Law / Frameworks / NIST AI RMF / Map

NIST AI RMF, MapMAP 4.1

Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), MAP 4.1

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

591
laws
239
jurisdictions
20
with court rulings behind them
10
not yet in force
3
proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

A law in force is unmarked; the rest wear their state: not yet in force proposed

  • Afghanistan
  • Alabama
  • Alaska
  • Albania
  • Algeria
  • Andorra
  • Angola
  • Antigua and Barbuda
  • Argentina
  • Arizona
  • Arkansas
  • Armenia
  • Australia
  • Austria
  • Azerbaijan
  • Bahamas
  • Bahrain
  • Bangladesh
  • Barbados
  • Belarus
  • Belgium
  • Belize
  • Benin
  • Bermuda
  • Bhutan
  • Bolivia
  • Bosnia and Herzegovina
  • Botswana
  • Brazil
  • Brunei Darussalam
  • Bulgaria
  • Burkina Faso
  • Burundi
  • Cabo Verde
  • California
  • Cambodia
  • Cameroon
  • Canada
  • Cayman Islands
  • Central African Republic
  • Chad
  • Chile
  • China
  • Colombia
  • Colorado
  • Comoros
  • Connecticut
  • Cook Islands
  • Costa Rica
  • Croatia
  • Cuba
  • Cyprus
  • Czech Republic
  • Côte d'Ivoire
  • Delaware
  • Democratic Republic of the Congo
  • Denmark
  • Djibouti
  • Dominican Republic
  • Ecuador
  • Egypt
  • El Salvador
  • Equatorial Guinea
  • Eritrea
  • Estonia
  • Eswatini
  • Ethiopia
  • European Union
  • Fiji
  • Finland
  • France
  • Gabon
  • Gambia
  • Georgia
  • Georgia
  • Germany
  • Ghana
  • Greece
  • Grenada
  • Guatemala
  • Guinea
  • Guinea-Bissau
  • Guyana
  • Haiti
  • Hawaii
  • Honduras
  • Hungary
  • Iceland
  • Idaho
  • India
  • Indiana
  • Indonesia
  • Iowa
  • Iran
  • Iraq
  • Ireland
  • Israel
  • Italy
  • Jamaica
  • Japan
  • Jordan
  • Kansas
  • Kazakhstan
  • Kentucky
  • Kenya
  • Kiribati
  • Kuwait
  • Kyrgyzstan
  • Laos
  • Latvia
  • Lebanon
  • Lesotho
  • Liberia
  • Libya
  • Liechtenstein
  • Lithuania
  • Louisiana
  • Luxembourg
  • Madagascar
  • Maine
  • Malawi
  • Malaysia
  • Maldives
  • Mali
  • Malta
  • Maryland
  • Massachusetts
  • Mauritania
  • Mauritius
  • Mexico
  • Michigan
  • Micronesia
  • Minnesota
  • Mississippi
  • Missouri
  • Moldova
  • Monaco
  • Mongolia
  • Montana
  • Montenegro
  • Morocco
  • Mozambique
  • Myanmar
  • Namibia
  • Nauru
  • Nebraska
  • Nepal
  • Netherlands
  • Nevada
  • New Hampshire
  • New Mexico
  • New York
  • New Zealand
  • Nicaragua
  • Niger
  • Nigeria
  • North Carolina
  • North Dakota
  • North Korea
  • North Macedonia
  • Norway
  • Oman
  • Oregon
  • Pakistan
  • Palau
  • Panama
  • Papua New Guinea
  • Paraguay
  • Pennsylvania
  • Peru
  • Philippines
  • Poland
  • Portugal
  • Puerto Rico
  • Qatar
  • Republic of the Congo
  • Rhode Island
  • Romania
  • Russia
  • Rwanda
  • Saint Kitts and Nevis
  • Saint Lucia
  • Saint Vincent and the Grenadines
  • Samoa
  • San Marino
  • Sao Tome and Principe
  • Saudi Arabia
  • Senegal
  • Serbia
  • Seychelles
  • Sierra Leone
  • Singapore
  • Slovakia
  • Slovenia
  • Solomon Islands
  • South Africa
  • South Carolina
  • South Dakota
  • South Korea
  • South Sudan
  • Spain
  • Sri Lanka
  • State of Palestine
  • Sudan
  • Suriname
  • Sweden
  • Switzerland
  • Syria
  • Taiwan
  • Tajikistan
  • Tanzania
  • Tennessee
  • Texas
  • Thailand
  • Timor-Leste
  • Togo
  • Tonga
  • Trinidad and Tobago
  • Tunisia
  • Turkey
  • Turkmenistan
  • Tuvalu
  • Uganda
  • Ukraine
  • United Arab Emirates
  • United Kingdom
  • United States
  • United States Virgin Islands
  • Uruguay
  • Utah
  • Uzbekistan
  • Vanuatu
  • Vatican City
  • Venezuela
  • Vietnam
  • West Virginia
  • Wyoming
  • Zambia
  • Zimbabwe

Computer misuse

238 laws, 210 jurisdictions
JurisdictionLawWhat it asks, as read here
Afghanistan Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment)

Do not access a computer, program, or data belonging to someone else without authorization; the Penal Code's wording carries no exception for a public, unauthenticated page, and no reported case construes the term.

Alabama Alabama Digital Crime Act, Computer Tampering

Because exceeding authorization of use is defined as using access you do have to obtain or alter information you are not entitled to obtain or alter, do not use a login or other legitimate access to a computer, computer system, or network to take or alter data beyond what you are authorized to take or alter.

Alaska Criminal mischief in the fourth degree, unauthorized computer access

Do not knowingly access a computer, computer system, program, or network without a right, or a reasonable belief of a right, to do so, even where the access causes no further harm.

Alaska Criminal use of a computer

Do not access, or exceed authorized access to, a computer, computer system, program, or network you have no right, or no reasonable belief of a right, to use.

Do not use unauthorized access to obtain information concerning a person, another person's proprietary information, or information the source makes available to the public only for a fee.

Alaska Theft of services, unauthorized use of a computer system

Do not obtain the use of another person's computer time, computer system, program, or network with reckless disregard that the use is unauthorized.

Albania Criminal Code, Unauthorized Computer Access

Do not enter a computer system, or a part of it, without authorization or beyond the authorization held, by breaching its security measures.

Do not enter without authorization, or beyond the authorization held, a military, national security, public order, civil protection or health computer system, or any other computer system of public importance.

Algeria Code pénal, atteintes aux systèmes de traitement automatisé de données

Do not access or remain in an automated data-processing system without authorization, whether or not the system is protected by a technical measure.

Do not create, distribute, or possess data by which these offenses can be committed, or use data obtained through them.

Andorra Penal Code, Attacks on Information Systems

Do not access all or part of an information system by defeating a security measure, without authorization, when the result is serious.

Do not intercept non-public data transmissions to, from, or within an information system without authorization.

Angola Penal Code, Unauthorised Access to an Information System

Do not access, without authorisation, all or part of an information system of which you are not the holder.

Do not defeat a security measure or access a conditional-access ('protegido') service to reach a system without authorisation, which draws a substantially heavier penalty.

Antigua and Barbuda Electronic Crimes Act, 2013, access and interference

Do not intentionally access, or download, copy or extract data from, an electronic system or network without a lawful excuse or justification.

Show the other 228 laws
Argentina Código Penal, art. 153 bis, unauthorized access to a restricted computer system or data

Do not access a computer system or data of restricted access without due authorization, or by exceeding the authorization held.

Arizona Computer tampering (Arizona's computer-misuse statute)

Do not access an Arizona-connected computer, computer system, or network without authority or in excess of your authorization; paragraph 8 criminalizes bare unauthorized access even without any intent to defraud, damage, or disrupt.

Do not access a computer, computer system, or network operated by the state, a political subdivision, a health care provider, or a clinical laboratory to obtain information required by law to be kept confidential or records that are not public records.

Arkansas Computer fraud

Do not access, or cause to be accessed, a computer, computer system, or computer network to devise or execute a scheme to defraud or extort, or to obtain money, property, or a service through a false or fraudulent intent, representation, or promise.

Arkansas Computer trespass

Do not intentionally and without authorization access, alter, delete, damage, destroy, or disrupt a computer, computer system, computer network, computer program, or data.

Arkansas Unlawful interference with access to computers; unlawful use or access of computers

Do not knowingly and without authorization use, access, attempt to access, or cause access to be gained to a computer, system, network, telecommunications device, telecommunications service, or information service.

Armenia Criminal Code, unauthorised computer access and illegal appropriation of data

Do not penetrate a computer, computer system or network without permission arising from law, contract or other legitimate basis; reading a public, unauthenticated page has not been held to fall within this prohibition, since the offence also requires that the access negligently cause destruction, alteration, damage or copying of data or other material harm.

Do not intercept or appropriate computer data that is not intended for general use, without permission under law, contract or other legitimate basis, for the purpose of using it or making it available to others; data a service makes available for general, public use falls outside a plain reading of this provision.

Australia Criminal Code Act 1995 (Cth), Part 10.7, Unauthorised Access to Restricted Data

Do not cause access to, or modification of, data held in a computer where that data is restricted by an access control system and you are not entitled to cause the access, knowing the access is unauthorised.

Austria StGB Sections 118a and 126a to 126c, Computer-Misuse Offenses

Do not overcome a computer system's specific security measure to gain access, if your purpose is to obtain personal data protected by a secrecy interest, or to use the accessed data or system to harm another, per StGB Section 118a.

Azerbaijan Criminal Code, unauthorised access, illegal interception, and system interference

Do not intentionally access a computer system, or any part of it, without the right to do so or by violating its security measures, with intent to seize the data stored there or for personal purposes.

Do not intentionally intercept, by technical means, computer data not intended for general use that is transmitted to, from, or within a computer system, without the right to do so.

Bahamas Computer Misuse Act 2003, unauthorised access, modification and interception offences

Do not cause a computer to perform any function to secure access to a program or data without being entitled to control that access or having the consent of someone who is.

Do not modify computer material, intercept a computer service, or obstruct the use of a computer without authority.

Bangladesh Cyber Security Act, 2026, unauthorised access to a computer system

Do not gain illegal entry into a computer, digital device, computer system, or computer network, and do not assist another person to do so; a higher penalty applies where the entry is for the purpose of committing an offence, and a further higher penalty applies where the entry results in the theft, destruction, or alteration of information, or in an AI agent generating new data through that access.

Barbados Computer Misuse Act, illegal access

Do not gain access to a computer system, cause a programme to execute, or copy, move, alter, or erase data, knowingly or recklessly and without lawful excuse or justification.

Belarus Criminal Code, Crimes Against Computer Security

Do not access a computer system or the information it holds by defeating or circumventing a protection or security measure, whether for gain or where doing so negligently causes substantial harm.

Do not copy, intercept, or otherwise unlawfully acquire computer information causing substantial harm, even without defeating a protection measure.

Belgium Code pénal, Livre II, articles 524 à 533, accès non autorisé et sabotage dans un système informatique

Do not access or remain in a computer system knowing you are not authorised to do so.

Do not exceed your own access rights to a computer system with a fraudulent intent or an intent to harm.

+1 more
Belize Cybercrime Act, illegal access to a computer system

Do not access a computer system of another person without authorisation, in excess of authorisation, or by infringing a security measure, and do not continue to exceed authorised access once it is withdrawn.

Benin Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybercriminalité), atteintes aux réseaux et systèmes d'information

Do not access, or remain present in, a computer system without right; the penalty escalates where the access or presence is aggravated by fraudulent intent, exceeds an authorized level of access with fraudulent intent or intent to harm, results in data being suppressed or modified, or is committed in violation of the system's security measures.

Do not intercept, divulge, use, alter, or misappropriate computer data during its non-public transmission to, from, or within a computer system.

Bermuda Computer Misuse Act 1996, unauthorised access and modification offences

Do not cause a computer to perform any function to secure access to a program or data without being entitled to control that access or having the consent of someone who is, and knowing the access is unauthorised.

Bhutan Information, Communications and Media Act of Bhutan 2018, unauthorized access and tampering with computer systems

Do not access a computer, computer system, network, or computer, content, or traffic data without authorization; unauthorized access is a felony of the fourth degree regardless of resulting damage, and the person is liable to pay court-determined compensation to the victim.

Bolivia Código Penal, Alteración, Acceso y Uso Indebido de Datos Informáticos

Do not appropriate, access, use, modify, suppress, or disable data stored on a computer or other computer medium without authorization, where doing so harms the data's owner.

Brazil Penal Code Art. 154-A, Invasion of a Computing Device

Do not invade a computing device, connected to a network or not, to obtain, alter, or destroy data or information without the device user's authorization, or to install a vulnerability to obtain an unlawful advantage.

Brunei Darussalam Computer Misuse Act, unauthorised access to computer material

Do not cause a computer to perform a function for the purpose of securing access to a program or data without authority, meaning without the entitlement to control that access and without the consent of a person who holds that entitlement.

Bulgaria Criminal Code (Nakazatelen kodeks), Art. 319a, Unauthorized Access to an Information System

Do not unlawfully access an information system or a part of it; a non-immaterial unauthorized access carries imprisonment of up to six years under Article 319a(1), rising with aggravating circumstances.

Bulgaria Criminal Code (Nakazatelen kodeks), Art. 319b, Interference with Data in an Information System

Do not unlawfully add, copy, use, change, transfer, delete, damage, degrade, hide or destroy computer data in an information system, or stop access to such data, in a case that is not immaterial.

Burkina Faso Loi n°025-2018/AN du 31 mai 2018 portant Code pénal, computer and data systems offenses (Livre VII, Titre I, Chapitre 1)

Do not access, or remain present in, a computer system without right; a heavier penalty applies where the access or continued presence results in data being suppressed, modified, or altered.

Do not intercept a non-public data transmission to, from, or inside a computer system without right.

+1 more
Cabo Verde Cybercrime Law, Unauthorised Access to a Computer System

Do not access a computer system without legal permission or authorization from its owner or another rights holder, and do not produce, sell, distribute, or introduce a device, program, or code intended to produce that unauthorised access.

California Comprehensive Computer Data Access and Fraud Act (knowing access without permission)

Do not continue accessing a California site, or circumvent a technical block, after the operator has sent a cease-and-desist notice (Facebook v. Power Ventures, 9th Cir. 2016; Craigslist v. 3Taps, N.D. Cal. 2013).

Cambodia Criminal Code, offences in the information technology sector

Do not fraudulently access or maintain access to a computer system located in Cambodia, including to copy, alter, or delete data from it.

Cameroon Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 68-69 (accès frauduleux)

Do not fraudulently access or remain within all or part of an electronic-communications network or information system, or transmit, damage, or cause a serious disruption or interruption of its functioning.

Do not access, without right and in violation of a security measure, all or part of a network, information system, or terminal equipment connected to another information system, in order to obtain information or data.

Canada Criminal Code, unauthorized use of a computer

Do not obtain a computer service, or cause a function of a computer system to be intercepted, fraudulently and without colour of right.

Chad Code Pénal, unauthorised access to and interference with a computer system

Do not access, or attempt to access, a computer system by fraudulent means, and do not fraudulently remain in, hinder, falsify, or introduce data into one.

Chile Ley 21.459, art. 2, acceso ilícito a un sistema informático

Do not defeat a technical barrier or technological security measure (a login, a paywall, an access token) to reach a computer system without authorization; doing so is a criminal offence regardless of what is then done with the data.

China Criminal Law, Arts. 285-286 (unauthorized computer intrusion and system destruction)

Do not intrude into a computer system to obtain its data, or exercise illegal control over it, where the conduct is serious (Art. 285).

Colombia Código Penal, Acceso Abusivo a un Sistema Informático

Do not access a computer system, whether or not it is protected by a security measure, without authorization or beyond what the system's owner agreed to, and do not remain in it against the will of the person entitled to exclude you.

