Updated October 2, 2026. Hover over or tap a country or US state for its laws. Outlined countries have a full Vault JS summary.
In effect: GDPR (EU/EEA), or US state law requiring opt-out signalsIn effect: national law, or US state law without a signal requirementEnacted, not yet in effect or start date unconfirmedUS state bill progressingUS state with other privacy laws onlyNo law trackedVault JS summary available
The full country list is below the map. For US states, see the US state privacy laws map.
Laws by country
National laws first, then regional or provincial laws where we hold them. Links open the official text.
Europe (54 countries and territories)
Belgium
- GDPR and the ePrivacy Directive
- Loi du 13 juin 2005 relative aux communications électroniques (Belgium; cookie rule art. 10/2, formerly art. 129)
- Loi du 3 décembre 2017 portant création de l'Autorité de protection des données / Wet van 3 december 2017 tot oprichting van de Gegevensbeschermingsautoriteit (Belgian Data Protection Authority Act, LCA/WOG)
- Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel / Wet van 30 juli 2018 betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens (Belgian Data Protection Act)
Bosnia and Herzegovina
- Law on Personal Data Protection (Official Gazette of BiH No. 12/25)Start date not confirmed
Cyprus
- GDPR and the ePrivacy Directive
- Νόμος 125(I)/2018 (Cyprus Law 125(I)/2018 providing for the protection of natural persons with regard to the processing of personal data and the free movement of such data)
- Ο περί Ρυθμίσεως Ηλεκτρονικών Επικοινωνιών και Ταχυδρομικών Υπηρεσιών Νόμος 112(Ι)/2004 (Cyprus; cookie rule art. 99(5))
Denmark
- GDPR and the ePrivacy Directive
- Bekendtgørelse nr. 1148 af 9. december 2011 om krav til information og samtykke ved lagring af eller adgang til oplysninger i slutbrugeres terminaludstyr (Danish cookie order)
- Danish Data Protection Act (Databeskyttelsesloven, lov nr. 502 af 23. maj 2018; LBK nr. 289 af 8. marts 2024)
Greece
- GDPR and the ePrivacy Directive
- Νόμος 3471/2006 (Greek Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector)
- Νόμος 4624/2019 (Greek Law 4624/2019 on the Hellenic Data Protection Authority, GDPR implementing measures and transposition of Directive 2016/680)
Hungary
- GDPR and the ePrivacy Directive
- 2003. évi C. törvény az elektronikus hírközlésről (Hungary; cookie rule § 155(4))
- Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról, Infotv.)
Isle of Man
Luxembourg
- GDPR and the ePrivacy Directive
- Loi du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communications électroniques
- Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection regime (Loi du 1er août 2018 portant organisation de la CNPD et du régime général sur la protection des données)
Malta
- GDPR and the ePrivacy Directive
- Data Protection Act, Chapter 586 of the Laws of Malta (Act XX of 2018)
- Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01
- Restriction of the Data Protection (Obligations and Rights) Regulations, Subsidiary Legislation 586.09 (L.N. 177 of 2018, Malta)
Monaco
- Law No. 1.565 of 3 December 2024 on the Protection of Personal DataStart date not confirmed
Montenegro
Romania
- GDPR and the ePrivacy Directive
- Legea nr. 102/2005 privind înființarea, organizarea și funcționarea Autorității Naționale de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian Law No. 102/2005 on ANSPDCP, republished 2018)Start date not confirmed
- Legea nr. 190/2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 (Romanian Law No. 190/2018 implementing the GDPR)Start date not confirmed
- Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice (Romanian Law No. 506/2004, ePrivacy)Start date not confirmed
San Marino
Americas (33 countries and territories)
Antigua and Barbuda
- Data Protection Act, 2013 (No. 10 of 2013)Start date not confirmed
Argentina
- Decreto 1558/2001, Reglamentación de la Ley 25.326 de Protección de los Datos Personales
- Decreto 2501/2014, Reglamentación de la Ley 26.951 del Registro Nacional "No Llame"
- Ley 25.326 de Protección de los Datos Personales
- Ley 26.951 de creación del Registro Nacional "No Llame"
- Plus 1 regional or provincial law
Barbados
Belize
- Data Protection Act, 2021 (Act No. 45 of 2021)Start date not confirmed
Bonaire, Sint Eustatius and Saba
British Virgin Islands
Canada
- An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (CASL), S.C. 2010, c. 23
- Personal Information Protection and Electronic Documents Act
- Privacy Act (Canada), R.S.C. 1985, c. P-21
- Plus 21 regional or provincial laws
Cayman Islands
Chile
Colombia
Dominican Republic
Grenada
- Data Protection Act, No. 1 of 2023Start date not confirmed
Guyana
- Data Protection Act 2023 (Act No. 18 of 2023)Start date not confirmed
Mexico
Panama
Paraguay
Peru
Saint Kitts and Nevis
- Data Protection Act, 2018 (No. 5 of 2018)Start date not confirmed
Saint Lucia
- Data Protection Act, No. 11 of 2011Start date not confirmed
Trinidad and Tobago
Asia-Pacific (33 countries and territories)
Australia
- Do Not Call Register Act 2006 (Cth)
- Privacy Act 1988 (Cth)
- Spam Act 2003 (Cth)
- Telecommunications (Interception and Access) Act 1979 (Cth)Start date not confirmed
- Plus 11 regional or provincial laws
Kazakhstan
Malaysia
Marshall Islands
New Zealand
Philippines
Tonga
- Privacy Act 2025 (Act 34 of 2025)Start date not confirmed
Turkmenistan
Middle East (8 countries and territories)
Qatar
United Arab Emirates
- Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (UAE PDPL)
- Federal Law No. (2) of 2019 Concerning the Use of Information and Communications Technology in Health Fields (UAE)Start date not confirmed
- Data Protection Regulations 2021 (Abu Dhabi Global Market)
- Data Protection Law, DIFC Law No. 5 of 2020 (Dubai International Financial Centre)
- Health Data Protection Regulation No. (7) of 2013 (Dubai Healthcare City)
Africa (45 countries and territories)
Botswana
- Data Protection Act, 2024 (Act No. 18 of 2024)Start date not confirmed
Central African Republic
Chad
Comoros
- Loi N°14-029/AU portant protection des données à caractère personnel (Union des Comores)Start date not confirmed
Côte d'Ivoire
Djibouti
Equatorial Guinea
Eswatini
- Data Protection Act, 2022 (Act No. 5 of 2022)Start date not confirmed
Kenya
Mauritania
Nigeria
Republic of the Congo
South Africa
São Tomé and Príncipe
Zambia
- Data Protection Act, 2021 (Act No. 3 of 2021)Start date not confirmed
See every law we summarize on the privacy laws page, or the US state privacy laws map.
Law names, dates and links come from the Vault JS legal library, which holds the official text of each law. Coverage grows as we add laws; a country shown without a law may still have one. This map is a summary, not legal advice. Spot an error? Tell us.