Reviewed 27 October 2026

65 laws. 341 requirements. Nothing hidden.

For every law we audit, the requirements that matter for a website or app, the provision behind each one, and exactly how an audit covers it. Where a scan can't see something, we say so, so you know what to confirm yourself.

European Union EU

GDPR

7 checked · 3 ai review · 2 your answers · 5 you confirm

In force since 25 May 2018.

Applies to: Anyone established in the EU, or offering goods or services to, or monitoring, people in the EU (Art. 3).

Requirement	Provision	How we cover it
A lawful basis for every use of personal data	Art. 6	AI review
A privacy notice at collection: identity and contact, purposes and legal basis, recipients, retention, rights, right to complain, transfers	Art. 12–14	Checked
The notice names every service that receives visitors' data	Art. 13(1)(e)	Checked
Consent is freely given, specific, informed and as easy to withdraw as to give	Art. 7	Checked
Explicit consent (or another Art. 9 condition) for health and other special-category dataApplies if you handle special-category data	Art. 9	Your answers
Parental consent for information-society services offered to children under 16 (or the national age, 13–16)Applies if children use the product	Art. 8	Your answers
People can access, correct, delete and port their data, and object	Art. 15–22	Checked
No solely automated decisions with legal or similar effects without safeguards	Art. 22	AI review
Security appropriate to the risk: encryption in transit, access control, no exposed secrets	Art. 32	Checked
Data protection by design and by default (collect only what's needed)	Art. 25	AI review
Written contracts with processors (hosting, analytics, email, AI providers)	Art. 28	You confirm
A record of processing activitiesApplies to 250+ staff, or processing that isn't occasional	Art. 30	You confirm
Breach notification to the authority within 72 hours and a response plan	Art. 33–34	Checked
A DPIA before high-risk processing (large-scale sensitive data, systematic monitoring, profiling)	Art. 35	You confirm
A DPO where core activities involve large-scale monitoring or special-category data	Art. 37	You confirm
Transfers outside the EEA rely on adequacy (e.g. EU–US Data Privacy Framework), SCCs or another Chapter V tool	Art. 44–49	Checked
An EU representative if you have no EU establishmentApplies if not established in the EU	Art. 27	You confirm

ePrivacy Directive

4 checked · 1 ai review · 2 your answers

In force; applied through each member state's law (e.g. Germany's TDDDG, France's CNIL guidance).

Applies to: Anyone storing or reading information on EU users' devices, and anyone sending electronic marketing.

Requirement	Provision	How we cover it
Prior consent before setting or reading non-essential cookies and similar storage (analytics, ads, replay)	Art. 5(3)	Checked
Rejecting is as easy as accepting, on the first layer of the banner (regulator guidance)	Art. 5(3); EDPB 03/2022	Checked
Trackers stay off after Reject	Art. 5(3)	Checked
Strictly necessary cookies are the only ones set before a choice	Art. 5(3)	Checked
Cookie information: what each cookie does and how long it lasts	Art. 5(3)	AI review
Prior consent for marketing emails, with a soft opt-in only for existing customers and similar productsApplies if you send marketing emails	Art. 13	Your answers
Every marketing email identifies the sender and has a free, working unsubscribeApplies if you send marketing emails	Art. 13(4)	Your answers

EU AI Act

1 checked · 1 ai review · 1 your answers · 3 you confirm

Prohibitions since 2 Feb 2025; general-purpose AI duties since 2 Aug 2025; Art. 50 transparency since 2 Aug 2026 (machine-readable marking: grace to 2 Dec 2026 for systems already on the market). High-risk duties postponed by the Digital Omnibus (Reg. 2026/1744) to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I).

Applies to: Providers and deployers of AI systems used in the EU.

Requirement	Provision	How we cover it
People are told they are interacting with an AI system (chatbots, assistants), unless it's obviousApplies if the product uses AI	Art. 50(1)	Checked
AI-generated audio, image, video or text is marked as AI-generated in a machine-readable wayApplies if you provide generative AI	Art. 50(2)	AI review
Deepfakes and AI text published to inform the public are disclosedApplies if you deploy such content	Art. 50(4)	You confirm
No prohibited practices (manipulative techniques, social scoring, emotion recognition at work or school, untargeted face scraping)	Art. 5	You confirm
Staff using AI have sufficient AI literacy	Art. 4	You confirm
High-risk uses (hiring, credit scoring, education, essential services) meet Chapter III dutiesApplies if AI is used for these decisions; from 2 Dec 2027	Art. 6 & Annex III	Your answers

Digital Services Act

1 ai review · 5 you confirm

Applies to all intermediary services since 17 Feb 2024. Micro and small enterprises are exempt from most online-platform duties (Art. 19), not from Art. 11–18.

Applies to: Intermediary services offered in the EU: hosting, online platforms and marketplaces (anything that stores or shares users' content).

Requirement	Provision	How we cover it
A single point of contact for authorities and one for users, published and easy to findApplies if users can post or store content	Art. 11–12	You confirm
A legal representative in the EU if not established thereApplies if users can post or store content	Art. 13	You confirm
Terms that explain content moderation, in plain languageApplies if users can post or store content	Art. 14	You confirm
A notice-and-action mechanism for reporting illegal content, and statements of reasons for removalsApplies to hosting services	Art. 16–17	You confirm
Platforms: no dark patterns, ad transparency (who paid, why shown), no profiling-based ads to minorsApplies to online platforms above small-enterprise size	Art. 25–28	AI review
Marketplaces: trader traceability and information shown to consumersApplies to online marketplaces	Art. 30–32	You confirm

European Accessibility Act

2 checked · 1 ai review

Applies to services provided to consumers from 28 June 2025 (existing contracts until they end, at most 5 years). Microenterprises providing services are exempt.

Applies to: E-commerce, consumer banking, e-books, electronic communications, passenger transport and audiovisual access services for EU consumers.

Requirement	Provision	How we cover it
The service meets accessibility requirements, in practice WCAG 2.1 AA / EN 301 549 (alt text, labels, keyboard use, contrast)Applies to consumer services in scope	Art. 4 & Annex I	Checked
Accessibility information is published: how the service meets the requirementsApplies to consumer services in scope	Art. 13(2) & Annex V	Checked
A way to report accessibility problems	Art. 13	AI review

Consumer Rights Directive

2 checked · 2 ai review · 1 you confirm

In force; amended by the Omnibus Directive 2019/2161.

Applies to: Traders selling to EU consumers at a distance (online).