Colorado Colorado Cybercrime statute (unauthorized access, defined by express consent)

Do not knowingly access a computer, computer network, or computer system without authorization, or beyond the scope of the authorization granted; Colorado defines authorization as the express consent of a person.

Comoros Penal Code, unauthorized access to an information system

Do not access, or attempt to access, any part of an information system without authorization.

Do not remain, or attempt to remain, within an information system once access is no longer authorized.

+1 more
Connecticut Connecticut Computer Crime (unauthorized access, undefined authorization test)

Do not access a Connecticut-connected computer system knowing you lack authorization to do so; an ordinary read of an unrestricted public page with no notice of any restriction lacks that knowledge, but the statute does not say that a public page is outside the offence, so notice of a restriction can supply it.

Connecticut Connecticut Computer Crimes (unauthorized use of a computer or computer network with intent to copy, alter or disable)

Do not use a computer or computer network without the owner's right or permission, or in a manner exceeding it, with the intent to make an unauthorized copy of its data, to cause it to malfunction, or to alter or erase its data or software; the statute defines being without authority by the owner's permission and states no knowledge element.

Costa Rica Código Penal, artículo 231, Espionaje informático

Do not use a computerized manipulation to appropriate, copy, or transmit information of economic or commercial value without the authorization of the system's owner or the party responsible for it.

Croatia Kazneni zakon, Computer Crime Chapter (Arts. 266-273)

Do not access a computer system, part of one, or computer data in Croatia without authorisation; unauthorised access alone is a criminal offence, rising from up to two years' imprisonment to up to three years where the system or data belongs to a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest.

Do not interfere with the operation of a computer system, damage, alter, delete, destroy or conceal another person's computer data or programs, or intercept a non-public transmission of computer data, without authorisation; each is a separate criminal offence carrying up to three years' imprisonment.

Cuba Código Penal (Ley 151/2022), offenses against telecommunications and ICT security

Do not access or use an information system, storage device, software, or database without due authorization, for the purpose of appropriating, using, disclosing, or disseminating the information it stores, transmits, or captures.

Do not violate an established computer-security measure to use information technology media in a way that affects the confidentiality, integrity, or availability of digital assets.

Cyprus Attacks against Information Systems Law, Articles 3, 4, 7, 11-12 (Illegal Access, System Interference, Tools, Corporate Liability)

Do not access the whole or part of an information system intentionally and without right by violating a security measure.

Cyprus Convention on Cybercrime Ratifying Law, Article 4 (Illegal Access)

Do not enter the whole or part of a computer system intentionally and without right by violating the security measures, per article 4 of Law 22(III)/2004.

Czech Republic Criminal Code Section 230, Unauthorized Access to a Computer System

Do not overcome a security measure to gain access to a computer system or part of it in the Czech Republic, and do not use, delete, alter, forge, insert or transmit data, or otherwise interfere with a computer system's software or hardware, without authorization.

Côte d'Ivoire Cybercrime Act, unauthorized access to an information system

Do not access, or attempt to access, all or part of an information system without the operator's authorization, and do not remain fraudulently within one once inside.

Delaware Delaware Computer Crime (unauthorized access, with a private civil right of action)

Do not access a Delaware-connected computer system knowing you lack authorization to do so; an openly served page carries no obvious authorization barrier, but this statute's own text does not resolve the question for a public page.

Democratic Republic of the Congo Digital Code, Book IV: Unauthorized Access to a Computer System

Do not access, or maintain access to, all or part of a computer system without authorization and with fraudulent intent.

Do not exceed your lawful access authority over a computer system with fraudulent intent or intent to harm.

+1 more
Denmark Straffeloven Section 263, Unauthorized Access to a Data System

Do not obtain access to a data system, or to data intended for use in one, without the right to do so, including by defeating an access control while scraping.

Djibouti Digital Code, Book VI: Fraudulent Access to Information Systems

Do not access or attempt to access an information system, or a part of one, without authorization.

Do not remain, or attempt to remain, within an information system after having fraudulently entered it.

Dominican Republic Ley No. 53-07 sobre Crímenes y Delitos de Alta Tecnología, Acceso Ilícito

Do not access an electronic, computer, telematic, or telecommunications system, or exceed an authorization to access one, using or not using another's identity.

Ecuador COIP, acceso no consentido a un sistema informático

Do not access, in whole or in part, a computer, telematic, or telecommunications system without authorization, or remain inside it against the will of the person with the legitimate right, to exploit the access, modify a web portal, divert data or voice traffic, or offer the system's services to third parties without paying the legitimate provider.

Ecuador COIP, interceptación ilegal de datos

Do not intercept, listen to, divert, record, or observe a computer datum, signal, or data transmission without a prior judicial order and for the purpose of obtaining registered or available information.

Ecuador COIP, revelación ilegal de base de datos

Do not reveal information registered in a file, archive, database, or similar medium, obtained through or directed at a computer, telematic or telecommunications system, for your own or a third party's benefit, in a way that breaches a person's secrecy, privacy or intimacy.

Egypt Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes

Do not access, or remain present in, a restricted website, private account, or information system without authorization; if that access results in copying, altering, or republishing data, a higher penalty applies.

Do not exceed the scope of access rights that were legally granted to you on a website, private account, or information system.

El Salvador Ley de Propiedad Intelectual, elusión de medidas tecnológicas efectivas

Do not evade an effective technological measure controlling access to a protected work, and do not make, import, distribute or offer a technology or device designed to do so, absent authorization.

El Salvador Ley Especial contra los Delitos Informáticos y Conexos, acceso indebido a sistemas informáticos

Do not access, intercept or use a computer system without authorization, or by exceeding the authorization you were granted.

Eritrea Penal Code of the State of Eritrea, Unauthorized Use of a Computer from a date not yet set

Do not obtain an unauthorized computer service, intercept a function of a computer system, or alter, destroy, or interfere with data in a computer system, without authorization.

Estonia Karistusseadustik (Penal Code) Section 217, Illegal Obtaining of Access to a Computer System

Do not eliminate or avoid a technical means of protection, such as authentication, to obtain access to a computer system; Section 217 does not reach access to a system that carries no such protective measure.

Eswatini Computer Crime and Cybercrime Act, 2022, Illegal Access

Do not access the whole or any part of a computer system without lawful excuse or justification; logging into a system you are not entitled to use is itself an offence under this Act, even before any security measure is defeated.

Do not infringe a security measure to obtain computer data once inside a system, which raises the penalty for the access itself.

Ethiopia Computer Crime Proclamation

Do not intercept non-public computer data or a data-processing service without authorization.

European Union Cybercrime Directive, Articles 2(d) and 3 to 12 (offenses against information systems, penalties and jurisdiction)

Do not intentionally access, without right, the whole or any part of an information system by infringing a security measure; Member States must make this a criminal offense, at least for cases which are not minor (Article 3). Without right means not authorized by the owner or another right holder of the system or of part of it, or not permitted under national law (Article 2, point (d)).

Do not intentionally and without right intercept, by technical means, non-public transmissions of computer data to, from or within an information system, including electromagnetic emissions from an information system carrying such data; Member States must make this a criminal offense, at least for cases which are not minor (Article 6).

European Union Data Act, Article 11 (technical protection measures on access to data)

Do not alter or remove the technical protection measures a data holder applies to prevent unauthorized access to data, including metadata, unless the data holder agrees (Article 11(1)).

Where you are a third party or data recipient who, for the purposes of obtaining data, provided false information to a data holder, deployed deceptive or coercive means or abused gaps in the technical infrastructure of the data holder designed to protect the data, or who altered or removed the data holder's technical protection measures without its agreement, comply without undue delay with the requests of the data holder (and, where applicable and where they are not the same person, of the trade secret holder or the user) to erase the data made available and any copies, to end the production, offering or placing on the market or use of goods, derivative data or services produced on the basis of knowledge obtained through the data in the cases Article 11(2), point (b), describes, to inform the user of the unauthorized use or disclosure and of the measures taken to end it, and to compensate the party suffering from the misuse or disclosure (Article 11(2) and (3)).

+1 more
Finland Rikoslaki Chapter 38, Tietomurto and törkeä tietomurto (Computer Break-in and Aggravated Computer Break-in)

Do not gain access to a computer system, or a separately protected part of one, by using an access code that does not belong to you or by otherwise breaking a protective measure, and do not obtain data from such a system without hacking into it by a special technical device, by bypassing a protective arrangement, by exploiting a vulnerability or by other clearly fraudulent means, under Rikoslaki 38 luku 8 sec.

France Code pénal STAD Offenses, Unauthorized Access to and Interference with Automated Data Processing Systems

Do not defeat an access control, password, or other security measure to reach a French computer system; reading a public, unauthenticated page without doing so has not itself been held to violate Article 323-1.

Gabon Loi n°027/2023, infractions et sanctions informatiques

Do not access or remain in a computer system without authorization, whether or not the system is protected by a technical measure, and do not exceed an access you were granted.

Gambia Information and Communications Act, 2009, Computer Misuse and Cyber Crime part

Do not cause a computer system to perform any function to secure access to a program or data without the right or permission of the person who controls that system.

Do not intercept, or cause to be intercepted, any function of or data within a computer system without the consent of both the sender and the intended recipient of the data, or a statutory power to do so.

Georgia Criminal Code, unauthorised access and interference with computer data and systems

Do not access a computer system, or copy, alter, or output data from it, without authorisation from the person who holds the right to grant that access.

Georgia Georgia Computer Systems Protection Act, computer theft, trespass, invasion of privacy, forgery, password disclosure

Do not use a Georgia-connected computer or computer network in a manner that exceeds the right or permission its owner granted; ordinary access to a page that grants and denies no specific permission at all does not, on the statute's own text, become use 'without authority.'

Do not take, delete, alter, or interfere with computer data, programs, or operation without authority; doing so with the required intent is computer theft or computer trespass regardless of whether the access was automated.

+1 more
Germany Ausspaehen, Abfangen und Manipulation von Daten (Computer Misuse and Data Interference)

Do not gain access to data that is specially secured against unauthorised access by overcoming that security measure.

Do not intercept non-public data transmissions or a computer's electromagnetic emissions using technical means.

+1 more
Ghana Cybersecurity Act, Unlawful Access

Do not, without lawful authority, retrieve a person's subscriber information or intercept traffic data or content data.

Ghana Electronic Transactions Act, Cyber Offences

Do not access or intercept an electronic record without authority or permission, whether or not the record sits behind a login.

Do not cause a computer to perform any function to secure access to a programme or electronic record without authority.

+1 more
Greece Penal Code Article 370B (370Β), Illegal Access to an Information System or to Data

Do not gain access, without right and in breach of a protection measure, to all or part of an information system or to electronic data.

Greece Penal Code Article 370C (370Γ), Violation of Computer Data and Program Secrets

Do not copy, record, use, or disclose to a third party computer data or programs that constitute a state, scientific, professional, or business secret, where the lawful holder treats them as secret from a justified interest, without right.

Greece Penal Code Article 370D (370Δ), Access to an Information System in Breach of a Prohibition or Security Measure

Do not access all or part of an information system, or data transmitted over a telecommunications system, by violating a prohibition or a security measure the lawful holder has put in place.

Grenada Electronic Crimes Act, 2013, unauthorised access and interference

Do not gain access to, or download, copy or extract data from, an electronic system or network without the permission of its owner or the person in charge of it.

Guatemala Código Penal, Decreto 17-73, Arts. 274 'A' a 274 'G' (Delitos Informáticos)

Do not, without authorization, use another's computerized records, or enter by any means their data bank or electronic archives (art. 274 'F'); whether reading a public, unauthenticated page counts as unauthorized use or entry has not been tested by a Guatemalan court.

Guinea Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif aux infractions informatiques (cybercriminalité)

Do not access, or continue to access, a computer system without right; a heavier penalty applies where the access hinders the system's operation.

Do not fraudulently intercept data.

Guyana Cybercrime Act 2018, unauthorised access to a computer system

Do not access a computer system without authorisation under the Cybercrime Act 2018; the located sources do not establish how Guyanese courts would read this against a public, unauthenticated page.

Hawaii Hawaii Computer Crime Law, Part IX (unauthorized computer access, computer fraud, computer damage)

Accessing a computer, computer system, or computer network connected to Hawaii without the permission of its owner or rightful user, or in excess of the permission granted, is unauthorized access under this statute; ordinary automated retrieval of a public, unauthenticated page has not been tested against this definition by a Hawaii court.

Honduras Código Penal, seguridad de las redes y de los sistemas informáticos

Do not access a computer system, in whole or in part, by infringing a security measure established to prevent it, without authorization.

Hungary Büntető Törvénykönyv (Criminal Code), Sections 423-424, Violation of Information Systems or Data

Do not log into, or remain logged into, an information system by violating or circumventing a technical measure safeguarding it; unauthorized access is a criminal offense under Btk. Section 423(1) regardless of whether any data is altered.

Iceland Almenn hegningarlög nr. 19/1940, Art. 229, Unauthorized Access to Computer-Stored Data

Do not obtain access to another's data or programs stored in computer-readable form without authorization, including by defeating a security measure, under Almenn hegningarlög Article 229.

Idaho Computer crime (unauthorized access, use, or alteration)

Do not knowingly access, attempt to access, or use an Idaho-connected computer, computer system, or network, or its software, program, documentation, or data, without authorization; subsection (3) reaches this as a misdemeanor even without any further intent to defraud, damage, or disrupt.

Do not knowingly access or use a computer, system, or network with intent to defraud, to obtain money, property, or services by false pretenses, or to commit theft, and do not knowingly and without authorization alter, damage, or destroy a computer, system, network, or the software, program, documentation, or data it contains; either is a felony under subsections (1) and (2).

India Information Technology Act, Unauthorized Access and Computer-Related Offences

Do not access, or secure access to, a computer, computer system or computer network, or download, copy or extract data from it, without the permission of its owner or the person in charge of it.

Indiana Indiana Computer Trespass, lack of owner's consent

Do not access an Indiana-connected computer system or network without the owner's consent; the statute does not say whether serving a page openly is consent to an ordinary request for it, and an owner's express refusal, such as a written demand to stop or a block, leaves later access without consent.

Indonesia Criminal Code (KUHP), Article 332, unauthorised access to a computer or electronic system, as reworded by Law No. 1 of 2026

Do not access another person's computer or electronic system without right or unlawfully, or access any computer or electronic system without right or unlawfully in order to obtain electronic information or documents from it.

Iowa Iowa Unauthorized Computer Access, with a private civil cause of action

Do not knowingly access a computer, computer system, or computer network without authorization; copying, altering, or deleting data is a serious misdemeanor, and accessing a confidential record, utility or airport operational data, or a trade secret is an aggravated misdemeanor.

Ireland Criminal Justice (Offences Relating to Information Systems) Act 2017

Do not intentionally access an information system by infringing a security measure, without lawful authority or reasonable excuse (s. 2).

Israel Computers Law, unlawful penetration of computer material

Do not connect with, communicate with, or operate a computer or its material without authorization; doing so to commit a further offence under another law raises the maximum term to five years.

Italy Codice Penale Art. 615-ter, Unauthorized Access to a Computer or Telematic System

Do not access, or remain within after being excluded, a computer or telematic system protected by security measures without the right-holder's consent.

Jamaica Cybercrimes Act, 2015, unauthorised access to computer program or data

Do not knowingly obtain, for yourself or another person, access to any program or data held in a computer unless you are entitled to control that access or have the consent of a person who is so entitled.

Japan Act on Prohibition of Unauthorized Computer Access, prohibition of unauthorized access

Do not operate a computer connected to a telecommunications line, where it carries an access control feature, by inputting another person's identification code, or by inputting other information or a command designed to evade that feature, without the access administrator's or the authorized user's permission.

