safelaunch
Rulebook v2026.10.2

24 jurisdictions. 17 obligations. One map.

Each obligation is mapped to the exact provision in every jurisdiction where it applies. Universal standards — WCAG 2.2 AA, OWASP Top 10, PCI DSS (if payments) — apply everywhere.

Obligations we check

App store privacy requirements

0 jurisdictions mapped + universal

Privacy notice

24 jurisdictions mapped

Consent for cookies & tracking

21 jurisdictions mapped

Reasonable security safeguards

24 jurisdictions mapped + universal

Access, correction & deletion rights

21 jurisdictions mapped + universal

Children's privacy

10 jurisdictions mapped + universal

Digital accessibility

9 jurisdictions mapped + universal

Attorney advertising rules

13 jurisdictions mapped + universal

Commercial email & messaging

8 jurisdictions mapped + universal

AI transparency

8 jurisdictions mapped + universal

Sensitive & health data

16 jurisdictions mapped + universal

Card payment security

2 jurisdictions mapped + universal

Online consumer contracts

8 jurisdictions mapped + universal

Advertising claims

6 jurisdictions mapped + universal

"Do Not Sell or Share" link

5 jurisdictions mapped

Cross-border data transfer

10 jurisdictions mapped

Breach notification readiness

11 jurisdictions mapped + universal

Europe

European Union

EU
GDPRePrivacy DirectiveEU AI ActDigital Services ActEuropean Accessibility ActConsumer Rights Directive
14 mapped provisions
  • Privacy noticeGDPR Art. 13–14
  • Consent for cookies & trackingePrivacy Directive Art. 5(3); GDPR Art. 6(1)(a) & 7
  • Reasonable security safeguardsGDPR Art. 32
  • Access, correction & deletion rightsGDPR Art. 15–17
  • Children's privacyGDPR Art. 8
  • Digital accessibilityEuropean Accessibility Act (Dir. 2019/882), EN 301 549
  • Commercial email & messagingePrivacy Directive Art. 13
  • AI transparencyEU AI Act Art. 50 (applies from Aug 2026)
  • Sensitive & health dataGDPR Art. 9
  • Card payment securityPSD2 Strong Customer Authentication (RTS 2018/389)
  • Online consumer contractsConsumer Rights Directive 2011/83/EU Art. 6 & 9 (14-day withdrawal)
  • Advertising claimsUnfair Commercial Practices Directive 2005/29/EC
  • Cross-border data transferGDPR Ch. V (Art. 44–49)
  • Breach notification readinessGDPR Art. 33–34 (72 hours)

United Kingdom

UK
UK GDPRData Protection Act 2018PECRAge Appropriate Design CodeOnline Safety Act
13 mapped provisions
  • Privacy noticeUK GDPR Art. 13–14
  • Consent for cookies & trackingPECR Reg. 6; UK GDPR Art. 7
  • Reasonable security safeguardsUK GDPR Art. 32
  • Access, correction & deletion rightsUK GDPR Art. 15–17
  • Children's privacyAge Appropriate Design Code (Children's Code)
  • Digital accessibilityEquality Act 2010 §20 & §29
  • Attorney advertising rulesSRA Code of Conduct 8.6–8.11; SRA Transparency Rules
  • Commercial email & messagingPECR Reg. 22
  • Sensitive & health dataUK GDPR Art. 9
  • Online consumer contractsConsumer Contracts Regulations 2013; DMCC Act 2024
  • Advertising claimsCAP Code; DMCC Act 2024 Part 4
  • Cross-border data transferUK GDPR Ch. V; IDTA
  • Breach notification readinessUK GDPR Art. 33–34

Switzerland

CH
revFADP
5 mapped provisions
  • Privacy noticerevFADP Art. 19
  • Consent for cookies & trackingTCA Art. 45c; revFADP Art. 6
  • Reasonable security safeguardsrevFADP Art. 8
  • Access, correction & deletion rightsrevFADP Art. 25 & 32
  • Cross-border data transferrevFADP Art. 16

Americas

United States (federal)