Requirement	Provision	How we cover it
Before purchase: trader identity and address, total price with taxes, delivery, duration and cancellation of subscriptionsApplies if you sell to consumers	Art. 6	Checked
A 14-day right of withdrawal, and the model withdrawal form, unless an exception appliesApplies if you sell to consumers	Art. 9–11	Checked
The order button says "order with obligation to pay" or equivalentApplies if you sell to consumers	Art. 8(2)	AI review
Digital content: consent and acknowledgement before withdrawal rights are lostApplies to digital content and services	Art. 16(m)	You confirm
No pre-ticked boxes for extra paymentsApplies if you sell to consumers	Art. 22	AI review

United Kingdom UK

UK GDPR

5 checked · 2 ai review · 3 you confirm

In force; amended by the Data (Use and Access) Act 2025 (main provisions from 5 Feb 2026; complaints procedure from 19 June 2026).

Applies to: Anyone established in the UK or targeting or monitoring people in the UK.

Requirement	Provision	How we cover it
A lawful basis for each use; DUAA adds 'recognised legitimate interests' (no balancing test) for listed purposes	Art. 6	AI review
A privacy notice with identity, purposes and basis, recipients, retention, rights, complaints and transfers	Art. 13–14	Checked
People can access, correct and delete their data; searches for access requests must be reasonable and proportionate	Art. 15–17	Checked
A complaints procedure, with complaints acknowledged within 30 days	DPA 2018 s. 164A (DUAA)	You confirm
Security appropriate to the risk	Art. 32	Checked
Breach notification to the ICO within 72 hours	Art. 33	Checked
Automated decisions: significant decisions on special-category data need consent or another basis; others need safeguards (information, human review, contest)	Art. 22A–22D (DUAA)	AI review
International transfers: the destination's protection is 'not materially lower'	Ch. V (DUAA)	Checked
A UK representative if not established in the UKApplies if not established in the UK	Art. 27	You confirm
Pay the ICO data protection fee	DP (Charges and Information) Regs 2018	You confirm

Data Protection Act 2018

2 you confirm

In force; amended by DUAA 2025.

Applies to: Supplements UK GDPR (conditions for special-category data, exemptions, ICO powers).

Requirement	Provision	How we cover it
An appropriate policy document when processing special-category data under Schedule 1 conditionsApplies if you handle special-category data	Sch. 1 Part 4	You confirm
Criminal-offence data only under a Schedule 1 condition	s. 10–11	You confirm

PECR

2 checked · 2 your answers

In force; DUAA 2025 added consent exemptions (from 5 Feb 2026) and raised fines to UK GDPR levels.

Applies to: Cookies and similar technologies, and electronic marketing, for UK users.

Requirement	Provision	How we cover it
Consent before non-essential cookies; analytics used only for statistics may run without consent if users are told and can opt out	Reg. 6 (as amended)	Checked
Advertising and session-replay cookies always need consent	Reg. 6	Checked
Consent for marketing emails and texts to individuals (soft opt-in for customers; now also charities)Applies if you send marketing emails	Reg. 22	Your answers
Every marketing message identifies the sender and offers a simple opt-outApplies if you send marketing emails	Reg. 22–23	Your answers

Age Appropriate Design Code

1 ai review · 2 your answers · 2 you confirm

In force since 2 Sept 2021.

Applies to: Online services likely to be accessed by children under 18 in the UK.

Requirement	Provision	How we cover it
Assess whether children are likely to use the service, and their age	Std 3	Your answers
High privacy by default; geolocation and profiling off by defaultApplies if children use the product	Std 7, 10, 12	Your answers
No nudge techniques that weaken children's privacyApplies if children use the product	Std 13	AI review
Child-friendly privacy informationApplies if children use the product	Std 4	You confirm
A DPIA covering children's risksApplies if children use the product	Std 2	You confirm

Online Safety Act

1 your answers · 4 you confirm

Illegal-content duties from 17 Mar 2025; children's duties from 25 July 2025.

Applies to: User-to-user services (users can share content with each other) and search services with links to the UK.

Requirement	Provision	How we cover it
An illegal content risk assessment, kept up to dateApplies if users can share content	s. 9	You confirm
A children's access assessment; if children are likely to access, a children's risk assessmentApplies if users can share content	s. 35–36, 11	Your answers
Highly effective age assurance for pornographic or other primary priority contentApplies if such content is possible	s. 12, 81	You confirm
Easy ways to report content and complainApplies if users can share content	s. 20–21	You confirm
Terms of service that explain how users are protectedApplies if users can share content	s. 10(5)	You confirm

Switzerland CH

revFADP

6 checked · 2 you confirm

In force since 1 Sept 2023.

Applies to: Processing that has an effect in Switzerland, including by foreign companies.

Requirement	Provision	How we cover it
Inform people at collection: identity and contact, purposes, recipients, countries data goes to and safeguards	Art. 19	Checked
Cookies and trackers: inform users and let them refuse (opt-out), consent for sensitive profiling	TCA Art. 45c; Art. 6	Checked
Data security appropriate to the risk	Art. 8	Checked
Access and deletion/correction rights, answered within 30 days	Art. 25, 32	Checked
Transfers abroad only to adequate countries or with safeguards	Art. 16–17	Checked
Report breaches likely to cause high risk to the FDPIC as soon as possible	Art. 24	Checked
A Swiss representative for foreign companies processing large volumes regularlyApplies if not established in Switzerland	Art. 14	You confirm
A record of processing activities (unless under 250 staff and low risk)	Art. 12	You confirm

United States (federal) US

FTC Act §5

5 checked · 1 ai review

In force. The 2024 'click-to-cancel' rule was vacated on 8 July 2025; ROSCA still applies.

Applies to: Most businesses dealing with US consumers.

Requirement	Provision	How we cover it
The privacy notice is accurate: it matches the data the product collects and the services it uses	§5 (deception)	Checked
Reasonable data security	§5 (unfairness)	Checked
Claims are truthful and substantiated (no unsupported 'guaranteed', '#1', health claims)	§5; 16 CFR 255	Checked
Endorsements and testimonials reflect real experience and disclose material connections; no fake reviews	16 CFR 255; 16 CFR 465 (2024)	AI review
AI claims are accurate and AI use isn't hidden where it mattersApplies if the product uses AI	§5	Checked
Subscriptions: clear terms before billing, express consent, simple cancellationApplies if you sell subscriptions	ROSCA 15 U.S.C. §8403	Checked

COPPA

3 your answers · 3 you confirm

Amended rule in force 23 June 2025; full compliance required from 22 April 2026.

