Rulebook v2026.10.2
The rules we check, and when they changed.
196 mapped provisions from 61 laws across 24 jurisdictions, evaluated by 29 automated checks.
Cited to the source
Every obligation maps to a specific article or section per jurisdiction. Findings cite those provisions, not paraphrases.
Tested before release
Each change runs against a labelled eval suite of real-world patterns; a release ships only if no expected check is missed and no forbidden one fires.
Versioned, never edited
Changes publish as a new dated version. Every report and sign-off names the version it was checked against, so old results stay reproducible.
Legal review status
Mappings are SafeLaunch's reading of the law. Independent review by qualified lawyers in each jurisdiction is being arranged; this page will mark each reviewed jurisdiction and date.
Changelog
2026-10-27 · v2026.10.2
Fewer false positives on public websites.
- Third-party services are detected from what a page loads (scripts, frames, pixels, checkout links), not from text that mentions them.
- Marketing-claim checks ignore negated statements ("we do not guarantee…") and legal pages.
- Lawyer-advertising rules need at least two signs of a practice advertising itself, so sites that write about lawyers aren't treated as law firms.
- AI-disclosure, cross-border and breach-readiness checks now pass when the site already discloses AI use, explains international transfers, or publishes a security.txt (now also fetched during URL scans).
- On URL-only scans, a payment processor that isn't visible on public pages is raised as a low-severity check rather than a high-severity gap.
2026-10-26 · v2026.10.1
Mobile apps, consent timing and app-store rules.
- New obligation: app store privacy requirements (Apple App Store Review Guidelines 5.1.1–5.1.2 and privacy manifests; Google Play User Data policy and Data safety).
- New check: trackers that load before the visitor answers the cookie banner (no Consent Mode default of denied, no blocked tags).
- New checks for iOS apps: missing privacy manifest; ad or attribution SDKs without an App Tracking Transparency prompt.
- New check for iOS and Android apps: store privacy labels / Data safety must match declared permissions and bundled SDKs.
- URL scans now read up to eight same-site pages, including sign-up, contact and checkout pages.
- AI-suggested findings are kept only when they cite a law the rulebook knows for that jurisdiction.
2026-10-01 · v2026.10
First public rulebook.
- 24 jurisdictions and 16 obligations: privacy notices, cookie consent, security, data rights, children, accessibility, attorney advertising, email marketing, AI transparency, sensitive data, payments, consumer contracts, marketing claims, sale/sharing opt-out, cross-border transfers and breach notification.
- Deterministic checks for secrets in code, database row-level security, security headers, HTTPS and mixed content, XSS sinks and token storage.
Obligations
Per-jurisdiction citations are on the coverage page.
App store privacy requirements
Applies everywhere · show citationshide
- allApple App Store Review Guidelines 5.1.1–5.1.2 & privacy manifest requirement; Google Play User Data policy & Data safety section
Privacy notice
24 jurisdictions · show citationshide
- EUGDPR Art. 13–14
- UKUK GDPR Art. 13–14
- CHrevFADP Art. 19
- USFTC Act §5 (unfair or deceptive practices)
- US-CACalOPPA B&P §22575; CCPA §1798.100(a)
- US-TXTDPSA Bus. & Com. Code §541.102
- US-NYNY GBL §899-bb; FTC Act §5
- US-VAVCDPA §59.1-578(C)
- US-COCPA C.R.S. §6-1-1308(1)
- US-ILPIPA 815 ILCS 530
- US-FLFDBR §501.711
- CAPIPEDA Sch. 1 Principle 4.8; Quebec Law 25 s. 3.2
- BRLGPD Art. 9
- MXLFPDPPP Art. 15–16
- INDPDP Act 2023 §5; DPDP Rules 2025 Rule 3
- SGPDPA §20
- AUPrivacy Act 1988, APP 1 & 5
- JPAPPI Art. 21 & 32
- KRPIPA Art. 30
- CNPIPL Art. 17
- AEPDPL Art. 13
- SAPDPL Art. 12
- ZAPOPIA §18
- NGNDPA 2023 §27
Consent for cookies & tracking
21 jurisdictions · show citationshide
- EUePrivacy Directive Art. 5(3); GDPR Art. 6(1)(a) & 7