US
FTC Act §5COPPAADA Title IIICAN-SPAMHIPAA (if health data)GLBA (if financial)
11 mapped provisions
  • Privacy noticeFTC Act §5 (unfair or deceptive practices)
  • Reasonable security safeguardsFTC Act §5 (data security)
  • Children's privacyCOPPA, 16 CFR Part 312
  • Digital accessibilityADA Title III (WCAG 2.1 AA as de facto standard)
  • Attorney advertising rulesABA Model Rules 7.1–7.3
  • Commercial email & messagingCAN-SPAM Act, 15 U.S.C. §7704
  • AI transparencyFTC Act §5 (AI claims and disclosures)
  • Sensitive & health dataFTC Health Breach Notification Rule, 16 CFR 318; HIPAA if a covered entity
  • Online consumer contractsFTC Negative Option Rule; ROSCA 15 U.S.C. §8403
  • Advertising claimsFTC Act §5; FTC Endorsement Guides 16 CFR 255
  • Breach notification readinessState breach laws; FTC HBNR

Canada

CA
PIPEDACASLQuebec Law 25AODA (Ontario)
9 mapped provisions
  • Privacy noticePIPEDA Sch. 1 Principle 4.8; Quebec Law 25 s. 3.2
  • Consent for cookies & trackingPIPEDA Principle 4.3; Quebec Law 25 s. 8.1
  • Reasonable security safeguardsPIPEDA Principle 4.7
  • Access, correction & deletion rightsPIPEDA Principle 4.9; Quebec Law 25 s. 28
  • Digital accessibilityAccessible Canada Act; AODA (Ontario) IASR §14
  • Attorney advertising rulesLaw Society Model Code r. 4.2
  • Commercial email & messagingCASL s. 6 & 11
  • Advertising claimsCompetition Act s. 52 & 74.01
  • Breach notification readinessPIPEDA s. 10.1

Brazil

BR
LGPDConsumer Defense Code
10 mapped provisions
  • Privacy noticeLGPD Art. 9
  • Consent for cookies & trackingLGPD Art. 7–8
  • Reasonable security safeguardsLGPD Art. 46
  • Access, correction & deletion rightsLGPD Art. 18
  • Children's privacyLGPD Art. 14
  • Commercial email & messagingLGPD Art. 7(I)
  • Sensitive & health dataLGPD Art. 11
  • Online consumer contractsConsumer Defense Code Art. 49
  • Cross-border data transferLGPD Art. 33
  • Breach notification readinessLGPD Art. 48

Mexico

MX
LFPDPPP
4 mapped provisions
  • Privacy noticeLFPDPPP Art. 15–16
  • Consent for cookies & trackingLFPDPPP Art. 8
  • Reasonable security safeguardsLFPDPPP Art. 19
  • Access, correction & deletion rightsLFPDPPP Art. 22 (ARCO rights)

US States

California

US-CA
CCPA / CPRACalOPPACalifornia Age-Appropriate Design CodeUnruh Act (accessibility)
11 mapped provisions
  • Privacy noticeCalOPPA B&P §22575; CCPA §1798.100(a)
  • Consent for cookies & trackingCCPA §1798.120 & §1798.135 (opt-out of sharing; honour GPC)
  • Reasonable security safeguardsCiv. Code §1798.81.5; CCPA §1798.150
  • Access, correction & deletion rightsCCPA §1798.105–106
  • Children's privacyCalifornia Age-Appropriate Design Code Act
  • Digital accessibilityUnruh Civil Rights Act, Civ. Code §51
  • Attorney advertising rulesCalifornia RPC 7.1–7.3; B&P Code §6157–6158
  • AI transparencyBOT Act B&P §17941; AI Transparency Act (SB 942)
  • Sensitive & health dataCCPA §1798.121; CMIA Civ. Code §56
  • Online consumer contractsAutomatic Renewal Law, B&P §17600–17606
  • "Do Not Sell or Share" linkCCPA §1798.135(a)

Texas

US-TX
Texas Data Privacy and Security ActTexas Disciplinary Rules of Professional Conduct Part VII (attorney advertising)SCOPE Act
9 mapped provisions
  • Privacy noticeTDPSA Bus. & Com. Code §541.102
  • Consent for cookies & trackingTDPSA §541.051(b)(5) (targeted advertising opt-out)
  • Reasonable security safeguardsTDPSA §541.101(b)(2); Bus. & Com. Code §521.052
  • Access, correction & deletion rightsTDPSA §541.051
  • Children's privacySCOPE Act (HB 18)
  • Attorney advertising rulesTexas Disciplinary Rules of Prof. Conduct 7.01–7.07 (Rule 7.05 filing with the Advertising Review Committee)
  • Sensitive & health dataTDPSA §541.101(b)(4) (consent for sensitive data)
  • "Do Not Sell or Share" linkTDPSA §541.055
  • Breach notification readinessBus. & Com. Code §521.053 (60 days)

