NIST Privacy Framework, Control-PCT.PO-P1

An app that processes race, nationality, family-life, religious-belief, health, or conviction data from a person in Azerbaijan must have a specific statutory ground for that processing under Art. 9.7; biometric data is not one of these special categories under Azerbaijan's law and is governed instead by the Act's ordinary processing conditions.

An app processing an individual's race, ethnic origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, or health or sexual status in Bahrain must obtain the Data Subject's consent unless the Art. 5 public-availability exception applies; biometric data is not part of this Sensitive Personal Data category, so it is governed instead by the Art. 15 prior-authorisation rule.

An app that derives a facial image, voiceprint, or other biometric identifier from a person in Bangladesh must treat it as Sensitive Personal Data and satisfy one of section 7's narrower lawful-basis conditions, ordinarily the data principal's specific consent, before processing it.

Do not process sensitive personal data, including biometric data, unless the data subject consents or a specific statutory ground applies.

Process a child's personal data only where consent is given or authorised by the child's parent or guardian, a child being a person under the age of 18.

Do not process special personal data, meaning data on race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, or biometric or genetic data, without the personal data subject's consent, unless a listed exception applies, such as the data having been publicly disclosed by the subject, a labor relations purpose, or medical care by a bound professional, under Article 8.

Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.

Verify that a minor is at least sixteen years old before processing their personal data in connection with an information society service offered directly to them, and otherwise obtain the consent of the holder of parental responsibility, making reasonable efforts to verify that consent given the technology available.

An app that derives a voiceprint, faceprint, or other biometric identifier from a person in Bhutan must treat it as Sensitive Personal Data or Information and obtain the subject's express written permission before collecting it, unless the information is itself freely available or accessible in the public domain.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.

Process personal data about a criminal conviction or offence only under the supervision of a public authority or where a special law authorizes it with safeguards for the person's rights, and keep any register of criminal convictions exclusively under a public authority's control, under Article 12.

Obtain consent given or authorised by a parent or a person with parental duties over a child under sixteen before processing that child's personal data for an information-society service offered directly to them; a child who is sixteen may consent themselves.

Do not process racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health data, or data concerning sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.

Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.

Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in Bulgaria.

Obtain the data subject's express consent before collecting or processing sensitive personal data, including data about health, biometric or genetic characteristics, sex life, racial or ethnic origin, political, philosophical, religious or trade union opinions or activity, morals, or criminal investigations, prosecutions, convictions and administrative or safety measures, unless a specific statutory exception applies.

Restrict any processing of personal data about offenses, convictions or safety measures to a court or public authority acting within its legal powers, a public body managing a public service after the CIL's concurring opinion, or a legal auxiliary acting strictly within duties assigned to it.

Create or keep a central register on persons suspected of illegal activities or on criminal or administrative offences, penalties or security measures only as a public service with that legal competence, and limit processing for police investigation to what a concrete danger or a particular offence requires.

Do not process personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, unless the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, the CNPD authorizes it, or another of the law's listed grounds is met.

Process health, sex life and sexual orientation data, including genetic data, only through a health professional or other person bound by professional secrecy, only for preventive medicine, work-capacity assessment, medical diagnosis, health or social care or health system management, and only once notified to the CNPD, with adequate information security measures.

If you operate a site, service or application, or work on behalf of an operator, that you know is used for K-12 school purposes and that is designed or marketed for them, do not engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use (Business and Professions Code Section 22584(a)(10), (b)(1)).

Do not use covered information, including persistent unique identifiers, created or gathered by your site, service or application to train a generative artificial intelligence system or service or to develop an artificial intelligence system (Section 22584(b)(5)).

A data controller must not process sensitive personal data, which includes a facial image, fingerprints, or another biometric identifier, genetic data, health data, and data revealing racial origin, political opinions, religious or philosophical beliefs, or trade union membership, unless it also meets one of nine listed conditions, such as the data subject's explicit consent.

Get a data subject's explicit consent, and apply extra security and organisational safeguards, before processing a sensitive category of data such as racial origin, biometric or genetic data, health data, or political, religious, or trade union information.

Get authorisation from a holder of parental responsibility before processing a minor's personal data, including for a direct offer of information society services to a child.

Do not process biometric data, or data revealing racial or ethnic origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sex, health, or sexual life, unless the data subject gives explicit written consent or a listed statutory exception applies.