Applies to: Services directed to children under 13, or with actual knowledge they collect from under-13s.

Requirement	Provision	How we cover it
Verifiable parental consent before collecting children's personal informationApplies if children under 13 use the product	16 CFR 312.5	Your answers
Separate parental consent before disclosing children's data to third parties, including for targeted adsApplies if children under 13 use the product	312.5(a)(2) (2025)	Your answers
A notice naming the third parties (or categories) that receive children's dataApplies if children under 13 use the product	312.4	You confirm
A written data retention policy, published in the notice; delete when no longer neededApplies if children under 13 use the product	312.10	You confirm
A written information security program with annual risk assessmentsApplies if children under 13 use the product	312.8	You confirm
Parents can review and delete their child's data	312.6	Your answers

ADA Title III

2 checked · 1 you confirm

In force. No DOJ web rule for Title III (the 2024 rule covers state and local government); courts and DOJ guidance use WCAG as the benchmark.

Applies to: Businesses open to the public, including many websites and apps.

Requirement	Provision	How we cover it
Images have text alternatives; form fields have labels; the page language is set	WCAG 2.1 AA 1.1.1, 1.3.1, 3.1.1	Checked
Keyboard access, visible focus, colour contrast, captions for video	WCAG 2.1 AA	You confirm
A way for users to report access barriers	DOJ guidance	Checked

CAN-SPAM

2 your answers · 1 you confirm

In force.

Applies to: Anyone sending commercial email.

Requirement	Provision	How we cover it
Accurate sender and subject lines; the message is identified as an ad where requiredApplies if you send marketing emails	15 U.S.C. §7704(a)(1)–(2), (5)	Your answers
A working unsubscribe, honoured within 10 business daysApplies if you send marketing emails	§7704(a)(3)–(4)	Your answers
A valid physical postal address in every messageApplies if you send marketing emails	§7704(a)(5)(A)(iii)	You confirm

HIPAA (if health data)

2 checked · 1 your answers · 2 you confirm

In force. Health apps outside HIPAA fall under the FTC Health Breach Notification Rule (amended 2024).

Applies to: Covered entities (providers, plans, clearinghouses) and their business associates.

Requirement	Provision	How we cover it
Health information is collected only with appropriate consent and safeguardsApplies if you handle health data	45 CFR 164.502; FTC HBNR	Your answers
Business associate agreements with every vendor touching PHI (hosting, email, analytics, AI)Applies if you're a covered entity or business associate	45 CFR 164.504(e)	You confirm
No tracking pixels on pages with PHI without a BAA (HHS guidance)Applies if you handle health data	HHS tracking-technologies guidance	Checked
Security Rule safeguards and a risk analysisApplies if HIPAA applies	45 CFR 164.308–316	You confirm
Breach notification to individuals, HHS (or the FTC for non-HIPAA health apps)Applies if you handle health data	45 CFR 164.400–414; 16 CFR 318	Checked

GLBA (if financial)

2 checked · 1 you confirm

In force. FTC Safeguards Rule breach reporting (500+ consumers, within 30 days) since 13 May 2024.

Applies to: Financial institutions, including non-bank lenders, brokers, fintechs and tax preparers.

Requirement	Provision	How we cover it
A privacy notice explaining what financial data is shared and how to opt outApplies if you're a financial institution	Privacy Rule, 16 CFR 313	You confirm
A written information security program: risk assessment, MFA, encryption, a qualified individualApplies if you're a financial institution	Safeguards Rule, 16 CFR 314.4	Checked
Report security events involving 500+ consumers to the FTC within 30 daysApplies if you're a financial institution	16 CFR 314.4(j)	Checked

California US-CA

CCPA / CPRA

6 checked · 1 ai review · 3 your answers · 2 you confirm

In force. New regulations (ADMT, risk assessments, cybersecurity audits) effective 1 Jan 2026, with ADMT compliance from 1 Jan 2027 and audits phased 2028–2030.

Applies to: For-profit businesses with over ~$26.6M revenue, or that handle 100,000+ California consumers' data, or earn half their revenue from selling/sharing data.

Requirement	Provision	How we cover it
A privacy policy: categories collected, purposes, sources, recipients, rights and how to use them, updated every 12 months	§1798.100, .130; Regs §7011	Checked
A notice at collection where data is collected	§1798.100(a); Regs §7012	Checked
A "Do Not Sell or Share My Personal Information" link when sharing for cross-context ads	§1798.135	Checked
Honour Global Privacy Control as an opt-out of sale/sharing	Regs §7025	AI review
A "Limit the Use of My Sensitive Personal Information" link where sensitive data is used beyond what's necessaryApplies if you use sensitive personal information	§1798.121	Your answers
Rights to know, delete, correct and opt out, answered within 45 days, with two request methods	§1798.105–.130	Checked
Opt-in consent to sell or share data of consumers under 16Applies if under-16s use the product	§1798.120(c)	Your answers
Reasonable security (with a private right of action for breaches)	§1798.150; Civ. Code §1798.81.5	Checked
Contracts with service providers and contractors containing the required terms	§1798.100(d); Regs §7051	You confirm
Pre-use notice and opt-out for automated decision-making used for significant decisionsApplies if ADMT makes significant decisions	Regs §7220 (from 1 Jan 2027)	Your answers
Risk assessments for high-risk processing; cybersecurity audits for larger businesses	Regs §7150, §7120	You confirm
Consent flows free of dark patterns (symmetry of choice)	Regs §7004	Checked

CalOPPA

5 checked

In force.

Applies to: Any commercial website or app collecting personal information from California residents, at any size.

Requirement	Provision	How we cover it
A conspicuously posted privacy policy	B&P §22575(a)	Checked
It lists the categories collected and the third parties they're shared with	§22575(b)(1)	Checked
It says how users can review and correct their information, if offered	§22575(b)(2)	Checked
It says how the site responds to Do Not Track signals, and whether third parties track across sites	§22575(b)(5)–(6)	Checked
It has an effective date and explains how users are told of changes	§22575(b)(3)–(4)	Checked

California Age-Appropriate Design Code (partly enjoined)

2 your answers

The Ninth Circuit (Mar 2026) narrowed the injunction but kept the data-use and dark-patterns restrictions blocked; enforcement remains uncertain on remand.

Applies to: Online services likely to be accessed by children under 18.

