Activity Tracker
The DPA Activity Tracker provides our latest information on developments in legislatures, judiciaries and the executive branches of G20, EU member states and Switzerland.
89 events advancing 77 policy or regulatory changes:
Graph
Table
Cybersecurity regulation in Act amending Kentucky Revised Statutes on data privacy (HB 692)
Act amending Kentucky Revised Statutes on data privacy including cybersecurity regulation enters into force
On 1 July 2027, the Act amending Kentucky Revised Statutes on data privacy (HB 692) enters into force. The Act amends KRS 367.3617 to require controllers to establish, implement, and maintain reasonable administrative, technical, and physical data s…
Data protection regulation in Act amending Kentucky Revised Statutes on data privacy (HB 692)
Act amending Kentucky Revised Statutes on data privacy including data protection regulation enters into force
On 1 July 2027, the Act amending Kentucky Revised Statutes on data privacy (HB 692) enters into force. The Act amends KRS 367.3611 to introduce definitions of "automatic content recognition data" and "smart monitor." "Automatic content recognition d…
Bill amending Civil Code including age verification requirements for online services and software applications (AB 1043)
Law on Age Verification Signals in Software Applications and Online Services (AB 1043) becomes applicable to pre-existing accounts and applications
On 1 July 2027, in accordance with Section 1798.502 of Title 1.81.9 (Digital Age Assurance Act) of the Civil Code, operating system providers are required to provide an accessible interface for account holders to indicate the birth date, age, or bot…
Bill amending the California Business and Professions Code to include obligations for operators of companion chatbot platforms (Bill No. SB 243)
Annual reporting obligations under the Law on Companion Chatbots (SB 243) enter into force
On 1 July 2027, the annual reporting obligations under the Law on Companion Chatbots (SB 243) enter into force, as established in Chapter 22.6 (commencing with Section 22601) of Division 8 of the Business and Professions Code. The law defines “compa…
Consumer Financial Protection Bureau Personal Financial Data Rights Rule
Implemented obligations for depository institutions that hold at least USD 10 billion in total assets outlined in Rule on Personal Financial Data Rights
On 1 April 2027, the final rule on personal financial data rights came into force for depository institutions that hold at least USD 10 billion in total assets but less than USD 250 billion or non-depository institutions that did not generate USD 10…
Privacy Protection Act (A6309)
Section 6 of the Privacy Protection Act (A6309) enters into force
On 1 February 2027, Section 6 of the Privacy Protection Act (A6309) enters into force, regulating the collection and sharing of personal information by health care facilities. The provisions prohibit health care facilities from requesting or collect…
Regulations enforcing Stop Addictive Feeds Exploitation (SAFE) for Kids Act
Stop Addictive Feeds Exploitation (SAFE) for Kids Act implementing rules enter into force
On 25 January 2027, the rules implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act under Part 700 of Title 13 of the New York Codes, Rules and Regulations (NYCRR) enter into force 180 days after their publication in the State Regis…
Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act/SB 1582)
Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act) conditionally enters into force
On 18 January 2027, the Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act) enters into force, 18 months after its enactment on 18 July 2025. The Act takes effect on the earlier of that date or 120 days after the primary…
Data protection authority governance in Louisiana Data Privacy Act (Senate Bill No. 386)
Louisiana Data Privacy Act (Act No. 502) including data protection authority governance enters into force
On 1 January 2027, the Louisiana Data Privacy Act (Act No. 502) enters into force as Chapter 20-B of Title 51 of the Louisiana Revised Statutes (R.S. 51:1780.1 to 1780.5). The attorney general has exclusive authority to enforce the Act, with any vio…
Design requirement in Colorado Bill concerning requirements for an operator of a conversational artificial intelligence service (HB 26-1263)
Design requirements under Colorado Bill concerning requirements for an operator of a conversational artificial intelligence service (HB 26-1263) enter into force
On 1 January 2027, the design obligations under the Colorado Bill concerning requirements for an operator of a conversational artificial intelligence service (HB 26-1263) enter into force. As signed into law on 29 May 2026 and in force since 12 Augu…