaySection 70 does not itself require VPN age checks. In its published consultation response, the government says it will not ban or age-gate VPNs, while keeping circumvention under review.
From 25 July 2025, services allowing pornography must use highly effective age assurance to prevent children accessing it, alongside the Online Safety Act's children's safety protections. SI 2025/888 separately ended the former video-sharing-platform regime by commencing section 210.
What you face todayIn-scope services must check age before allowing access to pornography and protect children from the most harmful content. VPNs remain legal in the UK; the government's explainer places anti-circumvention responsibilities on platforms rather than making adult VPN use unlawful.
Apple no longer offers Advanced Data Protection to new UK users. Liberty's September case update confirms a second Apple challenge and a 17 September hearing. Its published submissions say the first notice was withdrawn and the original proceedings ended. The parties were awaiting a decision on whether the government could continue to neither confirm nor deny the second notice.
What you face todayNew UK users cannot enable Advanced Data Protection for iCloud Backup, Drive, Photos and the other affected categories. iMessage, FaceTime and categories encrypted end-to-end by default remain protected. The source check on 25 October found no later published outcome; the September case update is not a final ruling.
The DPDP Rules notification is dated 13 November 2025 and phases commencement: rules 1, 2 and 17–21 apply from Gazette publication, rule 4 after one year, and rules 3, 5–16, 22 and 23 after eighteen months. The Act's core processing and data-subject provisions are also deferred; this is not full commencement of the consent regime.
What you face todayThe core user-facing rules are not yet operative. They include consent and data-protection safeguards, but also minimum one-year retention of processed personal data, associated traffic data and processing logs under rule 8(3), once that rule commences. The rules do not direct providers to weaken encryption.
The Fifth Circuit's 4 June order stayed the injunctions against Texas SB 2420 while the appeal continued. On 6 July, the Supreme Court denied an application to lift that stay. CCIA's 3 August update said appeal arguments were scheduled for 4 August. No later merits decision was found in the published sources checked on 25 October.
What you face todayThe verified orders allowed Texas to enforce app-store age checks and parental-consent requirements during the appeal. A stay is not a final decision on the law. The current record does not establish a later appeal outcome.
Act 481 was signed on 30 June 2025 with a planned 1 July 2026 start. Act 185 (HB 977), signed on 15 May 2026, prevented Act 481 from taking effect and replaced it with app-store and developer requirements commencing on 1 July 2027.
What you face todayThese app-store age-category and parental-consent duties do not apply yet. From 1 July 2027, covered stores must verify age categories and obtain parental consent for minors' downloads, purchases, access to pre-loaded applications and enabling in-app purchases, subject to the replacement Act's terms.
Utah's HB 498, signed on 18 March 2026, amended the App Store Accountability Act and postponed the core app-store and developer duties in sections 13-76-201 and 13-76-202 to 6 May 2027. CCIA reports that it voluntarily dismissed its challenge in April 2026 after the amendment removed state-agency enforcement.
What you face todayThe core age-category verification and parental-consent duties do not apply yet. They begin on 6 May 2027, with existing-account verification due within 12 months after those obligations take effect. The amended private-action provisions also begin on 6 May 2027.
AB 1043 was approved on 13 October 2025 as Chapter 675 and becomes operative on 1 January 2027. Operating-system providers must offer an account-setup interface for a user's birth date, age, or both, and pass an age bracket to applications.
What you face todayThe duty starts in January 2027. Apps receive an age bracket rather than the underlying birth date. Existing devices must be offered the age-entry interface before 1 July 2027.
Statuses on this page change on legislative and court timetables, not on a publishing schedule. Each row carries its own verification date so a stale row is visible rather than silently wrong.
Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.