Requirement	Provision	How we cover it
Estimate users' age or apply child-level protections to all usersApplies if children use the product	Civ. Code §1798.99.31(a)(5)	Your answers
High privacy settings by default for childrenApplies if children use the product	§1798.99.31(a)(6)	Your answers

Unruh Act (accessibility)

1 checked

In force; an ADA violation is an Unruh violation ($4,000 minimum statutory damages).

Applies to: Businesses serving Californians, including websites tied to them.

Requirement	Provision	How we cover it
The site is usable by people with disabilities (WCAG 2.1 AA as the benchmark)	Civ. Code §51(f), §52	Checked

Texas US-TX

Texas Data Privacy and Security Act

3 checked · 2 your answers · 2 you confirm

In force since 1 July 2024.

Applies to: Businesses in Texas or targeting Texans, except SBA-defined small businesses (who still need consent to sell sensitive data).

Requirement	Provision	How we cover it
A privacy notice: categories, purposes, how to exercise rights and appeal, third-party sharing, contact methods	§541.102(a)	Checked
"NOTICE: We may sell your sensitive personal data." where that happensApplies if you sell sensitive data	§541.102(b)	Your answers
Consent before processing sensitive dataApplies if you handle sensitive data	§541.101(b)(4)	Your answers
Rights to access, correct, delete, port and opt out of sale, targeted ads and profiling; respond within 45 days with an appeal	§541.051–.055	Checked
Reasonable data security	§541.101(b)(2)	Checked
Data protection assessments for targeted advertising, sales and sensitive data	§541.105	You confirm
Processor contracts with the required terms	§541.104	You confirm

Texas Disciplinary Rules of Professional Conduct Part VII (attorney advertising)

2 checked · 1 ai review · 1 you confirm

Current rules effective 1 July 2021.

Applies to: Texas lawyers and firms advertising legal services.

Requirement	Provision	How we cover it
File the website home page with the Advertising Review Committee within 10 days of publication, unless exempt	Rule 7.04(a); 7.05(b)	Checked
No false or misleading statements; results and testimonials carry disclaimers	Rules 7.01–7.02	Checked
The name of at least one responsible lawyer and the principal office location	Part VII rules	AI review
Keep copies of advertisements and filing records	Rule 7.04	You confirm

SCOPE Act (largely enjoined)

1 your answers · 1 you confirm

Monitoring/filtering, targeted-ad and age-verification provisions enjoined (Aug 2024, Feb 2025) pending final judgment.

Applies to: Digital services that let users socialise and post content, used by minors under 18.

Requirement	Provision	How we cover it
Let users register their age; limit data collection from known minorsApplies if minors use a social service	Bus. & Com. Code ch. 509	Your answers
Parental tools to manage a minor's settingsApplies if minors use a social service	ch. 509	You confirm

New York US-NY

NY SHIELD Act

2 checked

In force.

Applies to: Anyone holding private information of New York residents.

Requirement	Provision	How we cover it
Reasonable administrative, technical and physical safeguards	GBL §899-bb(2)	Checked
Breach notice to affected residents (within 30 days) and the Attorney General	GBL §899-aa	Checked

NY Rules of Professional Conduct 7.1

1 checked · 2 ai review · 1 you confirm

Rewritten effective 1 June 2026 on the ABA model: the former 'Attorney Advertising' label, retention and filing details are gone.

Applies to: New York lawyers and firms communicating about their services, including websites.

Requirement	Provision	How we cover it
No false or misleading communications, including results presented without context	Rule 7.1(a) & Cmt. [2]–[3]	Checked
No claim to be a certified specialist unless certified by an approved body, which is named	Rule 7.1(c)	AI review
The name and contact information of at least one responsible lawyer or firm	Rule 7.1(d)	AI review
Firm name, domain name and website meet Rule 7.5	Rule 7.5	You confirm

NYC Local Law 144 (AI hiring)

2 you confirm

Enforced since 5 July 2023.

Applies to: Employers and agencies using automated employment decision tools for NYC candidates.

Requirement	Provision	How we cover it
An independent bias audit within the past year, with a published summaryApplies if AI screens NYC job candidates	NYC Admin. Code §20-871	You confirm
Notice to candidates 10 business days before useApplies if AI screens NYC job candidates	§20-871(b)	You confirm

Virginia US-VA

VCDPA

3 checked · 1 your answers · 1 you confirm

In force since 1 Jan 2023. The 2025 social-media minors amendment (SB 854) is being challenged in court.

Applies to: Businesses handling data of 100,000+ Virginians a year, or 25,000+ while earning over half their revenue from selling data.

Requirement	Provision	How we cover it
A privacy notice: categories, purposes, rights and appeal, data shared and with whom	§59.1-578(C)	Checked
Rights to access, correct, delete, port and opt out of targeted ads, sale and profiling; appeals	§59.1-577	Checked
Consent for sensitive data; COPPA-compliant handling of children's data	§59.1-578(A)(5)	Your answers
Reasonable data security	§59.1-578(A)(3)	Checked
Data protection assessments for targeted ads, sale, profiling and sensitive data	§59.1-580	You confirm

Colorado US-CO

Colorado Privacy Act

3 checked · 1 ai review · 1 your answers · 1 you confirm

In force since 1 July 2023; children's data amendments since 1 Oct 2025.

Applies to: Businesses handling data of 100,000+ Coloradans a year, or 25,000+ while earning revenue from selling data.

Requirement	Provision	How we cover it
A privacy notice: categories, purposes, rights and appeal, sharing	C.R.S. §6-1-1308(1)	Checked
Honour universal opt-out signals such as Global Privacy Control	§6-1-1306(1)(a)(IV); Rule 5	AI review
Rights to access, correct, delete, port and opt out; appeals	§6-1-1306	Checked
Consent for sensitive data; no dark patterns in consent	§6-1-1308(7); Rule 7	Your answers
Reasonable security	§6-1-1308(5)	Checked
Data protection assessments for high-risk processing	§6-1-1309	You confirm

Colorado ADMT law (SB 26-189, from 1 Jan 2027)

1 your answers · 2 you confirm

Signed May 2026, repealing and replacing the 2024 Colorado AI Act (SB 24-205); effective 1 Jan 2027. The Attorney General won't enforce until rulemaking ends.

Applies to: Developers and deployers of automated decision-making technology that materially influences consequential decisions (jobs, housing, credit, education, health care, insurance, government services).

