Upcoming legal deadlines for websites and apps

India: DPDP Act 2023 & DPDP Rules 2025

Board and procedural rules in force; consent-manager rules from 13 Nov 2026; notice, consent, security, breach, children and rights obligations from 13 May 2027.

Chile: Chile Data Protection Law 21,719

Published 13 December 2024; due in force from 1 December 2026 with a new Personal Data Protection Agency.

European Union: EU AI Act

Art. 50 transparency since 2 Aug 2026 (machine-readable marking: grace to 2 Dec 2026 for systems already on the market). New Art. 5 bans on AI that generates non-consensual intimate images or child sexual abuse material apply from 2 Dec 2026.

European Union: Product Liability Directive (2024)

Member states must apply it by 9 December 2026, for products placed on the market after 9 December 2026; the 1985 directive keeps covering earlier products.

Australia: Privacy Act 1988 (APPs)

In force; 2024 amendments: statutory privacy tort since 10 June 2025; automated-decision disclosures in privacy policies from 10 Dec 2026; Children's Online Privacy Code due by 10 Dec 2026.

California: California Age-Appropriate Design Code (partly enjoined)

Text read from a non-official mirror; operative date believed 1 Jan 2027 (no urgency clause); to be re-checked on leginfo.

California: CCPA / CPRA

New regulations (ADMT, risk assessments, cybersecurity audits) effective 1 Jan 2026, with ADMT compliance from 1 Jan 2027 and audits phased 2028–2030.

Colorado: Colorado ADMT law (SB 26-189, from 1 Jan 2027)

Signed 14 May 2026, repealing and replacing the 2024 Colorado AI Act (SB 24-205); applies to decisions made from 1 Jan 2027. The Attorney General enforces it (no private lawsuits), must adopt rules by 1 Jan 2027, and gives a 60-day chance to fix a violation where a fix is possible until 1 Jan 2030.

Colorado: Colorado chatbot law (HB 26-1263)

Operator duties apply from 1 Jan 2027 and the annual report to the Attorney General from 1 Jul 2027.

Delaware: Delaware Personal Data Privacy Act

HB 380 (signed 2 Sep 2026) lowers the threshold to 10,000 residents (5,000 for businesses earning over 20% of revenue from selling data) from 1 Jan 2027.

United Kingdom: DMCC Act 2024 (consumer protection)

Unfair commercial practices rules and CMA direct fines (up to 10% of global turnover) since 6 Apr 2025; the subscription contract rules apply to contracts made from 1 Jan 2027 (draft regulations laid Oct 2026, awaiting Parliament's approval).

Louisiana: Louisiana Data Privacy Act

Applies from 1 Jan 2027 (Act 502 of 2026, SB 386). The Attorney General enforces it, with a 30-day chance to fix a violation from 1 Jan 2027 to 31 July 2027; no private lawsuits.

New York: NY General Business Law (automatic renewal, AI companions, algorithmic pricing)

AI companion safeguards (Art. 47) from 5 Nov 2025; algorithmic pricing disclosure (§349-a) from Nov 2025; unsafe AI companion features for minors (Art. 48, signed 28 Oct 2026) banned from 1 Jan 2027.

Oklahoma: Oklahoma Consumer Data Privacy Act

Applies from 1 Jan 2027 (SB 546, 2026).

European Union: EU Data Act

Connected products placed on the market after 12 September 2026 must make their data accessible by design; switching charges for cloud and SaaS services end on 12 January 2027.

Indonesia: Indonesia PDP Law (Law 27/2022)

Implementing regulation GR 33/2026 applies from 16 January 2027; the supervisory agency is still being set up.

Alabama: Alabama Personal Data Protection Act

Applies from 1 May 2027 (HB 351, 2026).

Utah: App Store Accountability Act (SB 142)

HB 498, signed 18 March 2026, moved developer duties to 6 May 2027 and removed state enforcement: minors harmed by a violation, and their parents, can sue.

India: DPDP Act 2023 & DPDP Rules 2025

Board and procedural rules in force; consent-manager rules from 13 Nov 2026; notice, consent, security, breach, children and rights obligations from 13 May 2027.

California: California AI laws (BOT Act, SB 243 companion chatbots, AI Transparency Act)

SB 243 from 1 Jan 2026 (annual reports from 1 July 2027);

Colorado: Colorado chatbot law (HB 26-1263)

Operator duties apply from 1 Jan 2027 and the annual report to the Attorney General from 1 Jul 2027.

Kentucky: Kentucky Consumer Data Protection Act

HB 692 (2026) adds rules on smart-TV (automatic content recognition) data from 1 Jul 2027.

Louisiana: Louisiana Data Privacy Act

The Attorney General enforces it, with a 30-day chance to fix a violation from 1 Jan 2027 to 31 July 2027; no private lawsuits.

Chile: Chile Data Protection Law 21,719

Law firms report it moves the start to 15 October 2027; we have not read that date in the bill text. 1 December 2026 holds until a postponement is published.

European Union: EU AI Act

High-risk duties postponed by the Digital Omnibus (Reg. 2026/1744) to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I).

European Union: Cyber Resilience Act

Vulnerability and incident reporting has applied since 11 September 2026, including for products already on the market (ENISA's single reporting platform is live); everything else, including CE marking, from 11 December 2027.

Vermont: Vermont Data Privacy and Online Surveillance Act

Applies from 1 Jan 2028 (Act 145 of 2026, S.71). The Attorney General enforces it, with a 60-day chance to fix a violation from 1 Jan 2028 to 30 June 2029; no private lawsuits.

European Union: EU AI Act

High-risk duties postponed by the Digital Omnibus (Reg. 2026/1744) to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I).

Vermont: Vermont Data Privacy and Online Surveillance Act

The Attorney General enforces it, with a 60-day chance to fix a violation from 1 Jan 2028 to 30 June 2029; no private lawsuits.

Colorado: Colorado ADMT law (SB 26-189, from 1 Jan 2027)

The Attorney General enforces it (no private lawsuits), must adopt rules by 1 Jan 2027, and gives a 60-day chance to fix a violation where a fix is possible until 1 Jan 2030.