Process a minor's personal data only in keeping with the representation rules the law sets for the exercise of the minor's own rights.

Obtain the individual's separate, explicit consent before processing any sensitive personal information, including a biometric identifier such as a faceprint or voiceprint, in addition to any general consent already collected.

Process biometric identifiers only for a specific, necessary purpose and under strict protective measures, and obtain guardian consent before processing a minor's data.

Before processing sensitive personal data, including data revealing racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, or biometric data, obtain the data subject's explicit authorization; processing sensitive personal data is otherwise prohibited.

Process sensitive personal data without the data subject's explicit authorization only where it protects the data subject's vital interest and they cannot consent, where a not for profit political, philosophical, religious or union body processes it about its own members without disclosing it to third parties, where it is needed to establish, exercise or defend a right in a judicial proceeding, or where it serves a historical, statistical or scientific purpose and the data subject's identity is suppressed.

Treat data generated by measuring an individual's biological, genetic, biochemical, physiological, or neural properties, or central or peripheral nervous system activity, as sensitive data requiring the consumer's affirmative opt-in consent before you process it.

Get opt-in consent, parental consent for a minor under 13, before processing a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects.

Do not collect or process data revealing political, philosophical or religious opinions, trade union membership, or health or sexual life data, without the data subject's express consent, unless a listed exception applies, such as safeguarding a life the data subject cannot consent to protect.

Process data on offenses, convictions or security measures only as a court, a public authority, a body managing a public service, a legal auxiliary acting within your legal duties, or another legal person managing a dispute over an offense of which you were the victim.

Obtain a Connecticut consumer's opt-in consent before processing sensitive data, including biometric data generated to uniquely identify the individual.

Do not access an Electronic Health Record without the citizen's consent (Article 34).

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in the Czech Republic.

Do not process personal data revealing a person's racial, ethnic or regional origin, political opinion, religious or philosophical belief, trade-union membership, sex life, or genetic data concerning health, unless a listed exception applies.

Confine processing under the non-profit exception to the body's own members or to people with regular contact related to its purposes, and do not disclose the data to a third party without their consent.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.

Rely on the data subject's explicit consent, a manifestly public disclosure by the data subject, a vital interest, an important public interest, a public authority's public-interest mission, public-statistics legislation, or supervised preventive or occupational medicine as the only grounds for processing a prohibited special category of data.

Ground the processing of any biometric identifier of a person in Denmark, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.

Do not process sensitive personal data (racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, or health data) without the data subject's express consent or another statutory ground.

Let a minor consent alone to an information-society service's processing of their personal data only from age 16, obtain the consent of the person holding parental authority below that age, and make reasonable efforts to verify it given the technology available.

Obtain the data subject's free, conscious, and voluntary consent before forming a file, bank, or register that reveals their sensitive data (political opinions, religious or philosophical convictions, union affiliation, or health or sex-life information).

Do not create a data file, bank, or register that stores sensitive data except as this law provides, even though a church, religious association, clinic, hospital, or political or union organization may still keep a register of its own members.

Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.

Do not process sensitive data at all unless the data subject has given explicit consent or one of the other grounds article 26 lists applies.

Obtain a parent or legal guardian's consent before processing a child's personal data, and do not condition a child's participation in a game, competition, or activity on personal data beyond what participation requires.

Obtain the Data Subject's explicit written consent before any dealing with their Sensitive Personal Data, outside the cases a law authorises, on top of the Center's licence.

Do not compel a person to provide sensitive personal data (data touching physical or moral characteristics, or facts of private life whose misuse could cause discrimination or gravely harm honor or privacy, including religious belief, ethnic origin, political or union affiliation, sexual preference, health, or biometric or genetic information); take it only with the data subject's express and unequivocal consent after telling them of their right to withhold it.

Obtain a sensitive data subject's consent in writing, by an autograph signature or its equivalent, and apply the Progressive Exercise of Faculties principle to a child's consent to provide their personal data.

Ground the processing of any biometric identifier of a person in Estonia, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.

Do not process sensitive personal information, including genetic data, data related to children, data related to offences or criminal sentences, biometric data, or information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, gender, or health or sex life, unless a listed exemption applies.

Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.

Do not process sensitive personal data, including genetic or biometric data, unless a listed exception applies, such as the data subject's specific written consent.