Requirement	Provision	How we cover it
Tell consumers when ADMT influences a consequential decision about themApplies if AI influences such decisions	SB 26-189	Your answers
Explain adverse decisions within 30 days and offer meaningful human reviewApplies if AI influences such decisions	SB 26-189	You confirm
Keep the records the law requiresApplies if AI influences such decisions	SB 26-189	You confirm

Illinois US-IL

BIPA

1 checked · 3 you confirm

In force; 2024 amendment (SB 2979) counts repeated collection from one person as one violation and allows electronic consent.

Applies to: Private entities collecting biometric identifiers (face geometry, fingerprints, voiceprints) of people in Illinois.

Requirement	Provision	How we cover it
A public written policy with a retention schedule and destruction guidelinesApplies if you collect biometrics	740 ILCS 14/15(a)	You confirm
Written (or electronic) informed consent before collectionApplies if you collect biometrics	14/15(b)	You confirm
No selling or profiting from biometric data; disclosure only with consentApplies if you collect biometrics	14/15(c)–(d)	You confirm
Reasonable care in storage and transmissionApplies if you collect biometrics	14/15(e)	Checked

Illinois AI Video Interview Act

2 you confirm

In force since 1 Jan 2020.

Applies to: Employers using AI to analyse video interviews of Illinois applicants.

Requirement	Provision	How we cover it
Tell applicants AI may be used, explain how it works, and get their consentApplies if AI analyses video interviews	820 ILCS 42/5	You confirm
Share videos only with those needed to evaluate; delete within 30 days on requestApplies if AI analyses video interviews	42/10–15	You confirm

Florida US-FL

Florida Digital Bill of Rights

2 checked · 2 your answers

In force since 1 July 2024.

Applies to: Businesses with over $1 billion in revenue meeting further tests (ads, app store or smart speaker); the sensitive-data sale notice applies more widely.

Requirement	Provision	How we cover it
A privacy notice: categories, purposes, how to exercise rights and appeal, third-party sharing; updated yearly	§501.711(1)	Checked
"NOTICE: This website may sell your sensitive personal data." where that happensApplies if you sell sensitive data	§501.711(2)	Your answers
Rights to access, correct, delete and opt out within 45 days	§501.705	Checked
Consent for sensitive data	§501.71	Your answers

Florida Bar Rule 4-7 (advertising)

1 checked · 1 ai review · 1 you confirm

In force.

Applies to: Florida lawyers and firms advertising legal services.

Requirement	Provision	How we cover it
File advertisements for review at least 20 days before use; lawyer websites are exempt from filing but must still comply	Rule 4-7.19(a); 4-7.20(g)	You confirm
No misleading content; past results only if objectively verifiable; testimonials restricted	Rule 4-7.13–4-7.14	Checked
Name of at least one responsible lawyer and the office location	Rule 4-7.12	AI review

Canada CA

PIPEDA

5 checked

In force (Bill C-27 died in Jan 2025; PIPEDA still applies).

Applies to: Private-sector organisations collecting personal information in commercial activity.

Requirement	Provision	How we cover it
Openness: a privacy policy explaining practices and naming the accountable person	Sch. 1, 4.1 & 4.8	Checked
Meaningful consent, express for sensitive information; opt-out only for low-risk uses	4.3; OPC guidelines	Checked
Safeguards appropriate to sensitivity	4.7	Checked
Access and correction on request within 30 days	4.9; s. 8	Checked
Record all breaches; report real-risk-of-significant-harm breaches to the OPC and individuals	s. 10.1	Checked

CASL

3 your answers · 1 you confirm

In force.

Applies to: Anyone sending commercial electronic messages to or from Canada.

Requirement	Provision	How we cover it
Express or implied consent before sending commercial messagesApplies if you send marketing emails	s. 6, 10	Your answers
Sender identification and contact details in every messageApplies if you send marketing emails	s. 6(2)(a)–(b)	You confirm
A working unsubscribe, honoured within 10 business daysApplies if you send marketing emails	s. 11	Your answers
Keep records of consentApplies if you send marketing emails	s. 13	Your answers

Quebec Law 25

5 checked · 1 ai review

Fully in force since 22 Sept 2024.

Applies to: Businesses collecting personal information of people in Quebec.

Requirement	Provision	How we cover it
Publish a privacy policy in clear terms, and the title and contact of the person in charge of personal information	Private Sector Act s. 3.2, 3.1	Checked
Tell users about tracking technologies that identify, locate or profile them and how to turn them off; CAI expects consent before profiling cookies	s. 8.1	Checked
Highest confidentiality settings by default (other than browser cookies)	s. 9.1	AI review
A privacy impact assessment before transferring data outside Quebec	s. 17	Checked
Report confidentiality incidents with a risk of serious injury to the CAI and individuals; keep a register	s. 3.5–3.8	Checked
Access, correction, de-indexing and portability rights	s. 27–28.1	Checked

AODA (Ontario)

2 checked

In force; web requirement since 1 Jan 2021.

Applies to: Ontario organisations with 50+ employees, and public sector bodies.

Requirement	Provision	How we cover it
Public websites meet WCAG 2.0 AA (except live captions and pre-recorded audio description)Applies to 50+ employees in Ontario	IASR O. Reg. 191/11 s. 14	Checked
Accessible feedback processesApplies to 50+ employees in Ontario	IASR s. 11	Checked

Brazil BR

LGPD

7 checked · 1 ai review · 1 your answers · 1 you confirm

In force; ANPD regulations on incidents (Res. 15/2024), the DPO (Res. 18/2024) and international transfers (Res. 19/2024, SCCs required by 22 Aug 2025).

Applies to: Processing in Brazil, of people in Brazil, or to offer goods or services there.

Requirement	Provision	How we cover it
A legal basis for each use (Art. 7) and for sensitive data (Art. 11)	Art. 7, 11	AI review
Clear information: purpose, form and duration, controller identity and contact, sharing, rights	Art. 9	Checked
Publish the identity and contact of the DPO (encarregado)	Art. 41 §1; Res. 18/2024	Checked
Consent for cookies that aren't necessary (ANPD cookie guidance)	Art. 7–8; ANPD guide 2022	Checked
Rights: confirmation, access, correction, deletion, portability, information on sharing	Art. 18	Checked
Children's data in their best interest, with parental consent for under-12sApplies if children use the product	Art. 14	Your answers
Security measures	Art. 46	Checked
Report security incidents to the ANPD and data subjects within 3 business days	Art. 48; Res. 15/2024	Checked
International transfers using ANPD standard contractual clauses or another Art. 33 mechanism	Art. 33; Res. 19/2024	Checked
A record of processing operations	Art. 37	You confirm

Consumer Defense Code

2 checked · 1 you confirm

In force; e-commerce decree 7.962/2013.