Jordan Cybercrime Law, Unauthorized Access to Information Systems

Do not access a website, information network, information system, or information technology means, in whole or in part, without authorization or in excess of an authorization granted.

Do not use a program or program command to disable, alter, damage, or gain unauthorized access to an information system, and do not intercept or capture data transmitted through one.

Kansas Unlawful acts concerning computers (Kansas's computer-crime statute)

Do not knowingly access, or attempt to access, a Kansas-connected computer, computer system, social networking website, computer network, or computer software, program, documentation, data, or property without authorization; paragraph (a)(5) criminalizes bare unauthorized access or an attempt at it alone, even without any intent to defraud, damage, or exceed authorization.

Kazakhstan Penal Code, unauthorized access to information

Do not intentionally access legally protected information on an electronic medium without authorization where doing so causes significant harm; the offence is not confined to defeating a technical access control.

Kazakhstan Penal Code, unlawful distribution of restricted electronic information resources

Do not unlawfully distribute an electronic information resource containing citizens' personal data, or other information restricted by law or by its owner, once obtained.

Kentucky Kentucky Unlawful Access to a Computer

Do not access, cause to be accessed, or attempt to access a Kentucky-connected computer, computer system, computer network, or the data or software on one, without the effective consent of the owner.

Do not receive, conceal, or use data or property known to have been obtained through a violation of this statute; doing so is a separate felony.

Kenya Computer Misuse and Cybercrimes Act, 2018, unauthorised access

Do not gain access to a computer system by infringing a security measure, knowing the access is unauthorised, including to copy, transfer or output data from it.

Kiribati Cybercrime Act 2021, unauthorised access from a date not yet set

Do not access a computer program or computer data held in a computer system unless you are entitled to control that kind of access, or have the consent of a person who is so entitled.

Kuwait Electronic Transactions Law, Unauthorised Access to an Electronic Data Processing System

Do not illegitimately log in to an electronic data processing system, prevent access to it, damage it, or obtain credit-card or other electronic-card numbers from it to steal funds.

Kyrgyzstan Criminal Code, unauthorized access to computer information

Do not gain unauthorized access to another person's protected computer information, electronic documents, information system, or telecommunications network, including by defeating an access control, where doing so destroys, blocks, or modifies data or disrupts a processing device.

Laos Penal Code, Illegal Access to a Computer System

Do not defeat a special protection system to access a computer system with intent to obtain commercial, financial or privately held data.

Latvia Krimināllikums Sections 241, 243, 244, Automated Data Processing System Offences

Do not breach an automated data processing system's protective means, access it without permission, or use rights granted to another person to access it, where doing so causes substantial harm; whether an ordinary, unauthenticated page with no such protective means falls outside the without-permission ground is untested.

Lebanon Law No. 81/2018 on Electronic Transactions and Personal Data, Illegal Access to an Information System and Related IT-System Offences

Do not fraudulently access, enter, or remain in an information system, or a part of it, that you are not authorized to access.

Lesotho Penal Code Act, 2010, Misuse of Property of Another

Do not extract information from a computer or electronic storage device owned by another person where you have no reasonable cause to believe the owner would allow that extraction.

Liberia Cybercrime Act of 2025 from a date not yet set

Do not intentionally access the whole or part of a computer system or infrastructure without authorization or in excess of authorization.

Libya Law No. 5 of 2022 on Combating Cybercrimes, unauthorised access and system interference

Do not breach a website's or information system's protection measures to access it without authorization, in whole or in part.

Do not delete, alter, disclose, or copy data, or disable or deface a system, once inside it without authorization.

+1 more
Liechtenstein Strafgesetzbuch Art. 118a, Illegal Access to a Computer System

Do not gain access to a computer system, or part of one, in Liechtenstein that you may not use, or may not use alone, by overcoming a specific security precaution, for the purpose of obtaining personal data protected by a confidentiality interest or of inflicting a disadvantage on another person.

Lithuania Criminal Code Arts. 196-198 and 198-1, Computer Misuse and Unauthorised Access Offenses

Do not connect to an information system in Lithuania, or a part of it, by breaching its security measures (Criminal Code Art. 198-1(1)). Do not unlawfully connect to an information system of strategic significance for national security or great significance for the state governance, the economy or the financial system, or a part of it (Art. 198-1(2)).

Do not destroy, damage, delete, alter, or otherwise restrict the use of electronic data on a system in Lithuania without authorization, or disrupt the system's operation (Criminal Code Arts. 196 and 197). Do not unlawfully observe, intercept, acquire, hold, or disseminate non-public electronic data (Art. 198).

Louisiana Louisiana Computer Tampering, unauthorized access and exceeding authorization

Do not access, or cause to be accessed, a Louisiana-connected computer, computer system, or computer network without the authorization of its owner, including access that intentionally exceeds the scope of authorization you were given.

If a computer's owner has issued a confidential or proprietary access code, do not use a code issued to someone else; doing so creates a rebuttable presumption that your access was unauthorized or exceeded authorization.

+1 more
Luxembourg Code penal, Computer Misuse Offences (Unauthorized Access, Interference, Data Introduction, Devices, Attempt, Association)

Do not fraudulently access or remain in all or part of an automated or non-automated data-processing or transmission system located in Luxembourg.

Do not intentionally interfere with, falsify, or introduce, suppress, alter or intercept data in an automated or non-automated data-processing or transmission system, to the prejudice of another person's rights.

Madagascar Law No. 2014-006, fraudulent access to an information system

Do not access, or remain connected to, all or part of an information system intentionally and without a legitimate excuse or justification.

Maine Aggravated criminal invasion of computer privacy

Do not intentionally make an unauthorized copy of a computer program, software, or information from a Maine-connected computer resource, knowing you are not authorized to do so; this reaches unauthorized bulk copying even without any resulting damage.

Maine Criminal invasion of computer privacy

Do not intentionally access a Maine-connected computer resource while knowing you are not authorized to do so; the statute states a bare authorization test with no separate requirement of malicious intent, deception, or resulting damage.

Malawi Electronic Transactions and Cyber Security Act, 2016, unauthorized access to data

Do not access, intercept, or interfere with data without authority or permission to do so, or beyond the access you are authorized for.

Malaysia Computer Crimes Act 1997, unauthorised access to computer material

Do not cause a computer to perform a function to secure access to a program or data where that access is unauthorised and you know it to be unauthorised.

Mali Loi n° 2019-056, accès et maintien frauduleux à un système d'information

Do not access, or attempt to access, an information system by an irregular mode of penetration, and do not remain, or attempt to remain, in an information system once access to it is irregular.

Malta Criminal Code Article 337C, Unlawful Access to, or Use of, Information

Confirm you have authorisation from whoever is entitled to control access to a computer, data, or software before accessing, copying, or extracting it in Malta; acting without such authorisation under Article 337C of the Criminal Code is a criminal offence whether or not a login otherwise protects the resource.

Maryland Maryland Unauthorized Access to Computers, with a civil private right of action

Do not access, or exceed authorized access to, a Maryland-connected computer network, system, or database intentionally and without authorization; the statute defines access but never authorization, so whether an unrestricted public page counts as authorized is unsettled rather than resolved by its text.

Massachusetts Unauthorized access to a computer system; penalties

Do not access a computer system without authorization, and stop accessing it once you know your access is no longer authorized.

Mauritania Loi n° 2016-007, accès non autorisé à un système informatique

Do not access, or attempt to access, all or part of a computer system intentionally and without right.

Do not remain connected to all or part of a computer system after accessing it without right.

Mauritius Cybersecurity and Cybercrime Act 2021, unauthorised access offences

Do not gain unauthorised access to any program or data held in a computer system, that is, access you are not entitled to control and have not been authorised to make.

Mexico Código Penal Federal, Unauthorised Access to Computer Systems and Equipment (Arts. 211 bis 1 to 211 bis 7)

Do not modify, destroy, cause the loss of, learn of, or copy information in a computer system or equipment that is protected by a security mechanism, without authorisation to access it.

Mexico Ley Federal del Derecho de Autor, Technological Protection Measures and Circumvention (Arts. 114 Bis, 232 Bis)

Do not circumvent, or supply a device, mechanism, product, component, or system designed, marketed, or predominantly used to circumvent, a technological protection measure that controls access to a copyrighted work.

Michigan Fraudulent Access to Computers, Computer Systems, and Computer Networks Act

Do not access, or cause access to, a computer, computer system, or computer network without authorization or by exceeding authorization granted, to acquire, alter, damage, delete, or destroy data or property, or to use the system's services (MCL 752.795).

Do not access or cause access to a computer, computer system, or computer network to devise or execute a scheme to defraud or to obtain money, property, or a service by false pretense (MCL 752.794).

Minnesota Minnesota computer or electronic data theft, with the definition of authorization

Do not intentionally access, or cause to be accessed, a computer, computer system or computer network without the owner's permission or a claim of right for the purpose of obtaining services or property, which include computer time, data processing and storage functions and electronically processed or produced data.

Do not intentionally and without authorization or claim of right copy computer software or electronic data and then use, alter, transfer, retain or publish it, and do not retain copies of it beyond your authority.

+1 more
Minnesota Minnesota Unauthorized Computer Access, penetrating a computer security system

Defeating a login or other computer security system, meaning a program or device intended to protect the confidentiality and secrecy of data, to access a Minnesota-connected computer system is what this statute targets.

Mississippi Mississippi Computer Crimes and Identity Theft Act, core offenses

Do not defraud, deny an authorized user access, disable or damage equipment, or destroy, insert, modify, copy, use, or take intellectual property without consent, by means that fall outside proper means (independent invention, lawful reverse engineering, license or authority of the owner, public observation, or published literature).

Missouri Tampering with computer data, computer equipment, and computer users

Do not access a Missouri-connected computer, computer system, or computer network without authorization or without reasonable grounds to believe you have authorization.

Do not modify, destroy, disclose, or take computer data, programs, or supporting documentation, or a password or other access-control information, without authorization.

+1 more
Moldova Criminal Code, Illegal Access to a Computer System

Do not access a computer system without authorization under law or contract, or beyond the limits of an authorization, including to use, administer, or control it or to conduct research or another operation in it.

Monaco Code Pénal Arts. 389-1 to 389-9, Unauthorized Access, System Interference and Data Damage

Do not fraudulently access or remain within all or part of a Monaco information system.

Do not fraudulently hinder or alter the functioning of an information system, or introduce, damage, erase, alter, delete, extract, hold, reproduce, transmit or render inaccessible computer data within one, in the course of an automated crawl.

Montana Montana Unlawful Use of a Computer, without consent of the owner

Do not knowingly or purposely obtain the use or access of a computer, computer system or computer network without the owner's consent; the value of the property affected grades the penalty and is not an element, and the offense covers access when no loss can be articulated.

Montenegro Criminal Code of Montenegro, Unauthorised Access to a Computer System

Do not access a computer system, in whole or in part, without authorisation.

Do not defeat a computer system's protection measures, and do not access without authorisation a computer system of significance to a state authority, local-government authority, or another institution exercising public powers; either raises the offence's maximum penalty.

+2 more
Mozambique Electronic Transactions Law, Computer Misuse Contraventions

Do not access all or part of a computer system or computer network by violating its security measures, with intent to obtain data or another dishonest intent.

Do not intercept, by technical means, private data transmissions to, from, or within a computer system or network.

Myanmar Electronic Transactions Law, unauthorized interference and interception offences

Do not dishonestly hack, modify, alter, destroy, or steal another person's electronic record, electronic data message, or computer programme.

Do not intercept a communication within a computer network, or give any person access to the contents of a communication, without the permission of both the originator and the addressee.

Nauru Cybercrime Act 2015, illegal access to a protected computer

Do not access the whole or part of a protected computer, meaning one connected to the Republic's security, defence, or international relations, a confidential law-enforcement source, communications, public-utility, or public-key infrastructure, or public safety and essential emergency services, without a lawful excuse.

Do not obtain electronic data that is specially protected against unauthorised access and not meant for you.

Nebraska Nebraska Computer Crimes Act, unauthorized access defined against a statutory computer security system

Defeating a login wall or an access-code challenge is what this statute reaches: it is a Class IV felony where it creates a grave risk of causing the death of a person, a Class I misdemeanor where it creates a risk to public health and safety, and a Class II misdemeanor where it compromises the security of data.

Nepal Electronic Transactions Act, 2063, unauthorised access to computer materials

Do not use a computer to access a programme, information, or data without the authorisation of its owner or the person responsible for it, or in a manner contrary to the terms of an authorisation given.

Netherlands Wetboek van Strafrecht, art. 138ab, Computervredebreuk (Computer Trespass)

Do not access an automated work by breaching a security measure, a technical intervention, false signals or a false key, or a false identity; reading a public, unauthenticated page without defeating any access control has not itself been held to violate this article.

After any access gained that way, do not copy, tap, or record the data stored on, processed by, or transferred through that system.

Nevada Unlawful acts regarding computers, private action and enforcement

Do not knowingly, willfully and without authorization modify, damage, destroy, disclose, use, transfer, conceal, take, retain, copy, or obtain or attempt to obtain access to data, a program, equipment, or a computer, system or network connected to Nevada.

New Hampshire New Hampshire Computer Crime Statute

Do not knowingly access, or cause to be accessed, a computer or computer network you know you are not authorized to access.

Do not knowingly make an unauthorized display, use, disclosure, or copy of data obtained through such access, even after collection; this can reach how you later use or share data taken beyond the scope of any authorization.

New Mexico Computer Crimes Act, unauthorized computer use

Do not knowingly, willfully and without authorization, or in excess of an authorization obtained, access, use, take, transfer, conceal, obtain, copy or retain possession of a computer, computer network, or computer property or service connected to New Mexico; a violation is graded by the dollar value of the resulting damage, from a petty misdemeanor at two hundred fifty dollars or less up to a second degree felony above twenty thousand dollars.

New York New York Computer Trespass, notice-based revocation and circumvention presumption

Do not continue accessing a New York-connected system, or circumvent a technical security measure, after the operator has given you actual notice, including a cease-and-desist letter, that your access is unwanted; this statute treats notice alone as sufficient to convert continued access into unauthorized access, without needing a technical block.

New Zealand Crimes Act 1961, Accessing a Computer System Without Authorisation

Do not intentionally access, directly or indirectly, a computer system without authorisation, knowing or being reckless as to whether you are authorised to access it.

Nicaragua Ley No. 1042, interference with and damage to computer systems, as reformed by Ley No. 1219

Do not violate a computer system's security to destroy, alter, duplicate, or damage the data, processes, or their integrity, availability, or confidentiality.

Nicaragua Ley No. 1042, unauthorized access to computer systems

Do not access, intercept, or use a computer system without authorization or in excess of the authorization granted.

Niger Loi n° 2019-33, accès illégal et maintien frauduleux

Do not access, or remain present in, a computer system intentionally and without right; reading a page that is public and unauthenticated has not been shown to violate this test.

Nigeria Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, unlawful access to a computer

Do not intentionally access a computer system or network without authorisation for a fraudulent purpose in order to obtain data vital to national security.

North Carolina North Carolina Computer-Related Crime Act (unauthorized access and computer trespass)

Do not use a North Carolina computer or computer network without the owner's authorization, or beyond the scope of authorization granted, to remove, disable, or alter data, cause a malfunction, damage property, or make an unauthorized copy of computer data, programs, or software.

Do not access a computer, including a government computer, without authorization to defraud or to obtain property or services by false pretenses; accessing a government computer without authorization for any other purpose carries heightened felony exposure.

North Dakota Computer fraud and computer crime

Do not gain or attempt to gain access to, alter, damage, modify, copy, disclose, take possession of, or destroy a North Dakota-connected computer, computer system, or computer network in excess of the authorization you were given or without authorization at all; unlike some other states' statutes, no fraud, malice, or deception is required for this to be a class A misdemeanor.