New York

US-NY
NY SHIELD ActNY Rules of Professional Conduct 7.1NYC Local Law 144 (AI hiring)
7 mapped provisions
  • Privacy noticeNY GBL §899-bb; FTC Act §5
  • Reasonable security safeguardsSHIELD Act GBL §899-bb(2)
  • Digital accessibilityNYS Human Rights Law §296
  • Attorney advertising rulesNY Rules of Prof. Conduct 7.1 ("Attorney Advertising" label, past-results disclaimer, 1-year retention)
  • AI transparencyNYC Local Law 144 (if used in hiring)
  • Sensitive & health dataNY Health Information Privacy Act
  • Breach notification readinessGBL §899-aa

Virginia

US-VA
VCDPA
7 mapped provisions
  • Privacy noticeVCDPA §59.1-578(C)
  • Consent for cookies & trackingVCDPA §59.1-577(A)(5)
  • Reasonable security safeguardsVCDPA §59.1-578(A)(3)
  • Access, correction & deletion rightsVCDPA §59.1-577
  • Attorney advertising rulesVirginia RPC 7.1
  • Sensitive & health dataVCDPA §59.1-578(A)(5)
  • "Do Not Sell or Share" linkVCDPA §59.1-577(A)(5)

Colorado

US-CO
Colorado Privacy ActColorado AI Act
8 mapped provisions
  • Privacy noticeCPA C.R.S. §6-1-1308(1)
  • Consent for cookies & trackingCPA §6-1-1306(1)(a)(IV) (universal opt-out signal)
  • Reasonable security safeguardsCPA §6-1-1308(5)
  • Access, correction & deletion rightsCPA §6-1-1306
  • Attorney advertising rulesColorado RPC 7.1
  • AI transparencyColorado AI Act, C.R.S. §6-1-1701 et seq.
  • Sensitive & health dataCPA §6-1-1308(7)
  • "Do Not Sell or Share" linkCPA §6-1-1306(1)(a)

Illinois

US-IL
BIPAIllinois AI Video Interview Act
5 mapped provisions
  • Privacy noticePIPA 815 ILCS 530
  • Reasonable security safeguardsPIPA 815 ILCS 530/45
  • Attorney advertising rulesIllinois RPC 7.1–7.5
  • AI transparencyIllinois AI Video Interview Act (if used in hiring)
  • Sensitive & health dataBIPA 740 ILCS 14 (if biometrics)

Florida

US-FL
Florida Digital Bill of RightsFlorida Bar Rule 4-7 (advertising)
7 mapped provisions
  • Privacy noticeFDBR §501.711
  • Consent for cookies & trackingFDBR §501.705
  • Reasonable security safeguardsFla. Stat. §501.171(2)
  • Access, correction & deletion rightsFDBR §501.705
  • Attorney advertising rulesRules Regulating The Florida Bar 4-7.11–4-7.19 (Rule 4-7.19 filing)
  • Sensitive & health dataFDBR §501.71(2)
  • "Do Not Sell or Share" linkFDBR §501.705(2)

Asia-Pacific

India

IN
DPDP Act 2023IT Act 2000 & SPDI RulesConsumer Protection (E-Commerce) RulesBar Council of India Rule 36
14 mapped provisions
  • Privacy noticeDPDP Act 2023 §5; DPDP Rules 2025 Rule 3
  • Consent for cookies & trackingDPDP Act 2023 §6
  • Reasonable security safeguardsDPDP Act 2023 §8(5); DPDP Rules 2025 Rule 6
  • Access, correction & deletion rightsDPDP Act 2023 §11–13
  • Children's privacyDPDP Act 2023 §9 (under-18 parental consent)
  • Digital accessibilityRPwD Act 2016 §40 & §46
  • Attorney advertising rulesBar Council of India Rules, Part VI Ch. II, Rule 36
  • Commercial email & messagingDPDP Act 2023 §6; TRAI TCCCPR 2018
  • Sensitive & health dataDPDP Act 2023 §6
  • Card payment securityRBI Card-on-File Tokenisation Directions 2021
  • Online consumer contractsConsumer Protection (E-Commerce) Rules 2020, Rule 4–6
  • Advertising claimsConsumer Protection Act 2019 §2(28); CCPA Guidelines on Misleading Ads 2022
  • Cross-border data transferDPDP Act 2023 §16
  • Breach notification readinessDPDP Act 2023 §8(6); CERT-In Directions 2022 (6 hours)

