Law / Frameworks / NIST Privacy Framework / Control-P
NIST Privacy Framework, Control-PCT.DP-P1
Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).NIST Privacy Framework, version 1.0, January 2020, CT.DP-P1
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 8
- laws
- 7
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
- 1
- proposed, not law
A law in force is unmarked; the rest wear their state: proposed
Adult content age verification (AV)
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 France |
Délibération n° 2024-20 du 9 octobre 2024 de l'Arcom relative au référentiel technique de vérification de l'âge pour l'accès aux contenus pornographiques (Arcom Deliberation No. 2024-20 of 9 October 2024 on the technical reference framework for age verification for access to pornographic content) |
Offer at least one double anonymity method, in which an independent third party such as a bank, mobile operator or dedicated identity provider confirms a user is an adult without the pornographic site learning the user's identity and without the third party learning which site is being visited. |
 Italy |
Delibera AGCOM n. 96/25/CONS dell'8 aprile 2025 (technical and process rules for age verification) |
Verify that users are adults before granting access to pornographic content, using a dual anonymity model with independent certified third-party verifiers, so that neither the verifier nor the site learns both the user's identity and the service accessed. |
Sensitive categories
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Chad |
Loi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques) |
Where processing genetic data or data revealing health-related secrets, use a unique patient identifier distinct from other identification numbers, and interconnect it with another identifying number only with ANSICE's express authorization. |
 Monaco |
Loi sur la Protection des Données Personnelles, données sensibles et mineurs |
As an administrative or judicial authority acting in the exercise of your public powers, do not process genetic or biometric data for authentication or identity control without first obtaining the Authority's opinion, and store the raw biometric data separately from any template derived from it. Do not interconnect data from the judicial criminal record with any other file or processing operation. |
Age-appropriate design code
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 European Union |
EU KIDS Act proposal (Keeping Internet Digital Spaces Accountable and Trustworthy) proposed |
A provider using age assurance would have to use a solution that does not identify, locate, track or profile the person, and would have to process no more personal data than strictly necessary to assess whether the age threshold is met. |
App store age verification (AV)
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
| France |
Loi n° 2022-300 du 2 mars 2022 visant à renforcer le contrôle parental sur les moyens d'accès à internet (Law No. 2022-300 of 2 March 2022 strengthening parental control over means of internet access), Article 1, parental-control device on terminal equipment |
Build the device so that it can block downloads from software app stores of content that the law forbids to minors and can block access to installed content of that kind, and so that it runs locally without collecting the minor's personal data on servers. |
Biometric privacy
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 China |
Provisions on Security Management of Facial Recognition Technology Application |
Store captured facial information only on the recognition device itself; do not transmit it over the internet unless a legal exception applies or the individual has separately consented. |
Comprehensive regime
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 New Zealand |
Privacy Act 2020, Information Privacy Principles and Extraterritorial Reach |
Do not assign a unique identifier to an individual unless it is necessary to carry out your organisation's functions efficiently, and do not assign the same identifier already assigned by another agency except in limited circumstances. |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.