North Korea Criminal Code, Computer and Information Offenses

Do not intrude into an information-communication network of the state administration, national defense construction or advanced science research sector to read, steal or destroy data.

Do not intrude into an information-communication network to read, steal or destroy important information; the paragraph that punishes this names no sector.

North Korea Intellectual Property Law, Technical Protective Measures and Liability

Do not avoid or destroy the technical protective measures taken to prevent an intellectual property right from being infringed, without the permission of the party concerned or except on the conditions specified by laws.

Do not abuse a mark indicating an intellectual property right, make a false mark, or erase the mark.

North Korea Law on the Protection of Computer Software, Prohibited Acts and Supervision

Do not copy, adapt, sell, or telecast a software, or destroy or remove a technical protection device on it, without the copyright holder's permission, outside the three listed permission-free cases (education, a law-enforcement investigation, or software already distributed free of charge).

North Macedonia Criminal Code, Damage and Unauthorized Entry into a Computer System

Do not enter another's computer or system without authorization with intent to exploit its data or programs for unlawful gain or to cause damage, or to transmit data reached without authorization.

Do not intercept, by technical means, a non-public transmission of computer data to, from, or within a computer system.

Norway Penal Code, Unauthorised Access to a Computer System

Do not gain access to a computer system or part of it by breaching a protection measure or by another unauthorised method.

Oman Cybercrime Combat Law, unauthorized access to a website or information system

Do not access, or remain on, a website, information system, or information-technology means in Oman without right, in excess of authorized access, or after becoming aware the access is unauthorized; a spurious raise costs a developer one read, so this is flagged even though the Law's text does not on its face require defeating a technical security measure to reach a public, unauthenticated page.

Oregon Oregon Computer Crime, without-authorization access and alteration

Do not knowingly use, access or attempt to access a computer, computer system, computer network, or its software, programs, documentation or data without authorization.

Pakistan Prevention of Electronic Crimes Act 2016, unauthorized access and interference offences

Do not access an information system or data in Pakistan that is not available to the general public without authorization, or in violation of the terms and conditions of an authorization already granted; unauthorized access is a criminal offence under section 3 of the Prevention of Electronic Crimes Act 2016, and a more heavily punished one under section 6 where the system is critical infrastructure.

Palau Penal Code, unauthorized computer access

Do not access a computer, computer system, or computer network without authorization, meaning without the permission of, or in excess of the permission granted by, its owner, lessor, or rightful user.

Panama Código Penal, Delitos contra la Seguridad Informática

Do not improperly enter or use a database, network or computer system.

Do not improperly seize, copy, use or modify data in transit or held in a database or computer system, or interfere with, intercept, obstruct or prevent its transmission.

Paraguay Código Penal, arts. 146 b y 174 b, introducidos por la Ley N° 4439/2011, acceso indebido a datos y a sistemas informáticos

Do not access a computer system, or its components, using your own or another person's identity, or by exceeding an authorization.

Do not circumvent a security measure to obtain data that is specially protected against unauthorized access; ordinary access to unprotected, publicly available data falls outside this narrower offence.

Pennsylvania Unlawful use of computer and other computer crimes (hacking and similar offenses)

Do not intentionally access or exceed authorization to access a computer, computer network, database, or World Wide Web site without authorization, or in doing so alter, interfere with the operation of, damage, or destroy it; bare unauthorized access is itself an offense here.

Peru Decreto Legislativo 1700, illicit trafficking of computer data (art. 12-A of Ley 30096)

Do not possess, buy, receive, sell, exchange, facilitate, or traffic computer data, access credentials, or personal databases that you know or have reason to presume were obtained without the titleholder's consent or through a security breach or a computer offense.

Peru Ley 30096, unauthorized access and data/system integrity offenses

Do not access a computer system, in whole or in part, without authorization or beyond what you are authorized to access; defeating a security measure to do so draws a higher penalty tier.

Do not intercept non-public computer data transmissions without authorization.

Philippines Cybercrime Prevention Act of 2012, Illegal Access, Interception, and Data Interference

Do not access the whole or any part of a computer system without right, intercept a non-public transmission of computer data without right, or intentionally or recklessly alter, damage, delete, or deteriorate computer data without right.

Poland Kodeks karny, Unauthorized Access to Information and Computer-Misuse Offenses

Do not bypass or circumvent an electronic, technical, magnetic, IT, or other special security measure to access data or an IT system not intended for you; unauthorized access under Kodeks karny Art. 267 carries a fine, restriction of liberty, or imprisonment up to 2 years.

Portugal Lei do Cibercrime Article 6, Illegal Access to a Computer System

Do not access a computer system located in Portugal without legal permission or authorization from its owner or another rights holder, including by circumventing a security control.

Qatar Cybercrime Prevention Law, unauthorised access

Do not intentionally and illegally access, exceed authorised access to, or knowingly continue accessing a Qatar-based website, information system, or information network once aware the access is unauthorised; a violation reaching a system belonging to a state authority or affiliated corporation carries a doubled penalty.

Do not unlawfully capture, intercept, or spy on traffic data or data being transmitted through an information network while crawling or collecting it.

Republic of the Congo Law on Combating Cybercrime, Unauthorised Access, Interference and Fraudulent Copying of Data

Do not access or attempt to access, without authorization, all or part of an information system.

Do not remain or attempt to remain connected, without authorization, to an information system.

+1 more
Rhode Island Rhode Island Computer Crime chapter, unauthorized access and computer trespass

Do not access a Rhode Island-connected computer, system, or network without the owner's permission, or beyond the scope of permission actually granted; this chapter's without-authority standard reaches exceeding permission as well as having none.

Romania Cod penal, Art. 360-366, Infracțiuni contra siguranței și integrității sistemelor și datelor informatice (Offences Against the Security and Integrity of Computer Systems and Data)

Do not access a computer system in Romania without a right to do so, including for the purpose of obtaining data or where the system's access is technically restricted to certain users, per Cod penal art. 360.

Do not intercept, alter, or disrupt computer data or a computer system's functioning, and do not transfer data out of a computer system without authorization, per Cod penal arts. 361-364.

Russia Criminal Code Article 272, Unauthorized Access to Computer Information

Do not access computer information protected by Russian law without authorization in a way that destroys, blocks, modifies, or copies it, under Criminal Code Article 272; a version of this offense committed for gain, by a group, or causing grave consequences carries escalating fines up to 500,000 rubles and imprisonment up to 7 years.

Russia Criminal Code Article 274, Violation of Rules for Operating Computer-Information Storage, Processing or Transmission Systems

Do not violate the operating rules for protected computer-information systems or telecommunications-network access rules in a way that destroys, blocks, modifies, or copies information and causes significant damage, under Criminal Code Article 274.

Russia Criminal Code Article 274.1, Unlawful Impact on Critical Information Infrastructure

Do not create, distribute, or use malicious computer programs, or gain unauthorized access to protected information, aimed at Russia's critical information infrastructure, under Criminal Code Article 274.1; a version committed by a group or causing grave consequences carries imprisonment up to 10 years.

Rwanda Law on Prevention and Punishment of Cybercrimes, unauthorized access

Do not access computer or computer system data without the consent of a person entitled to give it, without being entitled to control or access it yourself, or by accessing another person's computer system without authorization.

Saint Kitts and Nevis Electronic Crimes Act, illegal access and related computer-misuse offences

Do not access a computer system, or any part of it, without lawful excuse or justification, including to copy, transfer or output data from it.

Do not access a computer system the Minister has designated as restricted; a heavier penalty applies where access to a restricted system occurs in the course of another offence under this Act.

Saint Lucia Computer Misuse Act, unauthorized access, interception and modification

Do not cause a computer system to perform a function to secure access to, or to intercept, a program, data, or computer service, without authority.

Samoa Crimes Act 2013, computer-access and interference offences

Do not access, directly or indirectly, the whole or part of an electronic system without authorisation, or while reckless as to whether access is authorised, whether or not the underlying data is later used for crawling or training.

Do not log into or remain logged into, or continue to access, an electronic system without lawful excuse or in excess of a lawful excuse.

+2 more
San Marino Computer Crimes Law, Unlawful Access to Computer or Telematics Systems

Do not unlawfully enter, or remain against the will of the party entitled to exclude you in, a computer or telematics system protected by a security measure, under Criminal Code art. 182-bis.

Senegal Loi n° 2008-11 du 25 janvier 2008 sur la Cybercriminalité, unauthorized computer-system access (Penal Code arts. 431-8 to 431-9)

Do not access, or attempt to access, all or part of a computer system by fraudulent means, and do not maintain a fraudulent presence in one once inside.

Serbia Criminal Code, Offences Against the Security of Computer Data

Do not access a computer, computer network, or electronic data processing system by circumventing a protection measure, without authorisation.

Do not use, record, or further distribute data obtained by circumventing a protection measure without authorisation.

Sierra Leone Cyber Security and Crime Act, 2021, unauthorised access

Do not cause a computer system to perform a function to gain access to a computer system, program, or data without authorisation, including by exceeding the level of access a person entitled to grant it has consented to.

Singapore Computer Misuse Act, Unauthorised Access to Computer Material

Do not cause a computer to perform any function for the purpose of securing access to a program or data without authority, meaning without being entitled to control that access and without the consent of a person who is so entitled.

Slovakia Trestný zákon, Unauthorized Access to a Computer System and Related Offences

Do not overcome a security measure to gain access to a computer system or part of it without authorization.

Do not intercept a non-public transmission of computer data to, from, or within a computer system without authorization.

Slovenia Kazenski zakonik (KZ-1, Criminal Code), Art. 221, Napad na informacijski sistem (Attack on an Information System)

Do not enter or break into an information system without authorization, and do not intercept data without authorization during its non-public transmission into or out of an information system.

Do not use, alter, copy, transfer, or destroy data in an information system without authorization, and do not obstruct the transfer of or access to data or the operation of an information system.

Solomon Islands Telecommunications Act 2009, Unauthorised-Access and Interception Offences

Do not access telecommunications facilities by infringing a security measure, with the intent of obtaining telecommunications data.

Do not intercept, by technical means, a transmission that is not intended for you and not intended for public reception.

South Africa Cybercrimes Act, unlawful access and unlawful interception of data

Do not unlawfully and intentionally access a computer system or data storage medium.

Do not unlawfully and intentionally intercept data, or possess data known or reasonably suspected to have been unlawfully intercepted, without a satisfactory exculpatory account.

South Carolina South Carolina Computer Crime Act

Do not access, or cause to be accessed, a computer, computer system, or computer network without authorization to devise a scheme to defraud, obtain money or property by false pretenses, commit another crime, or to alter, damage, destroy, or modify data, programs, or software, or to introduce a computer contaminant.

Do not engage in computer hacking, defined to include accessing a computer without express or implied authorization, using a port scanner or probe without permission, or using a computer, computer system, or computer network in a manner that exceeds any right or permission its owner granted; this is a separate misdemeanor offense regardless of any financial gain or loss.

South Dakota South Dakota Unlawful Use of a Computer System, Software, or Data

Do not access, or exceed authorized access to, a South Dakota-connected computer system, software, or data without the consent of the owner; this chapter turns on consent rather than on a technical access barrier, so it reaches ordinary unauthenticated automated access as well as authenticated access.

Do not copy or obtain information from a computer system, compromise its security controls, or use or disclose access codes or passwords, without the owner's consent; violating this is a Class 6 felony.

South Korea Information and Communications Network Act, Article 48 (network intrusion and anti-circumvention)

Do not access an information and communications network without authorization, or beyond the scope of granted authorization, to collect data.

South Sudan National Communication Act, 2012, confidentiality and unauthorised interception of communications

Do not break into, eavesdrop on, illegally monitor, or hack into a communication or a communication network without authorisation from the National Communication Authority, the Attorney General, the Director of Public Prosecutions, or a court.

South Sudan Penal Code Act, 2008, computer and electronic related offences

Do not gain access to, destroy, alter, copy, transfer, or interfere with data, a programme, or a system held in a computer or computer network without authority from its owner.

Spain Código Penal Article 197 bis, Unauthorized Access to an Information System

Do not circumvent a technical security measure, such as authentication, to access an information system without authorization; Article 197 bis does not reach access to a page that carries no such measure.

Sri Lanka Computer Crime Act, unauthorised access, modification and dealing with unlawfully obtained data

Do not secure access to a computer or to information held in it without lawful authority; the test does not turn on defeating a technical control, so relying on a page being public and unauthenticated is not itself a defence and has not been tested by a Sri Lankan court.

Do not buy, receive, retain, download, upload, or copy information known or believed to have been obtained from a computer without lawful authority by someone else.

State of Palestine Law by Decree No. 10 of 2018 on Cybercrime, Unauthorised Access and Computer Interference

Do not access a website, system, network, or means of information technology without authorisation, or continue accessing it after learning the access is unauthorised, or exceed the scope of authorised access (art. 4(1)).

Do not receive, record, intercept, or wiretap data sent through the network without authorisation (art. 7).

Suriname Wetboek van Strafrecht, Hacking and Denial of Access (arts. 187b-187c)

Do not gain access to a computer system, or part of one, without authorization; access counts as unauthorized if it was obtained by breaking through security, a technical intervention, false signals or a false key, or by assuming a false identity.

If access to a system was unlawfully obtained, do not go on to copy, intercept, or record the data it holds, use its processing capacity for your own or another's benefit, or pivot through it to a third party's system.

Sweden Brottsbalken 4 kap. 9 c §, Unauthorized Computer Access (Dataintrång)

Do not unlawfully gain access to, alter, delete, block, or register information intended for automated processing in Sweden, or seriously disturb or hinder the use of such information by another similar unlawful means.

Switzerland Swiss Criminal Code, Unauthorised Access to and Interference with Data Processing Systems

Do not defeat a security measure to obtain unauthorised access to a data processing system, knowing the access is unauthorised.

Do not obtain specially secured data not intended for you for your own or another's unlawful gain, and do not alter, delete or render unusable data stored or transmitted electronically without authority.

Taiwan Criminal Code, Offenses Against Computer Security

Do not access another's computer or related equipment by entering someone else's password, defeating a technical protective measure, or exploiting a system vulnerability without cause; each is a separate ground for criminal exposure under Article 358.

Tajikistan Criminal Code, illegal access, modification, sabotage and unlawful possession of computer information

An app must not gain access to a computer system, network or machine media by violating its security system, modify computer information or introduce deliberately false information into it, disable or destroy a computer system or its data, or unlawfully copy, seize or intercept information transmitted through a computer system.

Tanzania Cybercrimes Act, 2015, unauthorised access and interference offences

Do not intentionally and unlawfully access, remain in, or interfere with a computer system, or intercept a non-public transmission, without the operator's authorisation.

Tennessee Tennessee Personal and Commercial Computer Act, implicit consent for anonymous access

Do not intentionally access a Tennessee-connected computer, computer system, or network without authorization; the statute defines authorization as any form of consent, and its implicit-consent clause applies to networks operated to allow anonymous access.

Texas Texas Breach of Computer Security, effective-consent and posted-prohibition offenses

Accessing a Texas-connected computer, computer network, or computer system without the effective consent of the owner is a criminal offense regardless of your intent (Tex. Penal Code § 33.02(a)).

Thailand Act on Computer Crime, unauthorized access and interception

Do not access a Thai computer system or computer data protected by a security measure not intended for your use.

Do not disclose another person's security measures, or intercept another person's computer data by electronic or any other means, in a manner likely to cause injury or that is not for public benefit.

Togo Loi n° 2018-026, accès et maintien frauduleux à un système informatique

Do not access, or remain present in, a computer system without right, including a system reached over the internet.

Tonga Computer Crimes Act 2025, unauthorised access to or modification of computer data

Do not cause unauthorised access to or modification of computer data, knowing it is unauthorised and intending to cause it; access is unauthorised where the person is not entitled to cause it.