Process a minor's personal data only with the consent or authorization of a parent, guardian, or tutor, or where necessary to the minor's vitally important interest, and never for marketing, profiling, or merging of profiles.

If you are an obliged entity, process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679, and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation, only to the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, and subject to the safeguards of Article 76(2) and (3) (Article 76(1)).

Process personal data covered by Article 10 of Regulation (EU) 2016/679 only if you comply with the conditions of Article 76(2), the data relate to money laundering, its predicate offences or terrorist financing, and you have procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence (Article 76(3)).

Do not include special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679 in the information on which the creditworthiness assessment is carried out (Article 18(3)).

Do not consider a social network as an external source for the purpose of this Directive (Article 18(3)).

If you are a health data user, process electronic health data for secondary use only on the basis of and in accordance with the purposes contained in a data permit issued under Article 68, a health data request approved under Article 69 or, in situations referred to in Article 67(3), an access approval from the relevant authorised participant in HealthData@EU referred to in Article 75 (Article 54).

Seek access only for a purpose listed in Article 53(1), because a health data access body grants access only where your processing is necessary for one of them: the public interest in the areas of public or occupational health; policymaking and regulatory activities to support public sector bodies or Union institutions, bodies, offices or agencies in the health or care sector; statistics related to health or care sectors; education or teaching activities in health or care sectors at vocational or higher education level; scientific research related to health or care sectors that contributes to public health or health technology assessments, or ensures high levels of quality and safety of healthcare, of medicinal products or of medical devices, including development and innovation activities for products or services and the training, testing and evaluation of algorithms, including in medical devices, in vitro diagnostic medical devices, AI systems and digital health applications; and improvement of the delivery of care, the optimisation of treatment and the provision of healthcare, based on the electronic health data of other natural persons (Articles 53(1) and 68(1), point (a)).

Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.

Treat any biometric identifier your system derives through its own technical processing for the purpose of uniquely identifying a person as special category data, even where the underlying image or audio was lawfully public.

If you are a digital labour platform, do not, by means of an automated monitoring system or an automated decision-making system, process any personal data on the emotional or psychological state of a person performing platform work (Article 7(1)(a)).

Do not, by means of such a system, process any personal data in relation to private conversations, including exchanges with other persons performing platform work and the representatives of persons performing platform work (Article 7(1)(b)).

If you are a controller and use targeting techniques or ad-delivery techniques that involve the processing of personal data in online political advertising, process the data only if you collected it from the data subject (Article 18(1)(a)).

Process the data for those techniques only if the data subject has given explicit consent, within the meaning of Regulations (EU) 2016/679 and (EU) 2018/1725, to the processing of personal data separately for the purpose of political advertising (Article 18(1)(b)).

Ground the processing of any biometric identifier of a person in Finland, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent, unless it falls within one of the eight contexts Data Protection Act Section 6 lists, none of which is biometric-specific.

Obtain a qualifying Florida consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, if you meet FDBR's $1 billion-plus controller threshold.

Display the notice "NOTICE: This website may sell your sensitive personal data" and obtain consent before selling a qualifying consumer's sensitive personal data.

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in France.

Process a minor's personal data only on their own consent once they turn eighteen, or otherwise only with the express authorization of the holder of parental authority, and confirm by some means that the consent you rely on is theirs.

Do not collect or process data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies, such as the data subject's own express consent, a non-profit body's processing of its own members, data the person made public, or preventive medicine and care administered by a bound health professional.

Do not process genetic or biometric data, or data revealing racial origin, political opinions or health status, unless you have both a lawful basis and one of the Act's listed conditions, such as the data subject's explicit consent.

Obtain parental or guardian consent before processing the personal data of a person under the age of 18, and put that child's best interests and privacy first.

An app that processes special-category data, including biometric or genetic data, from a person in Georgia must rely on one of Art. 6's 20 lawful grounds, most commonly the data subject's explicit consent.

Where you deploy a biometric time clock, access control system, or voice-authentication system for employees in Germany, satisfy BDSG Section 26(3)'s conditions rather than relying on employee consent as the sole basis.

If you use health data made available for scientific research, use it only for the purposes for which it was made accessible, do not pass it to third parties, and do not process it to establish a link to a person or to identify care providers or payers (Section 7, paragraphs 1 and 2).