Singapore

SG
PDPASpam Control Act
7 mapped provisions
  • Privacy noticePDPA §20
  • Consent for cookies & trackingPDPA §13–14
  • Reasonable security safeguardsPDPA §24
  • Access, correction & deletion rightsPDPA §21–22
  • Attorney advertising rulesLegal Profession (Publicity) Rules 2015
  • Commercial email & messagingSpam Control Act s. 11
  • Breach notification readinessPDPA §26D (3 days)

Australia

AU
Privacy Act 1988 (APPs)Spam Act 2003Australian Consumer Law
11 mapped provisions
  • Privacy noticePrivacy Act 1988, APP 1 & 5
  • Consent for cookies & trackingAPP 7
  • Reasonable security safeguardsAPP 11
  • Access, correction & deletion rightsAPP 12–13
  • Children's privacyOnline Safety Act 2021
  • Digital accessibilityDisability Discrimination Act 1992 §24
  • Attorney advertising rulesLegal Profession Uniform Conduct Rules r. 36
  • Commercial email & messagingSpam Act 2003 s. 16–18
  • Online consumer contractsAustralian Consumer Law s. 18 & 29
  • Advertising claimsAustralian Consumer Law s. 18
  • Breach notification readinessNotifiable Data Breaches scheme (Part IIIC)

Japan

JP
APPI
6 mapped provisions
  • Privacy noticeAPPI Art. 21 & 32
  • Consent for cookies & trackingTelecommunications Business Act Art. 27-12
  • Reasonable security safeguardsAPPI Art. 23
  • Access, correction & deletion rightsAPPI Art. 33–35
  • Digital accessibilityAct for Eliminating Discrimination against Persons with Disabilities
  • Sensitive & health dataAPPI Art. 20(2)

South Korea

KR
PIPA
8 mapped provisions
  • Privacy noticePIPA Art. 30
  • Consent for cookies & trackingPIPA Art. 15 & 22
  • Reasonable security safeguardsPIPA Art. 29
  • Access, correction & deletion rightsPIPA Art. 35–37
  • Children's privacyPIPA Art. 22-2
  • AI transparencyAI Basic Act (2026)
  • Sensitive & health dataPIPA Art. 23
  • Cross-border data transferPIPA Art. 28-8

China

CN
PIPLData Security LawCybersecurity Law
10 mapped provisions
  • Privacy noticePIPL Art. 17
  • Consent for cookies & trackingPIPL Art. 13–14
  • Reasonable security safeguardsPIPL Art. 51; Cybersecurity Law Art. 21
  • Access, correction & deletion rightsPIPL Art. 44–47
  • Children's privacyPIPL Art. 28 & 31
  • AI transparencyMeasures for Labelling AI-Generated Content (2025); Generative AI Measures Art. 12
  • Sensitive & health dataPIPL Art. 28–29
  • Online consumer contractsE-Commerce Law Art. 17 & 19
  • Cross-border data transferPIPL Art. 38–39; Cross-border Data Flow Provisions 2024
  • Breach notification readinessPIPL Art. 57

Middle East & Africa

United Arab Emirates

AE
PDPL (Federal Decree-Law 45/2021)DIFC Data Protection Law
5 mapped provisions
  • Privacy noticePDPL Art. 13
  • Consent for cookies & trackingPDPL Art. 4–6
  • Reasonable security safeguardsPDPL Art. 20
  • Access, correction & deletion rightsPDPL Art. 13–15
  • Cross-border data transferPDPL Art. 22–23

Saudi Arabia

SA
PDPL
5 mapped provisions
  • Privacy noticePDPL Art. 12
  • Consent for cookies & trackingPDPL Art. 5–6
  • Reasonable security safeguardsPDPL Art. 19
  • Access, correction & deletion rightsPDPL Art. 4
  • Cross-border data transferPDPL Art. 29

South Africa

ZA
POPIA
5 mapped provisions
  • Privacy noticePOPIA §18
  • Consent for cookies & trackingPOPIA §11
  • Reasonable security safeguardsPOPIA §19
  • Access, correction & deletion rightsPOPIA §23–24
  • Sensitive & health dataPOPIA §26–27

Nigeria

NG
NDPA 2023
5 mapped provisions
  • Privacy noticeNDPA 2023 §27
  • Consent for cookies & trackingNDPA 2023 §25–26
  • Reasonable security safeguardsNDPA 2023 §39
  • Access, correction & deletion rightsNDPA 2023 §34–36
  • Cross-border data transferNDPA 2023 §41–43

Missing a country or a professional rule? Every rulebook release adds more.

Start an audit