Trinidad and Tobago Computer Misuse Act 2000, Unauthorised Access

Do not cause a computer to perform a function to secure access to a program or data knowingly and without authority; authority turns on the consent of the person entitled to control access, not on whether a technical security measure was defeated.

Tunisia Decree-Law on Cybercrime, unauthorised access

Do not access, or remain in, a computer system, in whole or in part, without authorization.

Do not exceed the limits of any access right that has been granted to you.

Turkey Turkish Penal Code, Information System Crimes

Do not enter, or continue to unlawfully remain within, the whole or part of a computer system located in Turkey without authorisation.

Turkmenistan Criminal Code, malicious programs

Do not create, use, or distribute a computer program intended to disrupt the normal operation of a computer, subscriber device, computer program, information system, or information-telecommunication network, and do not unlawfully destroy, block, reformat, or copy information protected by Turkmen law that is stored on an electronic medium or passing through such a network; a higher penalty applies where the target is a national information source, the national information system, or a critical information-communication infrastructure object.

Turkmenistan Criminal Code, unlawful access to an information system

Do not access information stored on electronic media, an information system, or an information-telecommunication network that is protected by Turkmen law, without authorization to do so, where the access substantially violates the rights of a person or the protected interests of society or the state; a higher penalty applies where the source accessed is a national information source or a critical information-communication infrastructure object.

Tuvalu Tuvalu Telecommunications Corporation Act 1993, offences and penalties

Do not intercept, disclose, alter, or interfere with a message or the telecommunications apparatus carrying it, and do not operate a competing telecommunications service without the Corporation's authorisation.

United Arab Emirates Federal Decree-Law on Combating Rumours and Cybercrime, hacking offences

Do not access, or remain on, a website, information system, computer, or information network without authorization, in violation of a licence, or illegally.

United Kingdom Unauthorised Access to Computer Material

Do not cause a computer to perform a function intended to secure access to a program or data, knowing that access is unauthorised because you are not entitled to control that kind of access and do not have the consent of someone who is.

United States Computer Fraud and Abuse Act (unauthorized access and the gates-based authorization test)

Do not continue accessing a site, or circumvent a technical block, after the operator has sent an individualized notice revoking your access (Facebook v. Power Ventures, 9th Cir. 2016).

United States Digital Millennium Copyright Act, anti-circumvention provisions

Do not circumvent a technological measure that controls access to a copyrighted work in order to collect it.

United States Virgin Islands Virgin Islands Computer Crimes Act, unauthorized access and computer trespass

Whether or not you have authority to use or access a computer or computer network, do not do so with intent to disable or alter data or programs, cause a malfunction, effect an unauthorized transfer of funds, injure property, make an unauthorized copy of computer data, or forge e-mail header or routing information to send unsolicited bulk e-mail.

Uruguay Código Penal arts. 297 bis, 297 ter, 297 quater, 358 quater, and 358 quinquies, computer-offence provisions inserted by Ley N° 20.327

Do not access, intercept, disclose, sell, or transfer another's information held on a digital medium by computer or telematic means without authorization and without just cause.

Do not access, appropriate, use, or modify a third party's confidential data held on a digital medium without the holder's authorization, and do not disclose, reveal, or transfer such data to a third party.

Utah Utah Computer Crimes Act (unauthorized access, with an express implied-consent definition)

Do not access a computer, computer system, or network without the owner's express or implied consent or permission.

Keep any access within the manner and scope of the consent or permission the owner has given.

Utah Utah Unlawful Computer Access, access without authorization

Do not intentionally or knowingly gain or attempt to gain access to a computer, computer network, computer property, or computer system without the owner's express or implied consent or permission.

Keep any access within the manner and scope of the consent or permission the owner has given.

Vanuatu Cybercrime Act 2021, computer-access and interference offences

Do not access the whole or part of a computer system by infringing a security measure, whether or not the underlying data is later used for crawling or training, unless entitled to access it or the owner has consented.

Do not intercept a non-public transmission of computer data to, from or within a computer system, or the electromagnetic emission of such a system, without lawful excuse.

Vatican City Unauthorised access to a protected computer or telematic system (Legge N. DXXXI, arts. 158 ter-158 quater)

Do not access, or remain connected to, a Vatican City State computer or telematic system that is protected by a security measure, without the right to do so or against the will of the party entitled to exclude you.

Venezuela Ley Especial contra los Delitos Informáticos, unauthorized access and sabotage of systems (Arts. 6-11)

Do not access, intercept, interfere with, or use a computer system without authorization or in excess of the authorization obtained.

West Virginia West Virginia Computer Crime and Abuse Act

Do not knowingly, willfully, and without authorization access or cause to be accessed a computer or computer network with intent to obtain computer services; this is a misdemeanor punishable by a $200 to $1,000 fine, up to one year in county jail, or both.

Wyoming Crimes against computer users (bare without-authorization test)

Do not access a Wyoming-connected computer, computer system, or computer network without authorization; this statute has no malicious-intent or deceptive-means gate, so a bare unauthorized access can fit its elements even without resulting damage or disruption.

Zambia Cyber Crimes Act, 2025, unauthorised access to computer system and data

Do not infringe a security measure to access or monitor a computer system, or any part of one, belonging to another person without lawful authority or in excess of authority.

Zimbabwe Cyber and Data Protection Act, Insertion of Computer-Misuse Offences into the Criminal Law Code

Do not access data, a computer programme, or a computer system if you know or suspect you must obtain prior authority to access it and have not obtained that authority.

Do not intercept a private data transmission, overcome or circumvent a protective security measure, or acquire data within or transmitted to or from a computer system without lawful authority.

Snippet reproduction

122 laws, 117 jurisdictions
JurisdictionLawWhat it asks, as read here
Afghanistan Copyright Law, Public Broadcasting of Work Exception

Do not treat this as a general press-review or quotation exception: it reaches only material already displayed openly to the public, not a competitor publisher's own news reporting.

Do not rely on the personal-use exception for systematic, publicly distributed reproduction: it lets a natural person reproduce a published work, including all or part of a database digitally, only for that person's own personal use.

Algeria Ordonnance n° 03-05, exception de citation

Do not reproduce or communicate a protected work outside these exceptions without authorization; doing so is punishable as infringement (contrefaçon).

Andorra Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception

Indicate the source and, as far as practicable, the author's name when you do so, and do not rely on this permission where the author has expressly reserved the right to authorize such reproduction.

Angola Copyright and Related Rights Law, Quotation and News-Reporting Exceptions

Do not rely on the private-reproduction exception to reproduce the whole or an important part of a database in digital form; article 51(2) excludes it.

Obtain the database holder's authorisation before reproducing, translating, adapting or distributing a database's structure: the holder of the database's patrimonial right has the exclusive right to authorise or prohibit those acts.

Argentina Ley 11.723, news exclusivity, speeches, and quotation exception

You may use, transmit or retransmit general-interest news, but state its source whenever you publish it in its original form.

Do not copy unsigned articles, anonymous contributions, reports, drawings, engravings or other original material that a newspaper, magazine, other periodical or news agency acquired with exclusivity; that material is the property of the outlet or agency.

+1 more
Show the other 112 laws
Bahrain Copyright Law, Facts Exclusion and Quotation Exception

Mention the source and the author's name where the source indicates them.

Benin Loi n°2005-30 relative à la protection du droit d'auteur et des droits voisins, exception de reproduction de presse et de comptes rendus d'actualité, et exclusion des nouvelles du jour

Do not rely on that permission where the copyright holder has expressly reserved the reproduction right.

Do not assume these exceptions reach a systematic aggregator's reproduction of headlines and snippets: no reported Beninese decision has tested it beyond a traditional press outlet's own reporting.

Bolivia Ley del Derecho de Autor, Límite de Cita

Keep the quotation in line with fair practice, to the extent the purpose justifies, and without becoming abusive.

Do not assume this reaches a systematic aggregator's reproduction of headlines and snippets: no reported Bolivian decision has tested it beyond the teaching, research, analysis or critical-commentary purposes the article names.

Brazil Copyright Law, Press Reproduction and Quotation Exceptions

Do not assume either permission reaches a systematic news aggregator: no reported Brazilian decision applies either one to an aggregator rather than to a periodical reproducing another periodical's item or an individual quoting a published work.

Burkina Faso Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, press review and current-events exception (Art. 23) and facts exclusion (Art. 10)

Do not assume this reaches a systematic aggregator's reproduction of headlines and snippets: no reported Burkinabe decision has tested it beyond a traditional press review or a broadcaster's current-events report.

Burundi Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, news and press-review exceptions (Article 26(2)) and facts exclusion (Article 7)

Do not do so where the article as published, or the work as broadcast, carried an express condition prohibiting such use.

Do not assume either exception reaches a systematic aggregator's reproduction of headlines and snippets: no reported Burundian decision has tested it beyond a traditional press review or a broadcaster's current-events report.

Cabo Verde Copyright Law Revision, News-Reporting and Quotation Exceptions

For every use under article 62(1), respect the authenticity and integrity of the title and the author's name.

Cameroon Loi n°2000/011 du 19 décembre 2000 relative au droit d'auteur et aux droits voisins, articles 29, 30, 31 (revue de presse, actualité, citation)

Do not rely on that press permission where the author or copyright owner has expressly reserved the right of exploitation.

Do not assume these articles reach a systematic aggregator: no provision addresses hyperlinking, framing or inline display, and no reported case law applies them to an aggregator rather than a traditional press or broadcast outlet.

Canada Copyright Act, s. 29.2, fair dealing for news reporting

Judge fairness by the six-factor analysis from CCH Canadian Ltd. v. Law Society of Upper Canada (2004 SCC 13).

Keep aggregation to limited news excerpts or snippets: the exception may shield a news aggregator that reproduces them, subject to that fairness analysis.

Central African Republic Bangui Agreement (Act of 2015), Annex VII, Free Use for Informational Purposes

Credit the source and the author's name where the source gives it.

Do not assume the press exception reaches a systematic aggregator's reproduction of headlines and snippets: Annex VII does not say so.

China Provisions on the Administration of Internet News Information Services, licensing and reprint sourcing duties (Arts. 5-6, 11, 15)

When reprinting news information, source it only from central news organisations or provincial-level and above news organisations within a state-designated list, and credit the original source, author, original headline and editor.

When reprinting, do not distort the original headline's meaning or the news content, keep the source traceable, and separately comply with copyright law.

Colombia Copyright Act, News Reporting and Press Reproduction Exception

Do not publish such works in a separate collection without the author's permission.

Comoros Bangui Agreement (Act of 2015), Annex VII, Free Use for Informational Purposes

Credit the source and the author's name where the source gives it.

Do not assume the press exception reaches a systematic aggregator's reproduction of headlines and snippets: Annex VII does not say so.

Comoros Law on Literary and Artistic Property, quotation and press-review exception

You may make analyses and short quotations from a divulged work, and press reviews, without the author's permission where justified by the critical, polemical, pedagogical, scientific or informational character of the work they are incorporated into; clearly indicate the author's name and the source (Article 41).

Costa Rica Ley sobre Derechos de Autor y Derechos Conexos, artículos 67 a 70, excepción de noticias, actualidad y cita

Treat news of a strictly informational press character as unprotected by copyright, but state the original source when you reproduce or retransmit it (art. 67).

You may reproduce, by press, broadcast or wire transmission, current-affairs articles on economic, political or religious topics published in newspapers or periodicals unless reproduction is expressly reserved, and you must always clearly indicate the source (art. 68).

+1 more
Cuba Ley 154/2022, De los Derechos del Autor y del Artista Intérprete, article 86, uses allowed without authorization or payment

Reference the creator's name for each use under article 86, and name the source where article 86.1(h) or 86.2(a) applies.

Côte d'Ivoire Copyright and Neighboring Rights Act, quotation, press-review and current-events exceptions

Do not rely on that current-events permission where reproduction or broadcasting rights were expressly reserved.

Do not assume these articles reach a systematic aggregator's reproduction of headlines and snippets: no reported Ivorian decision has tested it beyond a traditional press review or a broadcaster's current-events report.

Democratic Republic of the Congo Copyright and Neighboring Rights Ordinance, Quotation and Press-Reproduction Exceptions

Treat excerpting as reproduction: the Ordinance defines reproduction broadly, as the material fixation of a work by any process letting it be communicated indirectly to the public, so a service excerpting news content stands on Articles 24 and 32.

Dominican Republic Ley No. 65-00 sobre Derecho de Autor, Noticias del Día y Reseñas de Prensa

You may reproduce, in the press or by broadcast or transmission by wire to the public, current-affairs articles of economic, political or religious discussion published in newspapers or periodicals, and broadcast works of the same character, unless the rights holder has expressly reserved the reproduction, and you must always clearly indicate the source (art. 33).

You may publish, as current news and without authorization, speeches delivered in deliberative assemblies, judicial debates or before public authorities, and public conferences, speeches or sermons whose rights are not expressly reserved; do not publish them in a separate collection without the author's authorization (art. 35).

Ecuador Código Ingenios, reseñas y revista de prensa como forma de cita

Indicate the source and the author's name, and do not use the fragments as a disguised exploitation of the work.

Equatorial Guinea Bangui Agreement, Annex VII, Free Use for Informational Purposes

Credit the source and the author's name where the source states it.

Eritrea Civil Code of the State of Eritrea, Copyright, Press and Quotation Exceptions from a date not yet set

You may reproduce in the press, printed or broadcast, articles of topical interest published in newspapers and reviews unless the reproduction was expressly reserved, and you must always state the source clearly (art. 1168).

Ethiopia Copyright and Neighbouring Rights Protection Proclamation, Quotation Exception

Name both the source and the author when the quotation is taken from a source that carries the author's name.

France CPI Article L122-5 3°, Quotation and Press-Review Exception

Clearly indicate the author's name and the source in every case.

Guinea Loi portant protection de la propriété littéraire et artistique, article 23 (analyses et courtes citations, revues de presse, articles d'actualité)

Clearly indicate the author's name and the source for each of these uses.

Guinea-Bissau Bangui Agreement (Act of 2015), Annex VII, Free Use for Informational Purposes

Credit the source and the author's name where the source gives it.

Do not assume the press exception reaches a systematic aggregator's reproduction of headlines and snippets: Annex VII does not say so.

Haiti Décret du 12 octobre 2005 sur le Droit d'Auteur, exclusion de l'actualité et des simples faits

Do not rely on a general quotation or press-review exception to reproduce a headline or article text from a protected literary work: the Decree has none.

Treat a compilation of works, folklore expressions or mere facts or data (such as an encyclopedia, anthology or database) as a protected work where the choice, coordination or arrangement of its contents is an intellectual creation, whether it sits on a machine-exploitable medium or in any other form.

+1 more
Honduras Ley del Derecho de Autor, reproducción de artículos de actualidad

Credit the source and the author's name, where the work indicates one, for every use under article 46; none of its exceptions is free of attribution.

Iceland Höfundalög nr. 73/1972, Art. 14, Quotation Exception

Keep the quotation within reasonable limits and represent the quoted material correctly; the provision sets no headline-length or short-extract cap beyond that fair-practice test and is not restricted to press or news content.

Iran Copyright Act (1970), Quotation Exception

Do not rely on Article 7 for news reporting, press summaries, commentary on current events or text-and-data-mining or automated processing: its list is closed and names none of them apart from criticism or praise.

Do not publish, distribute or broadcast the whole or part of another person's protected work without permission, or under a false attribution: Article 23 makes that an offence.

Italy Legge sul Diritto d'Autore Art. 65, Free Reproduction of Current-Affairs Articles

Indicate the source, the date and the author's name (if given) whenever you reproduce such an article.