Applies to: Suppliers selling to consumers in Brazil.

Requirement	Provision	How we cover it
A 7-day right of withdrawal for purchases made outside a physical storeApplies if you sell to consumers	Art. 49	Checked
Company name, CNPJ/CPF, address and contact shown prominently on the siteApplies if you sell to consumers	Decree 7.962/2013 Art. 2	You confirm
No misleading or abusive advertising	Art. 37	Checked

Mexico MX

LFPDPPP

4 checked · 1 your answers

New law in force since 21 Mar 2025, replacing the 2010 law; the authority is now the Secretaría Anticorrupción y Buen Gobierno. Article numbers changed; check the DOF text.

Applies to: Private parties processing personal data in Mexico.

Requirement	Provision	How we cover it
A privacy notice (aviso de privacidad) at collection: identity and address, data processed, sensitive data, purposes (separating those needing consent), how to exercise ARCO rights	LFPDPPP 2025 (aviso de privacidad)	Checked
Consent: tacit for general data, express and written for sensitive data	LFPDPPP 2025 (consent)	Your answers
ARCO rights (access, rectification, cancellation, opposition), answered within 20 business days	LFPDPPP 2025 (ARCO)	Checked
Administrative, technical and physical security measures	LFPDPPP 2025 (security)	Checked
Notify data subjects of breaches that significantly affect their rights	LFPDPPP 2025 (security)	Checked

India IN

DPDP Act 2023 & DPDP Rules 2025

7 checked · 1 your answers · 1 you confirm

Rules notified 13 Nov 2025. Board and procedural rules in force; consent-manager rules from 13 Nov 2026; notice, consent, security, breach, children and rights obligations from 14 May 2027.

Applies to: Processing of digital personal data in India, and outside India when offering goods or services to people in India.

Requirement	Provision	How we cover it
A standalone notice before consent: itemised data, purposes, how to withdraw consent, exercise rights and complain to the BoardApplies from 14 May 2027	§5; Rule 3	Checked
Free, specific, informed, unambiguous consent, as easy to withdraw as to give	§6	Checked
Verifiable parental consent for under-18s; no tracking, behavioural monitoring or targeted ads to childrenApplies if under-18s use the product	§9; Rule 10	Your answers
Reasonable security safeguards (encryption, access control, logs kept for a year)	§8(5); Rule 6	Checked
Breach intimation to the Board and affected people without delay, with a detailed report within 72 hours	§8(6); Rule 7	Checked
Rights to access, correction, erasure, grievance redressal and nomination	§11–14	Checked
Publish the contact of a person who answers data questions (DPO for significant data fiduciaries)	§8(9); Rule 9	Checked
Grievances answered within 90 days	§13; Rule 14	You confirm
Transfers abroad allowed except to countries the government restricts	§16	Checked

IT Act 2000 & SPDI Rules

4 checked · 1 your answers

In force; the SPDI Rules will be superseded as DPDP obligations commence. CERT-In Directions 2022 apply.

Applies to: Bodies corporate handling sensitive personal data in India; all service providers for CERT-In.

Requirement	Provision	How we cover it
A published privacy policy covering the types of data, purposes and disclosure	SPDI Rule 4	Checked
A grievance officer named on the website, resolving complaints within a month	SPDI Rule 5(9)	Checked
Written consent for sensitive personal data (passwords, financial, health, biometrics)	SPDI Rule 5(1)	Your answers
Reasonable security practices (ISO 27001 or equivalent)	IT Act s. 43A; SPDI Rule 8	Checked
Report cyber incidents to CERT-In within 6 hours; keep logs for 180 days in India	CERT-In Directions 2022	Checked

Consumer Protection (E-Commerce) Rules

1 checked · 2 ai review · 2 you confirm

In force since July 2020; Guidelines for Prevention and Regulation of Dark Patterns 2023 (13 practices); CCPA self-audit advisory June 2025.

Applies to: E-commerce entities offering goods or services to consumers in India.

Requirement	Provision	How we cover it
Show legal name, address, customer care and grievance officer details prominentlyApplies if you sell online in India	Rule 4(2), 4(4)	You confirm
Acknowledge complaints within 48 hours and resolve within one monthApplies if you sell online in India	Rule 4(5)	You confirm
Explicit, affirmative consent for purchases: no pre-ticked boxesApplies if you sell online in India	Rule 4(9)	AI review
Clear prices, return, refund, exchange, warranty and delivery terms; country of originApplies if you sell online in India	Rule 5–6	Checked
No dark patterns: false urgency, basket sneaking, confirm-shaming, subscription traps, drip pricing and others	Dark Patterns Guidelines 2023	AI review

Bar Council of India Rule 36

4 checked

In force (BCI Rules Part VI Ch. II); 2008 amendment permits limited website information.

Applies to: Advocates enrolled in India.

Requirement	Provision	How we cover it
No soliciting work or advertising, directly or indirectly	Rule 36	Checked
A website limited to name, contact, enrolment, qualifications and areas of practice	Rule 36 (2008 proviso)	Checked
A disclaimer visitors accept before entry, confirming they seek information of their own accord	BCI practice	Checked
No testimonials, results, rankings or fees promotion	Rule 36	Checked

Singapore SG

PDPA

7 checked · 1 you confirm

In force; mandatory breach notification since 1 Feb 2021.

Applies to: Organisations collecting personal data in Singapore.

Requirement	Provision	How we cover it
Tell people the purposes before or at collection	s. 20	Checked
Consent (or deemed consent) for collection, use and disclosure, including cookies that collect personal data	s. 13–17	Checked
Make the DPO's business contact information publicly available	s. 11(5)	Checked
Access and correction requests	s. 21–22	Checked
Reasonable security arrangements	s. 24	Checked
Notify the PDPC within 3 calendar days of assessing a breach as notifiable (significant harm or 500+ people)	s. 26D	Checked
Transfers abroad only with comparable protection	s. 26	Checked
Check the Do Not Call Registry before marketing calls or textsApplies if you market by phone or SMS	Part 9	You confirm

Spam Control Act

1 your answers · 1 you confirm

In force.

Applies to: Unsolicited commercial electronic messages sent in bulk.

Requirement	Provision	How we cover it
An unsubscribe facility, and "<ADV>" in the subject line of unsolicited adsApplies if you send marketing emails	Second Schedule	Your answers
Accurate sender and header informationApplies if you send marketing emails	Second Schedule	You confirm

Australia AU

Privacy Act 1988 (APPs)

6 checked · 1 ai review · 2 your answers

In force; 2024 amendments: statutory privacy tort since 10 June 2025; automated-decision disclosures in privacy policies from 10 Dec 2026; Children's Online Privacy Code due by 10 Dec 2026.

