Sources and method
Every fact on this site comes from an official text or a regulator page, shown as a short quotation with its link and the date we read it. If we could not find it on an official page, it says "not stated". We read 26 laws.
For each law we recorded when it applies to a business as a set of conditions (where the business is established, where its users live, user counts, revenue, whether it sells or shares data). The check runs your answers through those conditions in your browser. A blank answer is never treated as "no": the result then says it cannot tell. We never say a law does not apply to you: "not triggered" only means your answers do not meet the conditions we read, and many laws have other tests (for example exemptions for particular organisations or kinds of data) that we list under "Conditions to check" on each result and each law page.
Sources last re-read on 2026-10-06.
Dates: what "in force" means here
The check judges your answers on the day you run it. A law whose in-force date is later than that day is listed as "not yet in force" and is not used for the result. Our law data was last verified on 2026-10-06: a law that took effect, or an amendment that applies, after that date is not in it. US state laws in particular are being passed and amended often.
Limits you should know
- Some laws were read from a regulator's or attorney general's guidance rather than the statute text, because the statute site could not be reached. The law page says which. Such facts are shown as the guidance states them.
- The excerpt shown for a fact is short. Where a summary lists more than the excerpt contains, the full list is on the same official page, which each row links to.
- Thresholds and exemptions that depend on a federal definition, on "doing business" in a place, or on the kind of organisation or data cannot be tested from the answers; they appear under "Conditions to check".
- A fact the text does not state, such as whether a data protection officer is required, is shown as not stated, not as "not required".
Answers that point outside this site
If your answers suggest any of these, the result says so and tells you to ask a professional:
- You handle children's data. Rules specific to children's online privacy can apply in addition to the laws listed here and are outside this tool. Ask a privacy professional.
- You handle health data or run a health care business. Rules specific to health information can apply in addition to the laws listed here and are outside this tool. Ask a privacy professional.
- You run a bank or other financial institution. Rules specific to financial institutions can apply in addition to, or instead of, the laws listed here and are outside this tool. Ask a privacy professional.
- You run a school or education provider. Rules specific to education records can apply in addition to the laws listed here and are outside this tool. Ask a privacy professional.
- Many privacy laws treat nonprofits differently. Each result shows the exemptions the law states under "Conditions to check"; if you are unsure, ask a privacy professional.
Laws and their main official source (26)
What we do not cover
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here
Updates
We re-read the official pages on a regular schedule and record each re-read, including what changed, on the change log. If a page changed, the affected fact is corrected and the date updated.
Not legal advice
This site gives general information from official sources. It is not legal advice and not a compliance assessment. It is not affiliated with any government, regulator or law firm. Have a qualified professional review your situation and your privacy notice before you rely on it.