Italy Legge sul Diritto d'Autore Art. 70, Quotation and Criticism Exception

Accompany every summary, quotation or reproduction with the work's title and the names of the author, publisher and (for a translation) the translator, where they appear on the reproduced work.

Kazakhstan Law on Copyright and Related Rights, quotation and news-article reproduction exceptions

You may quote lawfully published works without the author's or rightsholder's consent or payment, for scientific, research, polemical, critical or informational purposes and as far as the purpose justifies, including excerpts from newspaper and magazine articles in press reviews; attribute the author and source (Article 19(1)).

Lebanon Law No. 75/1999 on the Protection of Literary and Artistic Property, Current-Events Reporting Exception

Use the Article 26 exception only for educational purposes: it permits copying or reproducing articles published in newspapers and magazines, or short excerpts of a work, without authorization or compensation within the necessary limits of that purpose, crediting the author's and publisher's names on each use.

Liechtenstein Urheberrechtsgesetz Arts. 27 and 31, Quotation and Reporting on Current Events

You may quote a published work where the quotation serves explanation, reference or illustration and its length is justified by that purpose; identify the quotation and name its source (Article 27).

Do not treat either as a general licence to republish: each is tied to a defined purpose and a source-attribution duty.

Lithuania Copyright Act Art. 21, Quotation Exception

Cite the source and the author's name where possible, keep the use fair, and do not exceed what the purpose of quotation requires.

Lithuania Copyright Act Art. 24, Use of a Work for Information Purposes

Give the source and the author's name in the copies bearing the work or by other means.

Madagascar Law No. 94-036, quotation and press-article reproduction exceptions

You may reproduce and distribute by press, or broadcast or cable-communicate, an economic, political or religious article from a newspaper or periodical, or a broadcast work of the same character, unless that right has been expressly reserved; name the source and the author where his name appears there (Article 46(1)).

Mexico Ley Federal del Derecho de Autor, Quotation and Current-Events News Reproduction Exceptions (Art. 148, fracciones I y II)

For every use below, cite the source, do not alter the work, and do not affect its normal exploitation (art. 148).

Micronesia FSM Copyright Act, fair use exception reaching news reporting

Weigh the use against the purpose and commercial character of the use, the nature of the work, the amount used relative to the whole, and the effect on the work's potential market.

Monaco Loi n. 491 du 24 novembre 1948, Quotation and Press-Review Exceptions

Do not reproduce a literary or artistic work outside those closed exceptions without the author's authorization: the general reproduction right of Article 3 applies, and the law has no text-and-data-mining exception or machine-readable opt-out mechanism.

Nicaragua Ley No. 312, quotation and press-reproduction limitations

You may reproduce a work seen or heard in connection with reporting on a current event, to the extent the informational purpose justifies; reproduce it in full only in exceptional cases (art. 42).

Niger Ordonnance n° 2010-95, exclusion des faits et exception de citation

Do not rely on the quotation exception to reproduce a current political, social or economic news article in full: unlike a dedicated press-review clause, it carries no separate allowance for that.

Do not reproduce the whole or a substantial part of a database under the free-reproduction privilege (art. 10); a database is protected as an ordinary compilation where its selection or arrangement is an original creation (art. 5).

Oman Law on Copyright and Neighboring Rights, news exclusion and press-reproduction exception

Treat a compilation or arrangement of that excluded material, and any creation or intellectual effort behind it, as protected where it is itself distinguished (art. 4).

Paraguay Ley N° 1328/1998, arts. 8 y 41, excepción de prensa y actualidad y exclusión de las noticias del día

Apply the article 41 exception restrictively and never contrary to fair practice (art. 45); it has no headline-length or short-extract cap and is not confined to the press.

Puerto Rico Ley de Derechos Morales de Autor de Puerto Rico, news and criticism exception

Respect an author's moral rights of attribution (paternity) and integrity in a literary or artistic work: both are non-transferable, and the integrity right can be waived only by signed writing.

Qatar Copyright Protection Law, press-article reproduction exception

Do not use that permission where the author has explicitly reserved the right of reproduction or communication to the public; a publisher can withdraw it for its own content by express reservation, and a reproduction outside its conditions is an ordinary infringement (arts. 19, 48).

Republic of the Congo Copyright and Related Rights Law, News and Press-Review Free Uses

Do not do so where the article at publication, or the broadcast work at broadcast, carried an express reservation prohibiting that use.

Russia Civil Code Part IV Article 1274, Free Use of a Work for Informational, Scientific, Educational or Cultural Purposes

Name the author and the source of every quotation.

Do not treat article 1274 as covering text-and-data-mining, mass scraping for indexing, aggregation beyond quotation-length excerpts, or model training: it names no exception for them, so the ordinary reproduction right applies.

Rwanda Law on the Protection of Intellectual Property (2024), news exclusion and informatory-use and quotation exceptions

Indicate the source and the author's name, as far as practicable, for each use under article 297.

Do not assume these exceptions cover an aggregator's systematic reproduction of headlines and snippets: no reported Rwandan decision applies them to it.

Saint Lucia Copyright Act, fair dealing for criticism, review and reporting current events

Weigh fairness on the factors a court applies: the nature of the work, the extent and substantiality of the part used relative to the whole, and the effect of the use on the potential market for or commercial value of the work (section 57).

Sao Tome and Principe Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação

Name the author and publisher where possible and, for some of these uses, pay equitable remuneration (art. 76).

Saudi Arabia Copyright Law (2026), quotation and journalistic-summary exception

Do not let the use conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders (Article 37(1)).

Senegal Loi n° 2008-09 du 25 janvier 2008 sur le Droit d'Auteur et les Droits Voisins, quotation and current-events exceptions (arts. 44-45)

Do not assume a systematic aggregator's reproduction of headlines and snippets falls within either exception: no reported Senegalese decision has tested the point.

Treat a database as protected only where its selection or arrangement of contents is itself an original creation (art. 8(3)); there is no separate database right.

Serbia Law on Copyright and Related Rights, Right of Quotation

Indicate the author's name, the title of the quoted work, and where and when it was published or issued, where known (art. 49).

Spain TRLPI Article 32, Citation, Press-Review, and Aggregation-Service Exception

You may present periodic compilations of press articles as press reviews or press digests, which are treated as quotations; if a compilation consists essentially of mere reproduction for commercial purposes, pay equitable remuneration to an author who has not expressly objected, and obtain the authorization of an author who has (art. 32.1).

If you are a content-aggregation service provider making press text or text fragments available to the public, obtain the rights holder's authorization under Article 129 bis (art. 32.2, as amended in 2021).

Syria Law on Media, Duty to Cite Source on Republication

Cite the source of any media content (articles, news, investigations, programs, notes, comments or similar material) that you transmit or publish, including on a network communication outlet whose published content any individual can access.

Cite the source even where the content is not protected by copyright or the source has not reserved its rights: the duty is not conditioned on either.

Tunisia Copyright Act, Facts Exclusion and Quotation and Press-Review Exception

Do not assume the quotation exception covers a systematic aggregator's headlines and snippets: it has no headline-length or short-extract cap and is not confined to the press, but that use, as against a traditional press review, has not been tested in a reported Tunisian decision.

United Arab Emirates Federal Decree-Law on Copyright and Neighbouring Rights, news exclusion and press-review exception

If you are such an outlet, you may publish articles on subjects of current public concern; do not do so where the author stated a publication ban.

Keep any copying within the limits justified by its purpose; there is no separate headline-length or short-extract cap.

United States Copyright Act, fair use, 17 U.S.C. § 107

Do not run commercial, non-transformative snippet aggregation that substitutes for licensed feeds: a court held that fails fair use (Meltwater).

Uruguay Ley N° 9.739 art. 45, numeral 3, news and press-reproduction exception

Do not assume the exception covers an aggregator that extracts a headline or short snippet in wording different from the source's own: it has no headline or short-extract cap and is not confined to the press, but the exact-version condition suits reproducing a news item whole, as a press clipping does.

Uzbekistan Law on Copyright and Related Rights, quotation and news-article reproduction exceptions

Check for the author's prohibition before relying on the second exception: it is an author opt-out, not an unconditional licence.

Database right

75 laws, 75 jurisdictions
JurisdictionLawWhat it asks, as read here
Algeria Ordonnance n° 03-05, protection des bases de données

Do not reproduce a database whose choice or arrangement of contents is an original creation without the rightsholder's authorization; Algeria has no sui generis database right, so an unoriginal, purely factual database is not itself protected.

Do not rely on the private-use exception for a digital-form reproduction of a database; that exception expressly excludes it.

Austria UrhG Sections 76c to 76e, Sui Generis Database Right

Do not extract or re-utilize the whole, or a substantial part, of a database that required a substantial investment to compile, verify, or present, without the producer's authorization, per UrhG Section 76d.

Do not repeatedly and systematically extract or re-utilize insubstantial parts of such a database where this conflicts with its normal exploitation or unreasonably prejudices the producer's legitimate interests, per UrhG Section 76d.

Bahrain Copyright Law, Database Compilation Protection

An app scraping a database from a Bahraini source may freely take the underlying facts or data themselves, but copying the compiler's creative selection or arrangement of that database's contents is copyright infringement if done without authorization.

Belgium Code de droit économique, livre XI, titre 7, droit des producteurs de bases de données (articles XI.305 à XI.310/1)

Do not extract or reuse the content of a database without the producer's authorization, unless an exception in Article XI.310 applies.

Do not extract the content of a lawfully accessible database for text and data mining where the producer has expressly reserved that use in an appropriate manner; for content made available online, treat only a machine-readable reservation as appropriate.

Show the other 65 laws
Benin Loi n°2005-30 relative à la protection du droit d'auteur et des droits voisins, exclusion des nouvelles du jour et protection des bases de données comme compilations

Treat a database compiled through the selection, coordination, or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even though the underlying facts and data are not themselves protected.

Brazil Copyright Law, Database Compilation Right

Do not reproduce, translate, adapt, reorganize, distribute, or communicate to the public a database whose selection, organization, or arrangement of content is an intellectual creation, without the rightsholder's authorization.

Burkina Faso Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions

Treat a database compiled through the selection or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even for otherwise-permitted private use.

Rely only on the Law's enumerated exceptions rather than a general fair-use or text-and-data-mining defense when quoting, analyzing, or reproducing a protected work: a short quotation or analysis, a press review, or current-events reporting, each requiring clear credit to the author and source, and none framed as covering AI training.

Burundi Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions

Treat a database compiled through the selection or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even for otherwise-permitted private use.

Rely only on the Law's enumerated exceptions rather than a general fair-use or text-and-data-mining defense when quoting, analyzing, or reproducing a protected work: a quotation compatible with fair practice, a press review, or current-events reporting, each requiring source and author credit, and none framed as covering AI training.

Cameroon Loi n°2000/011 du 19 décembre 2000 relative au droit d'auteur et aux droits voisins, article 4(2)(b) (protection des bases de données)

Treat a database compiled through an original selection, coordination, or arrangement of its contents as a protected composite work: do not exploit the whole or a substantial part of it by reproduction, representation, transformation, or distribution without the rights holder's authorization, even though the underlying facts and data are not themselves protected.

Costa Rica Ley sobre Derechos de Autor y Derechos Conexos, artículo 8, protección de bases de datos

Do not reproduce the original selection or arrangement of a Costa Rican database compilation without the rightsholder's authorization; Costa Rican law protects a database only as a compilation, so it does not by itself bar extracting the underlying data.

Czech Republic Autorský zákon Sections 88-94, Sui Generis Database Right

Do not extract or re-utilize the whole, or a qualitatively or quantitatively substantial part, of a database made with a substantial investment by another person in the Czech Republic without the maker's authorization, and do not repeatedly and systematically extract insubstantial parts in a way that conflicts with the database's normal exploitation or unreasonably harms the maker's legitimate interests.

Côte d'Ivoire Copyright and Neighboring Rights Act, database compilation protection

Treat a database compiled through the choice, coordination or arrangement of its contents as a protected work: do not reproduce all or a substantial part of that arrangement without the rights holder's authorization.

Denmark Ophavsretsloven Section 71, Sui Generis Database Right

Do not reproduce or make available to the public the whole, or a substantial part, of a catalogue, table, database or similar compilation resulting from a substantial investment, without the maker's authorization, for 15 years from the year it was made or first made available.

Estonia Autoriõiguse seadus (Copyright Act) Chapter VIII-1, Sui Generis Right of a Maker of a Database

Do not extract or re-utilise the whole, or a substantial part evaluated qualitatively or quantitatively, of a database reflecting a substantial investment by its maker, absent authorization or a statutory exception, per Copyright Act Section 75-4.

Ethiopia Copyright and Neighbouring Rights Protection Proclamation, Database Protection

Do not reproduce a database whose selection or arrangement of contents is an original creation without the rightsholder's authorization; Ethiopia has no sui generis database right, so an unoriginal, purely factual database is not itself protected on that basis.

Do not rely on the personal-reproduction exception to copy the whole or a substantial part of a database in digital form; that exception does not extend to a database.

European Union Database Directive, Sui Generis Right and Lawful-User Exceptions

Do not extract or re-utilize the whole or a substantial part, evaluated qualitatively or quantitatively, of a database's contents without the maker's authorization, where the maker shows a substantial investment in obtaining, verifying, or presenting that content and is a national or habitual resident of a Member State, or a company or firm formed under a Member State's law with its registered office, central administration or principal place of business in the Community (Art. 11(1) and (2)). Under Art. 43 of Regulation (EU) 2023/2854 the right does not apply to data obtained from or generated by a connected product or related service within that Regulation's scope.

Do not repeatedly and systematically extract or re-utilize insubstantial parts of a database's contents where doing so conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests, even where no single extraction takes a substantial part.

+1 more
France CPI Sui Generis Database Right, Producer's Right to Prohibit Extraction and Reutilization

Do not extract or reutilize a qualitatively or quantitatively substantial part of a French database's content without the producer's authorization, where the producer shows a substantial investment in constituting, verifying, or presenting that content.

Repeated or systematic extraction or reutilization of insubstantial parts can still infringe where it amounts, in its cumulative effect, to extracting or reutilizing a substantial part.

Gabon Loi n°1/87, protection des recueils et compilations

Do not reproduce a collection or database whose choice or arrangement of contents is an original intellectual creation without the rightsholder's authorization; Gabon has no sui generis database right, so an unoriginal, purely factual collection is not itself protected.

Germany Schutz des Datenbankherstellers (Sui Generis Database Right)

Do not reproduce, distribute, or publicly communicate a database, or a substantial part of it, without the database maker's authorisation.

Do not repeatedly and systematically extract insubstantial parts of a database in a way that conflicts with its normal exploitation or unreasonably prejudices the maker's legitimate interests.

Guatemala Ley de Derecho de Autor y Derechos Conexos, Decreto 33-98 (compilations, databases, and technological measures)

Do not circumvent a technological measure that controls access to a protected work, and do not manufacture, import, or traffic in a device or service designed mainly to do so.

No text-and-data-mining exception exists in Guatemalan copyright law; reproducing a protected compilation's own original selection or arrangement to build a training dataset has no statutory carve-out and needs the rightsholder's authorization or a fair-use-style limitation.

Guinea Loi portant protection de la propriété littéraire et artistique, articles 9 et 22 (bases de données)

Do not reproduce all or a substantial part of a database whose selection, coordination or arrangement of contents makes it an intellectual creation without the rightsholder's authorisation; the private-copy exception does not cover it.

Do not rely on a text-and-data-mining exception or a sui generis database right when copying Guinean databases; the law provides neither, so protection turns on the originality of the selection or arrangement alone.

Hungary Szjt. Section 84/A, Sui Generis Database Producer's Right

Obtain the database producer's consent before extracting or re-utilizing the whole or a substantial part of a database's contents, per Szjt. Section 84/A(1), where obtaining, verifying, or presenting that database's contents required substantial investment.