Applies to: Organisations with over AUD 3M turnover, and smaller ones that handle health information or trade in personal information.

Requirement	Provision	How we cover it
A clearly expressed, up-to-date privacy policy: kinds of data, purposes, access and correction, complaints, overseas recipients and countries	APP 1.3–1.4	Checked
A collection notice at or before collection	APP 5	Checked
Consent for sensitive information	APP 3.3	Your answers
Direct marketing only with an easy opt-out	APP 7	Your answers
Reasonable steps to keep data secure	APP 11	Checked
Access and correction	APP 12–13	Checked
Overseas disclosure only with reasonable steps to ensure APP-level protection	APP 8	Checked
Notify eligible data breaches to the OAIC and individuals	Part IIIC	Checked
Say in the privacy policy where decisions are made by computer programs using personal informationApplies from 10 Dec 2026	APP 1.7–1.9	AI review

Spam Act 2003

2 your answers · 1 you confirm

In force.

Applies to: Commercial electronic messages with an Australian link.

Requirement	Provision	How we cover it
Consent (express or inferred) before sendingApplies if you send marketing emails	s. 16	Your answers
Accurate sender identificationApplies if you send marketing emails	s. 17	You confirm
A functional unsubscribe honoured within 5 business daysApplies if you send marketing emails	s. 18	Your answers

Australian Consumer Law

2 checked · 1 ai review · 1 you confirm

In force; unfair contract terms penalties since Nov 2023.

Applies to: Businesses dealing with Australian consumers.

Requirement	Provision	How we cover it
No misleading or deceptive conduct or false representations	s. 18, 29	Checked
Consumer guarantees can't be excluded; refund and terms information is clearApplies if you sell to consumers	s. 54–64	Checked
No unfair terms in standard-form contractsApplies if you sell to consumers	s. 23	You confirm
Total price shown (no drip pricing)Applies if you sell to consumers	s. 48	AI review

Japan JP

APPI

7 checked · 1 your answers

In force; 2022 amendments apply.

Applies to: Businesses handling personal information of people in Japan.

Requirement	Provision	How we cover it
Specify and publish purposes of use	Art. 17, 21	Checked
Publicly available matters: business name and address, purposes, request procedures, complaint contact	Art. 32	Checked
Consent for sensitive (special care-required) information	Art. 20(2)	Your answers
Security control measures	Art. 23	Checked
Report leaks of sensitive data, data risking financial harm, or 1,000+ people to the PPC and individuals	Art. 26	Checked
Consent and information for transfers to foreign third parties	Art. 28	Checked
Disclosure, correction and cessation requests	Art. 33–35	Checked
Tell users about external transmission of their data by cookies and similar tags	Telecommunications Business Act Art. 27-12	Checked

South Korea KR

PIPA

6 checked · 1 ai review · 1 your answers

In force; 2023 amendments (automated-decision rights since 15 Mar 2024). AI Basic Act in force since 22 Jan 2026 (fines after a grace period of at least a year).

Applies to: Personal information controllers handling data of people in Korea.

Requirement	Provision	How we cover it
A privacy policy: items collected, purposes, retention, third parties, rights, the privacy officer's name and contact	Art. 30	Checked
Separate consent for each purpose, with what's required and optional shown	Art. 15, 22	Checked
Designate a chief privacy officer	Art. 31	Checked
Parental consent for children under 14	Art. 22-2	Your answers
Safety measures (access control, encryption)	Art. 29	Checked
Breach notification to individuals and the PIPC within 72 hours	Art. 34	Checked
Rights to refuse or ask for an explanation of fully automated decisions	Art. 37-2	AI review
Tell users in advance that a service uses generative AI, and label AI-generated contentApplies if the product uses AI	AI Basic Act (transparency duties)	Checked

China CN

PIPL

6 checked · 1 your answers · 1 you confirm

In force since 1 Nov 2021; compliance-audit measures from 1 May 2025; cross-border certification measures from 1 Jan 2026.

Applies to: Processing in China, and abroad when offering products to or analysing people in China.

Requirement	Provision	How we cover it
Notice: handler name and contact, purposes, methods, categories, retention, how to exercise rights	Art. 17	Checked
Consent (separate consent for sensitive data, transfers abroad and public disclosure)	Art. 13–14, 29, 39	Checked
Guardian consent for under-14s	Art. 31	Your answers
Security measures and a PIPIA for sensitive data, automated decisions or transfers abroad	Art. 51, 55	Checked
Breach remediation and notification	Art. 57	Checked
Rights to access, copy, correct, delete and port	Art. 44–47	Checked
Cross-border transfers via security assessment, standard contract or certification (exemptions below thresholds)	Art. 38–39; Provisions 2024	Checked
A designated representative in China for foreign handlersApplies if processing from abroad	Art. 53	You confirm

Data Security Law

1 checked · 1 you confirm

In force since 1 Sept 2021.

Applies to: Data processing in China.

Requirement	Provision	How we cover it
A data security management system and risk monitoring	Art. 27, 29	You confirm
Report data security incidents to the authorities	Art. 29	Checked

Cybersecurity Law

1 checked · 2 you confirm

Amended law in force since 1 Jan 2026: fines up to RMB 10M and wider extraterritorial reach.

Applies to: Network operators in China.

Requirement	Provision	How we cover it
Technical security measures against attacks and intrusions	Art. 21	Checked
Network logs kept for at least 6 months	Art. 21(3)	You confirm
Real-name registration for services that publish user informationApplies if users publish content	Art. 24	You confirm

United Arab Emirates AE

PDPL (Federal Decree-Law 45/2021)

6 checked

In force since 2 Jan 2022, but executive regulations still not issued as of mid-2026, so penalties and procedures aren't operative.

Applies to: Processing of people in the UAE (outside free zones with their own laws).

Requirement	Provision	How we cover it
Information on purposes, recipients and rights before processing	Art. 13	Checked
Clear, specific consent, as easy to withdraw	Art. 4–6	Checked
Security measures	Art. 20	Checked
Breach notification to the Data Office	Art. 9	Checked
Rights to access, correction and erasure	Art. 13–15	Checked
Transfers abroad to adequate countries or with safeguards	Art. 22–23	Checked

DIFC Data Protection Law

4 checked · 2 you confirm

DIFC Law No. 5 of 2020; amended 15 July 2025 (private right of action, wider reach).