Do not process special personal data, including a person's ethnicity, race, political opinion, religious belief, health, sexual life, or criminal behaviour, or the personal data of a child under parental control, unless a listed exception applies.

Process special personal data only where it is necessary or the data subject consents, treating processing as necessary where it exercises or performs a right or obligation the law imposes on an employer.

Do not process sensitive personal data, including health, genetic, biometric, sex life, political or religious information, except on one of the Act's listed grounds, ordinarily the data subject's written consent.

Where you rely on a ground other than consent, confirm it is one the Act lists: an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained, medical purposes handled under a duty of confidentiality, legal proceedings or advice, the administration of justice, a government function, or information the data subject has already made public.

Do not intentionally disclose, or threaten to disclose, a private intimate image of an identifiable person without that person's consent, when you know or recklessly disregard that the image is private, the person did not consent, or the person is identifiable.

Do not force a person to provide personal data that could cause them discrimination, or patrimonial or moral harm or risk.

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric data of a person in Hungary; the Infotorveny's own definition tracks GDPR Article 4(14) without narrowing or expanding it.

Do not access, request, or require an individual's private genetic information, or require a genetic test, as a condition of a hiring, promotion, retention, or other related employment decision in Idaho if you employ five or more persons.

Obtain an Indiana consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, or process a known child's sensitive data only under COPPA's consent framework.

An app that stores, processes, or distributes data revealing a Iranian resident's tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition needs their explicit consent first. Any other collection or processing of personal data needs consent for a specified, described purpose, must be limited to that purpose, must stay accurate, and must let the person access their own data with a right to have it corrected or completely removed. The law names no biometric category, so a voiceprint or faceprint is not subject to a heightened consent, retention, or destruction standard beyond the general consent-based rule, and nothing in this chapter conditions moving personal data out of Iran or requires notifying anyone after a security incident. Violating Article 58's sensitive-data consent rule is a criminal offense (one to three years' imprisonment); separately, Article 78 makes a private or governmental institution liable to compensate a person damaged through electronic transactions by its deficiency or fault.

Where you process special category data, including biometric data, about an employee in Ireland on the ground that employment or social welfare law gives you or the employee a right or obligation, take suitable and specific measures to safeguard the employee's fundamental rights and freedoms, under Data Protection Act 2018 Section 46.

Treat any biometric identifier your system derives through its own technical processing as GDPR Article 9 special category data, whether or not the source photo or audio was publicly available.

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Italy.

Do not process genetic data, biometric data, health data or any other sensitive personal data unless at least one condition in section 24 is met in addition to a condition in section 23.

Obtain the data subject's consent in writing before processing their sensitive personal data on the consent condition, and stop processing on that condition once the consent is withdrawn.

An app that processes biometric data about an individual in Jordan, including a faceprint or voiceprint, must treat it as Sensitive Personal Data and obtain consent or rely on one of the Law's enumerated exceptions, and must not retain it beyond the processing purpose unless legislation specifies otherwise. Whether Jordan requires a heightened, explicit-consent standard specifically for biometric processing, beyond ordinary consent, is not confirmed.

Do not require, request, or use a Kansas health-benefit-plan applicant's or enrollee's genetic test results to condition coverage, set rates, or adjust premiums.

Obtain the written consent of an adult student, or the parent or legal guardian of a minor student, before a Kansas school district collects the student's biometric data, including a fingerprint, retina or iris pattern, voiceprint, DNA sequence, facial characteristic, or handwriting sample.

Obtain that same written consent before using a device or mechanism to assess a Kansas student's physiological or emotional state.

Obtain a Kentucky consumer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual.

Do not process biometric, genetic, health or other sensitive personal data unless a specific ground under section 45 applies, in addition to the Act's general lawful-basis requirement.

Do not process health data unless you are a health-care provider or a person bound by professional secrecy.

Obtain consent from a parent, guardian, or other appropriate legal representative before relying on the consent of a data subject who is under eighteen or otherwise lacks legal capacity, wherever the Act requires the data subject's consent for a lawful basis, retention, an automated decision, or a cross-border transfer.

Obtain that same consent from a parent, guardian, or other appropriate legal representative before relying on a data subject's voluntary provision of personal data as a lawful basis, where the data subject is under eighteen or otherwise lacks legal capacity.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 8(2) exception applies, most commonly the data subject's explicit consent.

Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what an official authority controls under the relevant law.

An app that processes biometric data for the digital identification of a Kyrgyzstani data subject, including a voiceprint or faceprint, must satisfy one of Art. 80(2)'s narrow lawful grounds before processing; such processing is prohibited by default otherwise. The Code itself supplies no illustrative list of biometric modalities for this general provision.

Ground the processing of any biometric identifier of a person in Latvia, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent, under Personal Data Processing Law Article 25(2).

Do not collect or process data that reveals, directly or indirectly, the health status, genetic identity or sexual life of a person in Lebanon.

Rely on one of the four exceptions only: the person made the data public or explicitly agreed to the processing and no legal impediment applies, the processing is necessary to establish a medical diagnosis or provide medical treatment by a healthcare professional, a right is being proved or defended before a court, or you hold a licence under Article 97.

Do not process personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life, or criminal behaviour, unless a listed exemption applies.

Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.

Ground the processing of any biometric identifier of a person in Liechtenstein, including a faceprint or voiceprint captured for unique identification, on a ground in GDPR Article 9(2), such as explicit consent, or on a derogation in Article 21 of the Datenschutzgesetz.

Ground the processing of any biometric identifier of a person in Lithuania, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.

Obtain a Louisiana consumer's consent before selling sensitive data, if you meet the LDPA's revenue-from-sale applicability threshold.

Ground the processing of any biometric identifier of a person in Luxembourg, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.

If you are an insurance or reinsurance undertaking, process health data other than genetic data only where necessary for pre-contractual measures or for performing an insurance or reinsurance contract, and respect professional secrecy under Article 300 of the Law of 7 December 2015 (Article 181-3, paragraph 1).

Do not process sensitive data, including racial origin, biometric, genetic, political opinion, religious or other belief, trade union, health, or sex-life data, unless one of the law's listed exceptions applies, such as the data subject's express consent.

Restrict processing personal data about offenses, convictions, or safety measures to a court, a public authority managing a public service acting within its legal powers, or a legal auxiliary acting within the strict needs of a legally assigned mission.

A Controller must not process special categories of personal data, which include biometric data used to identify a person uniquely, genetic data and health data, unless one of the instances section 17 lists applies, such as the data subject's explicit consent to one or more specified purposes.

A Controller relying on legitimate interest must weigh the position of a child, whose interests and fundamental rights section 16 treats as a particular reason that interest is overridden.

Do not process sensitive data (data relating to religious, philosophical, political, or union opinions or activities; sexual life or racial origin; health; social measures; prosecutions; or penal or administrative sanctions) unless the Autorité de Protection des Données à Caractère Personnel has defined appropriate safeguards for it and one of the listed conditions applies, such as necessity to safeguard the life of the data subject or a third party who cannot consent.

Limit any processing of personal data relating to offences and convictions to a court or public authority acting within its legal powers, a judicial auxiliary acting for the strict needs of duties the law assigns it, or another legal person handling, for the strict needs of managing contentious matters, offences of which it was itself the victim.

Do not collect, process, or share sensitive data, including genetic or biometric data, unless strictly necessary to provide a product or service the consumer requested. MODPA supplies no separate consent-only path around this necessity requirement.

Never sell sensitive data. MODPA bans the sale of sensitive data outright.

Before collecting or processing data revealing racial, ethnic, linguistic, or regional origin, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, confirm one of the Act's ten listed exceptions applies.

Process data on criminal offences, convictions, or security measures only if you are a court, a public authority, a public-service body, or a legal auxiliary acting within your legal mission.

Do not process a special category of personal data (including biometric data uniquely identifying a person) unless one of the specific grounds in section 29(1) applies, in addition to the Act's general lawful-processing requirement.

Obtain the data subject's express, written consent, by autograph signature, electronic signature, or another authentication mechanism, before processing their sensitive personal data, unless a statutory exception applies.

Do not create a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with your explicit activities or aims.

Obtain a test subject's written, informed consent before a physician orders a presymptomatic or predictive genetic test in Michigan.

Obtain a Minnesota consumer's opt-in consent before processing biometric data, or any other sensitive data, when that biometric data is processed for the purpose of uniquely identifying the individual.

Do not require or request an individual's or their blood relative's genetic information or a genetic test, or consider genetic information or a genetic test result without the individual's approval, when making a health-plan eligibility, premium, coverage, or renewal decision.