Do not repeatedly and systematically extract or re-utilize even an insignificant part of such a database if doing so conflicts with its normal exploitation or unreasonably prejudices the producer's legitimate interests, per Szjt. Section 84/A(3).

Iceland Höfundalög nr. 73/1972, Art. 50, Sui Generis Database Producer Right

Do not repeatedly and systematically extract or re-utilise an insubstantial part of a protected Icelandic database if doing so conflicts with its normal exploitation or unreasonably prejudices the producer's legitimate interests, under Höfundalög Article 50.

Do not reproduce or make available the whole or a substantial part of a protected database without the producer's authorization within the 15-year protection term.

Ireland Copyright and Related Rights Act 2000, Database Right

Do not extract or re-utilise all or a substantial part of the contents of a database in which a substantial investment (financial, human or technical) has been made in obtaining, verifying or presenting its contents, without the database right owner's authorisation (s. 321(1)-(2)).

Italy Legge sul Diritto d'Autore Artt. 102-bis and 102-ter, Sui Generis Database Right

Do not extract or re-utilize the whole or a substantial part of a database's content without the database maker's authorization, for the fifteen years (renewable on a substantial new investment) following the database's completion or first making-available.

Latvia Autortiesību likums Chapter IX, Sui Generis Database Right

Do not extract (permanently or temporarily transfer to another medium) or re-utilize (make available to the public) the whole, or a qualitatively or quantitatively substantial part, of a database that reflects a substantial investment by its maker, absent authorization or a statutory exception, per Article 57.

Do not repeatedly and systematically extract or re-utilize insubstantial parts of such a database in a way that conflicts with its normal use or unreasonably prejudices the maker's legitimate interests, per Article 57(4).

Liberia Liberia Intellectual Property Act, 2016, database compilation and private-copy exclusion (§§ 9.3, 9.4, 9.10)

Treat a database compiled through the selection or arrangement of its contents as a protected work; do not reproduce the whole or a substantial part of it without the rights holder's authorization, even where the reproduction would otherwise qualify as a permitted private copy.

Do not rely on a text-and-data-mining or general research exception when reproducing a protected work or database for training or analysis purposes; the Act states none.

Liechtenstein Urheberrechtsgesetz, Sui Generis Database Right

Do not extract or re-utilize the whole, or a qualitatively or quantitatively substantial part, of the contents of a database whose producer made a substantial investment in obtaining, verifying, or presenting those contents, without the producer's authorization.

Do not repeatedly and systematically extract or re-utilize insubstantial parts of such a database's contents in a manner that conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests.

Lithuania Law on Copyright and Related Rights (Nr. VIII-1185), Articles 61 to 64, Database Makers' Sui Generis Rights

Do not move the whole content of such a database, or a substantial part of it, to another medium or make it publicly available over computer networks without the maker's permission (Article 61(1)).

Do not make repeated and systematic extracts or use small parts of the content where this conflicts with the normal use of the database or infringes the maker's legitimate interests (Article 63(2)).

Luxembourg Loi du 18 avril 2001 sur les droits d'auteur, Sui Generis Database Right (Art. 67)

Do not extract or reuse the whole, or a substantial part evaluated qualitatively or quantitatively, of the contents of a database protected under this article without the producer's authorization.

Do not repeatedly and systematically extract or reuse insubstantial parts of a database's contents where doing so conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests.

Mexico Ley Federal del Derecho de Autor, Database Compilation and Non-Original Database Protection (Arts. 107 to 110)

Do not reproduce, translate, adapt, reorder, distribute, or publicly communicate a protected database's selection or arrangement, or a non-original database within its 5-year exclusive-use period, without the rightsholder's authorisation.

Moldova Copyright and Neighbouring Rights Law, Sui Generis Database Right

Before extracting or re-utilizing the whole, or a substantial part, of a database a Moldovan producer made a substantial investment in compiling, obtain the producer's authorization, unless a research, private-use, security, or judicial-proceeding exception applies.

Do not repeatedly and systematically extract or re-utilize insubstantial parts of such a database in a way that conflicts with its normal exploitation or unreasonably prejudices the producer's legitimate interests.

Netherlands Databankenwet, Sui Generis Database Right

Do not extract or re-utilize the whole or a substantial part of a database's contents without the producer's authorization, and do not repeatedly and systematically extract or re-utilize insubstantial parts in a way that conflicts with the database's normal exploitation or unreasonably prejudices the producer.

Nicaragua Ley No. 312, protection of compilations and databases

Do not reproduce the whole, or an important part, of a protected compilation or database in digital form without the rights holder's authorization; the personal-use privilege does not cover it.

When reproducing a fragment of a protected work under the quotation right, limit the reproduction to what the citation, analysis, comment, or criticism justifies, and name the source and the author.

Norway Copyright Act, Sui Generis Database Right

Do not extract or reuse all or a substantial part of a database's contents without the producer's authorisation where the database resulted from a substantial investment in collecting, checking or presenting its contents.

Do not repeatedly or systematically extract or reuse immaterial parts of such a database in a way that harms its normal use or unreasonably prejudices the producer's legitimate interests.

Paraguay Ley N° 1328/1998, art. 4, numeral 14, bases de datos como compilación

Do not rely on the personal-copying exception to justify copying a database or a compilation of data; that exception does not reach either.

Peru Decreto Legislativo 822, protection of compilations and databases

Do not rely on the personal-use copying privilege to justify copying a database or compilation of data; that privilege does not reach it.

Poland Ustawa o ochronie baz danych, Sui Generis Database Right

Get the producer's authorization before extracting or reusing a substantial part, by quality or quantity, of a protected database's contents; the right runs 15 years from the database's completion or first public availability.

Do not repeatedly and systematically extract or reuse even an insubstantial part of a database in a way that conflicts with its normal exploitation or unreasonably prejudices the producer's legitimate interests.

Portugal Sui Generis Database Right, Decreto-Lei n.º 122/2000

Do not extract or re-use, for direct or indirect commercial purposes, a substantial part of a database protected by Portugal's sui generis database right or database copyright without the maker's or author's authorization.

Russia Civil Code Part IV, Database Maker's Exclusive Right

Do not extract materials from a database that required substantial financial, material, or organizational outlay to create, or reuse those materials, without the rightholder's permission, where the database is Russian-made or otherwise covered by Civil Code Article 1336; a database of at least 10,000 independent elements is presumed to meet the substantial-outlay threshold, and extraction covers transferring its whole content or a substantial part onto another medium by any technical means, which reaches automated bulk scraping.

Sao Tome and Principe Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia

Do not reproduce a compilation, anthology, or systematic collection whose choice or arrangement of contents is itself an intellectual creation, without the rightsholder's authorization; Sao Tome and Principe has no sui generis database right, so an unoriginal, purely factual collection of data is not itself protected against reproduction.

Serbia Law on Copyright and Related Rights, Right of the Database Producer

Do not extract or re-utilise the whole or a substantial part, in quantitative or qualitative terms, of a database's contents without the database producer's authorisation.

Do not systematically extract or re-utilise insubstantial parts of a database's contents where doing so conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests.

Slovakia Autorský zákon, Special Right to a Database (Sections 135 to 139)

Do not extract or reutilize the whole contents of such a database, or a qualitatively or quantitatively substantial part of it, without the maker's consent (Section 135(1)).

Do not repeatedly and systematically extract or reutilize insubstantial parts of the contents where this conflicts with the normal use of the database and unreasonably interferes with the maker's legally protected interests (Section 135(5)).

Spain TRLPI Articles 133 to 137, Sui Generis Database Right

Do not extract or reuse the whole, or a substantial part evaluated qualitatively or quantitatively, of a database that reflects a substantial investment by its maker, absent authorization or a statutory exception, per TRLPI Article 133.

Sweden Upphovsrättslagen 49 §, Sui Generis Database Right (Katalogskydd)

Do not extract or make copies of a substantial part of a database compiled by, or resulting from a substantial investment of, a person or business connected to Sweden without authorization, for fifteen years from the database's completion.

Turkey Law on Intellectual and Artistic Works, Database Producer Right

Do not transfer a substantial part or all of the content of a database that reflects a substantial investment by its producer to another medium, or distribute, sell, rent, or communicate that content to the public, without the database producer's permission, for fifteen years from the database's disclosure.

Ukraine Copyright Law, Sui Generis Database Right

Do not extract or re-utilise, without the database maker's authorization, the whole or a substantial part of the contents of a database whose maker made a qualitatively or quantitatively significant investment in obtaining, verifying or presenting those contents.

Venezuela Ley sobre el Derecho de Autor, compilations and databases (Art. 3)

Providing public access to a database of protected works over a telecommunication network requires the rightholder's authorization.

Press publishers' right

28 laws, 28 jurisdictions
JurisdictionLawWhat it asks, as read here
Austria UrhG Section 76f, Press-Publisher Neighbouring Right

Obtain the press publisher's authorisation before reproducing the whole of its press publication, or parts of it, or making it available to the public online; the publisher holds the exclusive right; the right does not cover private or non-commercial use by individual users, hyperlinks, or individual words or very short extracts.

Belgium Code de droit économique, article XI.216/2, droit voisin des éditeurs de presse

Obtain the press publisher's authorisation before reproducing its press publication or making it available online; the publisher has the sole right to do so.

Bulgaria Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right

Obtain a licence, for payment, from a press publication's publisher before reproducing its press publications or parts of them online, or offering electronic access to them, as an information-society service provider.

Croatia Zakon o autorskom pravu i srodnim pravima, Pravo nakladnika informativnih publikacija (Arts. 165-166, 170-172)

Obtain the authorisation of a publisher of information publications established in the EU before reproducing, distributing, communicating to the public or adapting its information publications (Art. 165).

If you are an information-society service provider, obtain that publisher's authorisation before reproducing its information publications or communicating them to the public online (Art. 166).

Cyprus Intellectual Property and Related Rights Law, Article 36 (Press Publisher Online Rights)

Obtain the press publisher's authorisation before reproducing its press publication or making it available online (art. 36(1)).

Czech Republic Autorský zákon Section 87b, Press Publisher Neighbouring Right

Obtain the press publisher's authorization before reproducing its press publication or making it available online (Sec. 87b(3)-(4)).

Denmark Ophavsretsloven Section 69a, Press Publisher Right

Obtain the press publisher's consent before reproducing its press publication online or making it available to the public at a place and time individually chosen by them.

Estonia Autoriõiguse seadus (Copyright Act) Section 73-2, Rights of a Press Publication Publisher

Obtain the press publisher's permission before reproducing its press publication online, directly or indirectly, temporarily or permanently, in part or in full, or making it available to the public so that people can access it at a place and time individually chosen by them (Sec. 73-2(1)).

European Union Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market (DSM Directive), Articles 15 and 4

If you are an information society service provider that reuses press publications online, such as a news aggregator or media monitoring service, expect to need a licence from the press publisher for uses within the reproduction and making-available rights that Art. 15(1) gives it, which are the rights in Art. 2 and Art. 3(2) of Directive 2001/29/EC.

Before text and data mining works under the Art. 4 exception (for purposes beyond scientific research), confirm that you access them lawfully and that the rightholder has not expressly reserved the use in an appropriate manner, such as machine-readable means for content made publicly available online (Art. 4(1) and (3)); where no exception applies, an authorisation from the rightholder is required (recital 8).

Show the other 18 laws
France CPI Articles L218-1 to L218-5, Press Publisher and News Agency Neighbouring Right

Obtain the authorization of the press publisher or news agency before any total or partial reproduction or communication to the public of its press publication in digital form (Art. L218-2).

Germany Presseverleger-Leistungsschutzrecht (Press Publisher Neighbouring Right)

Obtain the press publisher's permission before, as a provider of information society services, making its press publication publicly available or reproducing it, in whole or in part, for online use.

Greece Law 2121/1993 Article 51B, Press Publisher Neighbouring Right

Obtain the press publisher's authorisation before reproducing its press publication, in whole or in part, online or making it available to the public (Art. 51B).

Hungary Szjt. Sections 82/A-82/C, Press Publisher's Right

Obtain the press publication publisher's consent before making it available to the public so that people can reach it from a place and at a time they choose, and before reproducing it electronically for that purpose.

Ireland European Union (Copyright and Related Rights in the Digital Single Market) Regulations 2021, Press Publisher Right

Obtain the press publisher's permission before reproducing or making available online its press publication (the reproduction and making-available rights of sections 37, 39 and 40 of the Copyright and Related Rights Act 2000 apply to that use).

Italy Legge sul Diritto d'Autore Art. 43-bis, Press Publisher Neighbouring Right

Obtain the press publisher's authorisation before reproducing or communicating to the public its journalistic publication online (the exclusive rights of LDA Articles 13 and 16).

Latvia Autortiesību likums Article 53.1, Press Publisher Online Rights (DSM Article 15 Transposition)

If you are an information-society service provider, obtain the press publisher's permission before reproducing or making available online its press publication (a journalistic compilation published under one title in a periodical or regularly updated edition).

Lithuania Copyright Act Art. 57-1, Electronic Press Publishers' Right

If you are an information-society service provider, obtain the electronic press publisher's permission before reproducing an electronic press publication or part of it, or making it publicly available online (Article 57-1).

Luxembourg Loi du 18 avril 2001 sur les droits d'auteur, Press Publisher Neighbouring Right (Art. 56 bis and 56 ter)

Obtain the press publisher's authorisation before reproducing or making available online its press publication (the reproduction and making-available rights of articles 43 and 44).

Malta Copyright and Related Rights in the Digital Single Market Regulations (S.L. 415.08), Regulation 15, Press Publishers' Right

Obtain the press publisher's authorisation before reproducing its press publications, or making them available to the public, in any online use.

Netherlands Wet op de naburige rechten, Article 7b, Press Publisher Online Right

If you are an information-society-service provider, obtain the press publisher's authorisation before reproducing its press publication online or making it available to the public (art. 7b(1)).

Poland Ustawa o prawie autorskim, Press Publisher Neighbouring Right

Obtain the press publisher's authorisation before reproducing its press publication for online use or making it available online, where the publisher is established in Poland or in an EU or EFTA/EEA state (art. 99(7)).

Portugal CDADC Article 188.º-A, Press Publisher Online Rights

If you are an information-society service provider, obtain the authorisation of a press publisher established in an EU member state before reproducing, communicating to the public or making available online the whole or part of its press publications (art. 188.º-A(1)).

Romania Legea nr. 8/1996 privind dreptul de autor și drepturile conexe, art. 94^1, Press Publisher Neighbouring Right, inserted by Legea nr. 69/2022

If you are an information-society service provider, obtain the authorisation of the press publisher before reproducing its press publications online (directly or indirectly, temporarily or permanently, in whole or in part) or making them available for individual access at a time and place the public chooses (art. 94^1(1)).

Slovakia Autorský zákon, Press Publisher Right

If you are an information-society service provider, obtain the periodical publisher's consent before reproducing its periodical or making it available online, unless the Act provides otherwise (s. 129c(1)-(2)).

Slovenia Zakon o avtorski in sorodnih pravicah (ZASP), Art. 139.a, Media Publications

If you are an information-society-service provider, obtain the authorisation of a media publisher established in the European Union before reproducing its media publication or making it available to the public.

Spain TRLPI Article 129 bis, Press Publisher and News Agency Online Rights

Obtain the press publisher's or news agency's authorization before reproducing its press publication or making it available online (art. 129 bis(1)).

Sweden Upphovsrättslagen 48 b-48 d §§, Press Publisher Neighbouring Right

Obtain the authorisation of the maker of a press publication before copying it, or making it available to the public so that individuals can access it from a place and at a time they choose, through an information-society service or for online use (48 b-48 d §§).