- UKPECR Reg. 6; UK GDPR Art. 7
- CHTCA Art. 45c; revFADP Art. 6
- US-CACCPA §1798.120 & §1798.135 (opt-out of sharing; honour GPC)
- US-TXTDPSA §541.051(b)(5) (targeted advertising opt-out)
- US-COCPA §6-1-1306(1)(a)(IV) (universal opt-out signal)
- US-VAVCDPA §59.1-577(A)(5)
- US-FLFDBR §501.705
- CAPIPEDA Principle 4.3; Quebec Law 25 s. 8.1
- BRLGPD Art. 7–8
- INDPDP Act 2023 §6
- SGPDPA §13–14
- AUAPP 7
- JPTelecommunications Business Act Art. 27-12
- KRPIPA Art. 15 & 22
- CNPIPL Art. 13–14
- AEPDPL Art. 4–6
- SAPDPL Art. 5–6
- ZAPOPIA §11
- NGNDPA 2023 §25–26
- MXLFPDPPP Art. 8
Reasonable security safeguards
24 jurisdictions · show citationshide
- EUGDPR Art. 32
- UKUK GDPR Art. 32
- CHrevFADP Art. 8
- USFTC Act §5 (data security)
- US-CACiv. Code §1798.81.5; CCPA §1798.150
- US-TXTDPSA §541.101(b)(2); Bus. & Com. Code §521.052
- US-NYSHIELD Act GBL §899-bb(2)
- US-VAVCDPA §59.1-578(A)(3)
- US-COCPA §6-1-1308(5)
- US-ILPIPA 815 ILCS 530/45
- US-FLFla. Stat. §501.171(2)
- CAPIPEDA Principle 4.7
- BRLGPD Art. 46
- MXLFPDPPP Art. 19
- INDPDP Act 2023 §8(5); DPDP Rules 2025 Rule 6
- SGPDPA §24
- AUAPP 11
- JPAPPI Art. 23
- KRPIPA Art. 29
- CNPIPL Art. 51; Cybersecurity Law Art. 21
- AEPDPL Art. 20
- SAPDPL Art. 19
- ZAPOPIA §19
- NGNDPA 2023 §39
- allOWASP Top 10 (2021)
Access, correction & deletion rights
21 jurisdictions · show citationshide
- EUGDPR Art. 15–17
- UKUK GDPR Art. 15–17
- CHrevFADP Art. 25 & 32
- US-CACCPA §1798.105–106
- US-TXTDPSA §541.051
- US-VAVCDPA §59.1-577
- US-COCPA §6-1-1306
- US-FLFDBR §501.705
- CAPIPEDA Principle 4.9; Quebec Law 25 s. 28
- BRLGPD Art. 18
- MXLFPDPPP Art. 22 (ARCO rights)
- INDPDP Act 2023 §11–13
- SGPDPA §21–22
- AUAPP 12–13
- JPAPPI Art. 33–35
- KRPIPA Art. 35–37
- CNPIPL Art. 44–47
- AEPDPL Art. 13–15
- SAPDPL Art. 4
- ZAPOPIA §23–24
- NGNDPA 2023 §34–36
- allApple App Store Guideline 5.1.1(v); Google Play account deletion policy
Children's privacy
10 jurisdictions · show citationshide
- USCOPPA, 16 CFR Part 312
- EUGDPR Art. 8
- UKAge Appropriate Design Code (Children's Code)
- US-CACalifornia Age-Appropriate Design Code Act
- US-TXSCOPE Act (HB 18)
- INDPDP Act 2023 §9 (under-18 parental consent)
- BRLGPD Art. 14
- CNPIPL Art. 28 & 31
- KRPIPA Art. 22-2
- AUOnline Safety Act 2021
- allUN CRC General Comment No. 25
Digital accessibility
9 jurisdictions · show citationshide
- USADA Title III (WCAG 2.1 AA as de facto standard)
- EUEuropean Accessibility Act (Dir. 2019/882), EN 301 549
- UKEquality Act 2010 §20 & §29
- CAAccessible Canada Act; AODA (Ontario) IASR §14
- US-CAUnruh Civil Rights Act, Civ. Code §51
- US-NYNYS Human Rights Law §296
- AUDisability Discrimination Act 1992 §24
- INRPwD Act 2016 §40 & §46
- JPAct for Eliminating Discrimination against Persons with Disabilities
- allWCAG 2.2 Level AA
Attorney advertising rules
13 jurisdictions · show citationshide
- US-TXTexas Disciplinary Rules of Prof. Conduct 7.01–7.07 (Rule 7.05 filing with the Advertising Review Committee)
- US-NYNY Rules of Prof. Conduct 7.1 ("Attorney Advertising" label, past-results disclaimer, 1-year retention)
- US-FLRules Regulating The Florida Bar 4-7.11–4-7.19 (Rule 4-7.19 filing)
- US-CACalifornia RPC 7.1–7.3; B&P Code §6157–6158
- US-ILIllinois RPC 7.1–7.5
- US-VAVirginia RPC 7.1
- US-COColorado RPC 7.1
- USABA Model Rules 7.1–7.3
- INBar Council of India Rules, Part VI Ch. II, Rule 36
- UKSRA Code of Conduct 8.6–8.11; SRA Transparency Rules
- CALaw Society Model Code r. 4.2
- AULegal Profession Uniform Conduct Rules r. 36
- SGLegal Profession (Publicity) Rules 2015
- allLocal bar or law society advertising rules
Commercial email & messaging
8 jurisdictions · show citationshide
- USCAN-SPAM Act, 15 U.S.C. §7704
- CACASL s. 6 & 11
- EUePrivacy Directive Art. 13
- UKPECR Reg. 22
- AUSpam Act 2003 s. 16–18
- SGSpam Control Act s. 11
- INDPDP Act 2023 §6; TRAI TCCCPR 2018
- BRLGPD Art. 7(I)
- allLocal anti-spam law
AI transparency
8 jurisdictions · show citationshide
- EUEU AI Act Art. 50 (applies from Aug 2026)
- US-COColorado AI Act, C.R.S. §6-1-1701 et seq.