Do not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit otherwise due them, unless a statutory exception applies.

Obtain explicit consent or another enumerated exception before processing biometric data, including facial images, of a person in Moldova for unique identification.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data or data concerning health, sex life or sexual orientation, unless one of the article 9(2) cases applies.

Do not process sensitive data, meaning data revealing political, religious, philosophical, or trade union opinions, racial or ethnic origin, genetic data, biometric data used to identify a person uniquely, or data about health, sex life, or sexual orientation, unless one of the listed exceptions applies.

Where you rely on a person's explicit consent to process their sensitive data, keep evidence that the consent was specific, informed, and given by a clear positive act, since a law can also bar that prohibition from ever being lifted by consent alone.

Obtain opt-in consent before processing a Montana consumer's genetic or biometric data collected to uniquely identify them.

Do not process sensitive data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data, without a specific legal authorization, the CNDP's prior authorization, or the data subject's express consent.

Do not process personal data about offenses, criminal convictions, or security measures unless you are a court, a public authority, a public service body, or an auxiliary of justice acting within your legal duties.

An app that holds a voiceprint, faceprint, or other biometric identifier of a person in Nepal must have the person's consent before disclosing or publishing it to a third party, and must have consent or lawful authorization before recording a private conversation to derive it in the first place, though Nepal's Privacy Act does not treat biometric data as a heightened "sensitive information" category the way it treats caste, political affiliation, religion, health, or sexual orientation.

Obtain a GDPR Article 9(2) basis before processing health, genetic, racial or ethnic origin, political opinion, or religious-belief data of a person in the Netherlands, following UAVG's Chapter 3 exceptions where one applies to your processing purpose.

Do not treat the citizen service number (BSN) as a general-purpose identifier; UAVG Article 46 restricts its processing.

Obtain a New Hampshire consumer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual, racial or ethnic origin, religious belief, a health condition, sexual orientation, citizenship or immigration status, a known child's data, or precise geolocation.

Obtain a person's informed, written consent before obtaining their genetic information or samples for genetic analysis, or before performing genetic analysis or collecting, retaining, transmitting, or using their genetic information, unless a statutory exception applies.

Process sensitive personal data (racial or ethnic origin, political affiliation, religious or philosophical belief, union membership, health or sex life, criminal record, or financial and credit information) only on a general-interest ground recognized by law, the data subject's consent, or a judicial order.

Do not create a data file that stores sensitive personal data except as this Act provides, even though a commercial company or nonprofit association may still keep a file of its own members' data.

Do not process data revealing racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, genetic or biometric data, social measures, or criminal or administrative sanctions, unless the data subject made it manifestly public themselves, gave written consent, or another listed exception applies.

Process health data only for the listed purposes, such as preventive medicine, diagnosis, care administration, public health, safeguarding vital interests, administering social-protection benefits, a legal claim, or ethics-committee-approved research, and restrict that processing to medical professionals or persons bound by professional secrecy.

Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.

Do not seek, give or accept consent in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.

Do not process a special category of personal data unless one of Article 13's exceptions applies, such as the data subject's explicit consent, a necessity ground tied to employment or social security law, vital interests, or an important public interest carried out with suitable safeguards.

Process personal data relating to criminal convictions and offences only under the control of an official authority, or under a law that provides appropriate safeguards for the rights and freedoms of data subjects.

Ground the processing of any biometric identifier of a person in Norway, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.

Obtain an Oklahoma consumer's opt-in consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual.

If you obtain information from a consumer reporting agency's files, do so only for a purpose section 8 allows.

Collect and use a health number only if the individual who requested your services authorized it, only to verify the individual's identity or for another prescribed purpose, and in accordance with the prescribed rules.

Do not collect, use or disclose personal health information about an individual unless you have the individual's consent and, to the best of your knowledge, the collection, use or disclosure is necessary for a lawful purpose, or the Act permits or requires it.

Make sure a consent is the individual's own, is knowledgeable, relates to the information and is not obtained through deception or coercion. A consent to disclosure to a person that is not a health information custodian must be express unless an exception in section 18 applies.

If you are not the custodian's agent, use personal health information you can access while providing the services only as necessary to provide them, and do not disclose it.