Text and data mining (TDM) opt-out

16 laws, 16 jurisdictions
JurisdictionLawWhat it asks, as read here
Austria UrhG Section 42h(6), Text-and-Data-Mining Opt-Out for Aggregation

Before mining, check whether the rightsholder has expressly prohibited the reproduction and signalled that prohibition adequately, in particular through machine-readable means for a work made available online.

Do not mine a work whose rights are reserved in that way.

Bulgaria Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for News Aggregation

Before mining, check for a reservation: a rightsholder, including a press publisher, may reserve this use by technical means that the software performing the analysis can recognize, and for works available electronically the prohibition has effect only if so established.

Honour that reservation; a news aggregator indexing press content must do so to remain within the exception.

California Generative Artificial Intelligence Training Data Transparency Act (AB 2013)

In that summary, disclose the data's copyright status and ownership, and whether it included personal information or third-party copyrighted content (including news).

Czech Republic Autorský zákon Sections 39c-39d, Text and Data Mining Exception Bearing on News Indexing

Before mining, check whether the author has expressly reserved the analysis in a suitable way, including by machine-readable means for a work made available online (Sec. 39c(2)).

Do not mine a work whose author has reserved the analysis without the rightholder's authorization; a news aggregator indexing text so reserved needs it.

Estonia Autoriõiguse seadus (Copyright Act) Sections 19-1 and 19-2, Text and Data Mining Exception

Before mining, check for such an exclusion, and do not mine a work whose author has excluded the use.

France CPI Article L122-5-3, Text and Data Mining Exception

Before mining, check for that objection; an indexing or training use that ignores a machine-readable opt-out falls outside the exception and requires authorization.

Greece Law 2121/1993 Articles 21A-21B, Text and Data Mining Exception

Before mining, check for such a reservation, and do not mine material whose rightholder has reserved it.

Kazakhstan Law on Artificial Intelligence, machine-readable opt-out for training on published works

Before using works, published news articles included, to train an AI model, check whether the author or rightsholder has expressed a prohibition in machine-readable form, and do not train on the work if they have (Article 23(5)).

Do not rely on copyright's free-use exceptions for educational or scientific purposes to justify training: training does not fall within them (Article 23(3)).

Latvia Autortiesību likums Article 21.1, Text and Data Mining Exception (News Indexing and Aggregation)

Honour a prohibition given by a rights holder, including a press publisher, by clear notice in an appropriate manner; for publicly accessible works online the prohibition must be machine-readable, including through metadata, so check for it before automated indexing.

Lithuania Copyright Act Arts. 22-1 and 22-2, Text and Data Mining Exceptions

Check for that reservation before mining: for content publicly available online, the appropriate means of reserving the use is a machine-readable one, and do not mine content whose use is reserved.

Show the other 6 laws
Luxembourg Loi du 18 avril 2001 sur les droits d'auteur, Text and Data Mining Exception for News Content (Art. 10, points 15 and 16)

If you index or mine Luxembourg press content for purposes other than scientific research, check for a publisher's machine-readable reservation first and do not mine content that carries one: it removes the exception's protection for that content.

Portugal CDADC Text and Data Mining Opt-Out for News Aggregation

Before text and data mining a legally accessible protected work, including a press publication, check whether the rights holder has expressly reserved that use in an adequate manner, in particular by optical reading of content made available to the public online (art. 75.º(2)(w)).

Do not mine content whose rights holder has reserved that use: the general text-and-data-mining exception does not cover it.

Slovakia Autorský zákon, TDM Exception (Aggregation)

Before text-and-data mining a work, check whether the rightsholder has expressly reserved that use, and do not mine the work if it has (s. 51c).

Slovenia Zakon o avtorski in sorodnih pravicah (ZASP), Arts. 57.a-57.b, Text and Data Mining

Before mining, check whether the author has expressly and appropriately reserved use of the work, in particular through internationally recognized, standardized, machine-readable means carrying metadata and terms of use for a work publicly available online (art. 57.a).

Do not mine a work whose author has reserved its use in that way: the general exception does not apply to it.

Spain RDL 24/2021 Article 67, Text and Data Mining Exception

Before mining, check for that reservation, and do not mine works whose rights holders have reserved the use.

Personal data

8 laws, 8 jurisdictions
JurisdictionLawWhat it asks, as read here
Colombia Código Penal, Violación de Datos Personales

Do not obtain, compile, extract, or use personal data contained in a file, archive, or database without the controller's authorization, even for data found on a public web page.

Grenada Data Protection Act, No. 1 of 2023, application to processing of personal data from a date not yet set

Establish a lawful basis, ordinarily the data subject's consent, before collecting or processing personal data from Grenada, including through crawling or scraping.

Indonesia Personal Data Protection Law, scraped personal data

Have a lawful basis under Article 20 before collecting or otherwise processing the personal data of an individual in Indonesia, including data collected from a public website; the Act carries no basis keyed to the data already being public.

Moldova Personal Data Protection Law, Reach Over Scraped Public Personal Data

A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must still establish an art. 6 lawful basis, such as consent or a legitimate interest that respects the person's rights, for the collection and any later use, including training a model.

Philippines Data Privacy Act of 2012, Application to Scraped Public Personal Data

An app scraping the publicly available personal data of an individual in the Philippines must still identify a lawful basis for processing that data under the Data Privacy Act; the data's public availability does not by itself supply the data subject's consent or any other lawful basis.

Rhode Island Rhode Island Data Transparency and Privacy Protection Act, publicly available information exemption

Do not treat personal data scraped from an aggregator, people-search site, or re-hosted directory as publicly available under RIDTPPA; the exemption has no prong for a third party's unrestricted disclosure of someone else's data.

Tanzania Personal Data Protection Act, 2022, application to processing of personal data

Register with the Personal Data Protection Commission and have a lawful basis before collecting or processing personal data through a crawler or data pipeline, whether or not the data was publicly accessible online.

Uzbekistan Law on Personal Data, publicly available personal data

An app scraping personal data from a publicly accessible Uzbek source must still meet the Law on Personal Data's general lawful-basis and consent requirements unless the data qualifies as publicly available personal data under Art. 29, meaning data the subject has made freely accessible or that is not subject to a confidentiality requirement.

Copyright: the exclusive rights

6 laws, 4 jurisdictions
JurisdictionLawWhat it asks, as read here
European Union Directive 2009/24/EC on the legal protection of computer programs (Software Directive), Articles 1, 4, 5 and 6

Treat a computer program as protected by copyright as a literary work, in the expression of the program in any form but not in the ideas and principles that underlie any element of it, including those that underlie its interfaces (Art. 1(1) and (2)).

Get the rightholder's authorisation before permanently or temporarily reproducing a computer program, in part or in whole, including where loading, displaying, running, transmission or storage of it necessitates the reproduction (Art. 4(1)(a)).

+3 more
United States Copyright Act, exclusive rights and infringement, 17 U.S.C. §§ 106 and 501

Get the copyright owner's permission before you reproduce a copyrighted work in copies or phonorecords, prepare a derivative work based on it, or distribute copies or phonorecords of it to the public by sale or other transfer of ownership, or by rental, lease, or lending, unless sections 107 through 122 allow the use (s. 106(1) to (3)).

Get the copyright owner's permission before you publicly perform or publicly display a work of a kind clauses (4) and (5) of section 106 name, or publicly perform a sound recording by means of a digital audio transmission, unless sections 107 through 122 allow the use (s. 106(4) to (6)).

+3 more
United States Copyright Act, first sale and computer program copies, 17 U.S.C. §§ 109 and 117

Do not dispose of the possession of a copy of a computer program by rental, lease or lending, or by any act in the nature of rental, lease or lending, for direct or indirect commercial advantage unless the owner of copyright in the program authorizes it (s. 109(b)(1)(A)).

Transfer exact copies made under section 117 only along with the copy they were made from and only as part of the transfer of all rights in the program, and transfer adaptations made under it only with the copyright owner's authorization (s. 117(b)).

United States Copyright Act, subject matter of copyright, 17 U.S.C. § 102

Treat an original work of authorship fixed in a tangible medium of expression, in one of the listed categories such as literary works, as protected by copyright (s. 102(a)).

Linking and framing

6 laws, 6 jurisdictions
JurisdictionLawWhat it asks, as read here
Brunei Darussalam Electronic Transactions Act, liability of network service providers for third-party material

Do not assume the shield covers reproducing, framing or linking a publisher's headlines and snippets: no reported Brunei decision has applied it to a news aggregator, and no Brunei statute or case says whether a hyperlink is itself a communication to the public.

China Regulation on the Protection of the Right to Network Dissemination of Information, linking safe harbour and notice-and-takedown (Arts. 14-17, 23)

Disconnect the link to an allegedly infringing work on receiving the rights holder's written notice, and you keep a safe harbour from damages liability; you lose it and bear joint infringement liability if you knew or should have known that the linked work was infringing.

Act on a notice immediately and forward it to the party that supplied the material; a valid notice names the rights holder, identifies the work and its network address, and includes preliminary proof of infringement.

European Union Audiovisual Media Services Directive (AVMSD), Article 7b (Overlay and modification of audiovisual media services)

Do not overlay an audiovisual media service provided by a media service provider for commercial purposes, or modify it, without that provider's explicit consent: Member States must take appropriate and proportionate measures to ensure that such services are not overlaid for commercial purposes or modified without it (Article 7b).

Germany Recht der öffentlichen Zugänglichmachung (Right of Making Available to the Public)

Making a work available to the public by wire or wirelessly, so that members of the public can reach it from places and at times of their choosing, is part of the author's exclusive right of public communication (sections 15(2) and 19a).

Unfair competition

5 laws, 5 jurisdictions
JurisdictionLawWhat it asks, as read here
China Anti-Unfair Competition Law, 2025 revision, Article 13 (data scraping and technical circumvention clause)

Do not obtain or use data lawfully held by another business operator by fraud, coercion, or by evading or destroying that operator's technical access controls.

European Union Trade Secrets Directive, Articles 2 to 5 (trade secret definition, lawful and unlawful acquisition, use and disclosure)

Do not acquire a trade secret without its holder's consent by unauthorized access to, appropriation of, or copying of documents, objects, materials, substances or electronic files lawfully under the holder's control that contain the trade secret or from which it can be deduced, or by any other conduct which, under the circumstances, is considered contrary to fair dealing in commercial practice (Article 4(2)).

Do not use or disclose a trade secret without its holder's consent where you acquired it unlawfully, are in breach of a confidentiality agreement or any other duty not to disclose it, or are in breach of a contractual or any other duty to limit its use (Article 4(3)); the same applies where you knew or ought, under the circumstances, to have known that it had come directly or indirectly from a person using or disclosing it unlawfully (Article 4(4)).

Iran Electronic Commerce Law, Trade Secrets Chapter

Do not illegally acquire, or disclose to a third party, a trade or economic secret in an electronic environment.

South Korea Unfair Competition Prevention and Trade Secret Protection Act, Art. 2(1) items ka and pa (data misappropriation and general catch-all)

Do not acquire data by theft, fraud, unauthorized access, or other wrongful means, or use or disclose data acquired that way.

Do not use, disclose, or provide to a third party, beyond a contractual access limit and for wrongful profit or to harm the data holder, data you accessed under that limit.

+1 more
Switzerland Unfair Competition Act, Exploitation of Another Person's Market-Ready Work Product

Do not take over and exploit, through a technical reproduction process, another person's market-ready work product without a reasonable effort of your own.

AI training data

3 laws, 3 jurisdictions
JurisdictionLawWhat it asks, as read here
European Union AI Act, Article 53 (obligations for providers of general-purpose AI models)

Adopt and follow a copyright policy that respects TDM opt-outs

Kazakhstan Law on Artificial Intelligence, copyright and training data

Do not train an AI model on a published work if the author or rightsholder has posted a prohibition against it in machine-readable form.

United Kingdom CMA Publisher Conduct Requirement on Google's general search services from , in 3 weeks

Provide publishers with effective controls to withhold their search content from being used in generative AI services and features, covering the training and grounding of Google's broader generative AI services and of its search generative AI features.

Make the controls for the grounding of search generative AI features available at directory level and at page level.

+2 more

Comprehensive regime

3 laws, 3 jurisdictions
JurisdictionLawWhat it asks, as read here
Colombia Superintendencia Circular on AI and Personal Data

Before collecting personal data from the internet to develop, train, test or deploy an artificial intelligence system, obtain the data subject's prior, express and informed authorization; a datum being accessible online does not make it a public datum exempt from that requirement.

Ireland DPC Guidance: AI, Large Language Models and Data Protection

Establish a lawful basis before collecting or otherwise using personal data, including publicly accessible personal data, to train an AI model on people in Ireland, and account for the purpose the person originally made that data public for, not only whether it was public.

Zimbabwe Cyber and Data Protection Act [Chapter 12:07]

Process personal data necessarily, fairly, lawfully and for specified, legitimate purposes before a crawler or AI training pipeline collects or uses personal data of a person in Zimbabwe.

Crawl signals

3 laws, 3 jurisdictions
JurisdictionLawWhat it asks, as read here
California AI Training Data Transparency Act (AB 2013)

State whether those datasets include copyrighted, trademarked, or patented data, and whether they include personal information.

New York S9934A, New York Stealth Crawler Prohibition Act proposed

If you operate a crawler that accesses a covered news source, identify it with a valid and accurate user-agent string that states the software product, its version, and the company behind it.

Disclose the specific nature and purpose of the crawler, including every use the news source's content could be put to, at or before the time you request access and in a format the journalism provider can access.

+1 more
United States H.R. 9915, Stealth Bot Prohibition Act proposed

Do not deploy a bot that accesses a website, digital platform, or online service without disclosing its identity and purpose, in a manner reasonably likely to damage, impair, or burden the technical or commercial operation of the website or service.

Identify your bot through a valid and accurate user-agent string, and disclose its specific nature and purpose, including any proposed use of page content such as search indexing or artificial intelligence training, at the time access is requested and in a format the website operator can access.

+1 more

AI prohibited practices

2 laws, 2 jurisdictions
JurisdictionLawWhat it asks, as read here
Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)

Compare only against a reference database formed for each use, and do not use a biometric database fed in whole or in part by untargeted scraping, meaning the automated, indiscriminate, large-scale extraction of facial images from the internet or from closed-circuit camera footage with an AI system to create or expand facial-recognition databases, or built in breach of data-protection law (art. 8, comma 3; art. 2, comma 1, lettera l).

Vietnam Law on Artificial Intelligence, prohibited practices

Do not collect, process, or use data to develop, train, test, or operate an AI system in violation of Vietnam's data, personal data protection, intellectual property, or cybersecurity law.

AI governance

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act

A provider that meets the open-source conditions remains bound by the Article 53(1), point (c), duty to put in place a copyright policy, including identifying and complying with a reservation of rights under Article 4(3) of Directive (EU) 2019/790, and by the point (d) duty to produce a summary of the content used for training (Section 4.1, paragraph 72).

A provider of a general-purpose AI model placed on the market before must take the necessary steps to comply by and is not required to retrain or unlearn the model where that is not possible, where information about the training data is unavailable or where retrieval would cause disproportionate burden, but must clearly disclose and justify each such instance in the copyright policy and the training-content summary (Section 5.3, paragraphs 106 and 108).

Contract terms of service (ToS)

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
Saudi Arabia Copyright Law (2026), licence terms for software, applications and databases

Follow the licence terms that accompany software, applications and databases in Saudi Arabia, including terms that appear electronically on download, installation or use; a user who agrees to them is bound unless they are contrary to public order or morals.

Sensitive categories

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
California AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act) from , in 7 weeks

Do not use covered information, including persistent unique identifiers, created or gathered by your site, service or application to train a generative artificial intelligence system or service or to develop an artificial intelligence system (Section 22584(b)(5)).

Full text of the NIST AI Risk Management Framework, public domain (a US government work). Every control of the framework.