- US-CABOT Act B&P §17941; AI Transparency Act (SB 942)
- US-NYNYC Local Law 144 (if used in hiring)
- US-ILIllinois AI Video Interview Act (if used in hiring)
- CNMeasures for Labelling AI-Generated Content (2025); Generative AI Measures Art. 12
- KRAI Basic Act (2026)
- USFTC Act §5 (AI claims and disclosures)
- allOECD AI Principles (transparency)
Sensitive & health data
16 jurisdictions · show citationshide
- EUGDPR Art. 9
- UKUK GDPR Art. 9
- USFTC Health Breach Notification Rule, 16 CFR 318; HIPAA if a covered entity
- US-CACCPA §1798.121; CMIA Civ. Code §56
- US-TXTDPSA §541.101(b)(4) (consent for sensitive data)
- US-VAVCDPA §59.1-578(A)(5)
- US-COCPA §6-1-1308(7)
- US-FLFDBR §501.71(2)
- US-NYNY Health Information Privacy Act
- US-ILBIPA 740 ILCS 14 (if biometrics)
- BRLGPD Art. 11
- INDPDP Act 2023 §6
- CNPIPL Art. 28–29
- ZAPOPIA §26–27
- KRPIPA Art. 23
- JPAPPI Art. 20(2)
- allSpecial-category data rules
Card payment security
2 jurisdictions · show citationshide
- INRBI Card-on-File Tokenisation Directions 2021
- EUPSD2 Strong Customer Authentication (RTS 2018/389)
- allPCI DSS v4.0.1
Online consumer contracts
8 jurisdictions · show citationshide
- EUConsumer Rights Directive 2011/83/EU Art. 6 & 9 (14-day withdrawal)
- UKConsumer Contracts Regulations 2013; DMCC Act 2024
- US-CAAutomatic Renewal Law, B&P §17600–17606
- USFTC Negative Option Rule; ROSCA 15 U.S.C. §8403
- INConsumer Protection (E-Commerce) Rules 2020, Rule 4–6
- AUAustralian Consumer Law s. 18 & 29
- BRConsumer Defense Code Art. 49
- CNE-Commerce Law Art. 17 & 19
- allLocal consumer protection law
Advertising claims
6 jurisdictions · show citationshide
- USFTC Act §5; FTC Endorsement Guides 16 CFR 255
- EUUnfair Commercial Practices Directive 2005/29/EC
- UKCAP Code; DMCC Act 2024 Part 4
- INConsumer Protection Act 2019 §2(28); CCPA Guidelines on Misleading Ads 2022
- AUAustralian Consumer Law s. 18
- CACompetition Act s. 52 & 74.01
- allLocal consumer protection law
"Do Not Sell or Share" link
5 jurisdictions · show citationshide
- US-CACCPA §1798.135(a)
- US-COCPA §6-1-1306(1)(a)
- US-TXTDPSA §541.055
- US-VAVCDPA §59.1-577(A)(5)
- US-FLFDBR §501.705(2)
Cross-border data transfer
10 jurisdictions · show citationshide
- EUGDPR Ch. V (Art. 44–49)
- UKUK GDPR Ch. V; IDTA
- CHrevFADP Art. 16
- CNPIPL Art. 38–39; Cross-border Data Flow Provisions 2024
- INDPDP Act 2023 §16
- BRLGPD Art. 33
- AEPDPL Art. 22–23
- SAPDPL Art. 29
- KRPIPA Art. 28-8
- NGNDPA 2023 §41–43
Breach notification readiness
11 jurisdictions · show citationshide
- EUGDPR Art. 33–34 (72 hours)
- UKUK GDPR Art. 33–34
- INDPDP Act 2023 §8(6); CERT-In Directions 2022 (6 hours)
- USState breach laws; FTC HBNR
- US-TXBus. & Com. Code §521.053 (60 days)
- US-NYGBL §899-aa
- AUNotifiable Data Breaches scheme (Part IIIC)
- SGPDPA §26D (3 days)
- CAPIPEDA s. 10.1
- BRLGPD Art. 48
- CNPIPL Art. 57
- allLocal breach-notification law