Applies to: Controllers and processors incorporated in, or processing in, the DIFC.

Requirement	Provision	How we cover it
Information to data subjects at collection	DP Law 2020, Part 4	Checked
A lawful basis and valid consent	DP Law 2020, Part 2	Checked
Security appropriate to the risk	DP Law 2020 (security)	Checked
Breach notification to the Commissioner	DP Law 2020 (breach)	Checked
A DPIA before high-risk processing (including AI and autonomous systems)	DP Law 2020 (DPIA); DP Regulations	You confirm
Notification of processing to the Commissioner	DP Law 2020 (notifications)	You confirm

Saudi Arabia SA

PDPL

6 checked · 1 you confirm

Fully enforced since 14 Sept 2024; violation committees imposing sanctions since 2026.

Applies to: Processing of personal data in Saudi Arabia, including by foreign companies.

Requirement	Provision	How we cover it
A privacy policy available before collection: purpose, data, methods, storage, destruction, rights	Art. 12	Checked
Consent where required, and separate consent for sensitive data	Art. 5–6	Checked
Security measures	Art. 19	Checked
Breach notification to SDAIA (72 hours under the Implementing Regulations)	Art. 20	Checked
Rights to information, access, correction and destruction	Art. 4	Checked
Transfers abroad only under the Transfer Regulations	Art. 29	Checked
Register with SDAIA and appoint a DPO where required	Implementing Regs	You confirm

South Africa ZA

POPIA

5 checked · 2 your answers · 1 you confirm

In force since 1 July 2021.

Applies to: Responsible parties processing personal information in South Africa.

Requirement	Provision	How we cover it
Notify people at collection: identity, purpose, recipients, transfers, rights including to complain to the Regulator	s. 18	Checked
A lawful justification, such as consent	s. 11	Checked
Opt-in consent for electronic direct marketing to new contacts; opt-out in every messageApplies if you send marketing emails	s. 69	Your answers
Security safeguards	s. 19	Checked
Notify the Regulator and people of security compromises as soon as reasonably possible	s. 22	Checked
Access and correction	s. 23–24	Checked
Special personal information only with an authorisation	s. 26–27	Your answers
Register the Information Officer with the Regulator; publish a PAIA manual	s. 55; PAIA s. 51	You confirm

Nigeria NG

NDPA 2023

6 checked · 1 you confirm

In force; General Application and Implementation Directive (GAID) 2025 issued 20 Mar 2025, effective Sept 2025, repealing the NDPR.

Applies to: Controllers and processors in Nigeria or processing data of people in Nigeria.

Requirement	Provision	How we cover it
A privacy notice: identity, contact, purposes and lawful basis, recipients, retention, rights, complaint to the Commission	s. 27; GAID	Checked
Consent that is freely given, specific and as easy to withdraw; cookie notices	s. 25–26; GAID	Checked
Security measures	s. 39	Checked
Breach notification to the Commission within 72 hours	s. 40	Checked
Rights to access, correction, erasure and portability	s. 34–38	Checked
Transfers abroad with adequate protection	s. 41–43	Checked
Register with the NDPC, appoint a DPO and file annual compliance audit returns if of major importanceApplies to data controllers of major importance	s. 44; GAID	You confirm

Everywhere (standards)

WCAG 2.2 AA

3 checked · 4 you confirm

W3C Recommendation (Oct 2023); the benchmark behind the ADA, EAA (via EN 301 549), AODA and Unruh.

Applies to: Every website and app.

Requirement	Provision	How we cover it
Text alternatives for images	1.1.1	Checked
Form fields have labels or instructions	1.3.1, 3.3.2	Checked
The page language is set	3.1.1	Checked
Colour contrast of at least 4.5:1 for text	1.4.3	You confirm
Everything works with a keyboard, with a visible focus indicator that isn't hidden	2.1.1, 2.4.7, 2.4.11	You confirm
Touch targets at least 24×24 px	2.5.8	You confirm
Captions for video	1.2.2	You confirm

OWASP Top 10:2025

7 checked · 1 ai review

Final 2025 edition; the reference for 'reasonable security' in most privacy laws.

Applies to: Every web application.

Requirement	Provision	How we cover it
A01 Broken access control: database rows restricted to their owners	A01	Checked
A02 Security misconfiguration: security headers set	A02	Checked
A03 Software supply chain failures: dependencies kept current	A03	AI review
A04 Cryptographic failures: HTTPS everywhere, no mixed content	A04	Checked
A05 Injection: no unsafe HTML rendering or eval	A05	Checked
A07 Authentication failures: tokens not exposed in local storage	A07	Checked
Secrets and API keys never shipped to the browser or committed	A02, A04	Checked
A09 Logging and alerting: a security contact and incident plan	A09	Checked

PCI DSS (if payments)

1 your answers · 2 you confirm

v4.0.1; future-dated requirements mandatory since 31 Mar 2025 (including payment-page script control, 6.4.3 and 11.6.1).

Applies to: Anyone taking card payments.

Requirement	Provision	How we cover it
Card data handled by a PCI-compliant processor (hosted checkout or fields), never by your own serverApplies if you take card payments	SAQ A eligibility	Your answers
Scripts on payment pages are inventoried, authorised and monitored for tamperingApplies if you take card payments	Req. 6.4.3, 11.6.1	You confirm
Card payments use strong customer authentication in the EU (PSD2) and tokenised card-on-file in India (RBI)Applies if you take card payments	PSD2 RTS; RBI 2021	You confirm

App store privacy requirements

4 checked

Apple App Store Review Guidelines and Google Play Developer Policy, as updated.

Applies to: Apps distributed through the Apple App Store or Google Play.

Requirement	Provision	How we cover it
A privacy manifest declaring required-reason APIs and tracking domains (iOS)Applies to iOS apps	Apple privacy manifest	Checked
App Tracking Transparency permission before tracking across apps (iOS)Applies to iOS apps	Guideline 5.1.2	Checked
Accurate privacy nutrition labels and Data safety sectionApplies to mobile apps	Guideline 5.1.1; Play Data safety	Checked
Users who can create an account can delete it in the appApplies to apps with accounts	Guideline 5.1.1(v); Play account deletion	Checked

These checklists cover what a law requires of a website or app, not every duty in it (employment, tax or sector rules are out of scope). They describe the law as of the review date, and they aren't legal advice: have a lawyer confirm how each applies to you. See also the provision map and the rulebook changelog.

Audit your product against these