Do not collect or use another person's health number except for provision of provincially funded health resources to that person, for the purposes for which a custodian disclosed the number to you, or for another purpose the Act lists, such as, if you are a prescribed person acting with the individual's express consent, identifying the individual's records, verifying identity or linking records.

Do not require anyone to produce their health card, unless you provide a provincially funded health resource to a person who has one.

Obtain a lawful basis and, for sensitive data, opt-in consent before processing an Oregon consumer's genetic or biometric data.

Do not transfer sensitive personal data (data touching a person's intimate sphere, or whose misuse could enable discrimination or serious risk, including racial or ethnic origin, religious or philosophical belief, union affiliation, political opinion, health, sexual orientation, or genetic or biometric data) unless the data subject gave explicit authorization or a narrow statutory exception applies.

Take a data subject's consent to processing sensitive health data only when it is prior, irrefutable and express, a higher bar than ordinary consent.

Treat racial or ethnic origin, religious or political belief, health, sexual orientation, genetic data and biometric data used to uniquely identify a person as sensitive data, and process it only on one of the law's narrow grounds.

Do not process sensitive data at all unless one of the narrow grounds article 20 lists applies, such as the data subject's own consent or data the person has made public.

Obtain opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify an individual.

For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.

Process health data without consent only where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment at a health establishment or by a health-sciences professional observing professional secrecy, for a public-interest or public-health reason the Ministry of Health has qualified as such, or for an epidemiological or similar study using an adequate dissociation procedure.

Ground the processing of any biometric identifier of a person in Portugal, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.

Process the biometric data of a worker in Portugal only for attendance control and for control of access to your premises, use only representations of the biometric data, and collect it in a way that does not allow the data to be reversed, under Lei 58/2019 Article 28(6).

Do not publish or disclose a known minor user's personal information beyond their name and city of residence without the minor's and a parent's or guardian's consent.

Do not profile a known minor through fully automated processing of their personal information unless the profiling is reasonably necessary to the service or serves a compelling, minor-protective purpose, and safeguards are in place.

Obtain the person's express consent, not an inferred or bundled one, before using sensitive personal information for a new purpose or communicating it to a third person.

Do not collect or process personal data revealing ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data, or a person's state of health, unless one of the article 15 grounds applies.

Process genetic data itself only to verify a genetic link for a person's identification, or for the prevention or repression of a specific criminal offence, in the administration of proof in court.

Obtain a Rhode Island customer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual.

Obtain explicit consent or express legal authorization, with adequate protective measures, before using genetic, biometric, or health data of a person in Romania to drive an automated decision or profile.

Obtain written consent before processing biometric personal data of a person in Russia, including an identifier such as a facial image or voice recording that would fall under Article 11's general definition, unless a narrow Article 11(2) statutory exception applies.

Never make provision of biometric data a condition of service to a person in Russia, except where a separate federal law affirmatively mandates identification.

Process sensitive personal data, including genetic or biometric information, race, health status, criminal records, religious or philosophical beliefs, political opinion, sexual life or family details, only on one of the five grounds article 10 lists, such as the data subject's consent, a vital interest, public health, or archiving, scientific or statistical purposes.

Before processing personal data you know belongs to a child under sixteen, obtain the consent of a holder of parental responsibility over the child, unless the processing is necessary to protect the child's vital interest.

Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or an offence they committed or are alleged to have committed, unless a listed exception applies.

Process sensitive personal data only with the data subject's explicit consent, for an employment right or obligation, to protect vital interests where consent cannot be given or has been unreasonably withheld, for medical purposes by a healthcare professional or an equivalent confidant, for legal proceedings, advice, or the administration of justice, or where the data subject has deliberately made the information public.

Do not process a special category of sensitive personal data (racial or ethnic origin, political opinion, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a listed ground applies, the person has given explicit consent, or the person already published it themselves.

Process sensitive personal data for health or medical purposes only through a health practitioner or someone bound by professional confidentiality, and only for preventive medicine, public health, medical diagnosis, medical research, or managing health and hospital care services.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data or data concerning health, sex life or sexual orientation, unless one of the article 8(2) cases applies.

Where you rely on the not-for-profit body ground, confine the processing to the body's members or regular contacts and do not disclose the data outside it without the data subject's consent.

Before processing a sensitive category of data (political, religious, trade-union or philosophical affiliation, racial or ethnic origin, private life, health, sex life, or genetic data), obtain the holder's explicit authorization, rely on a specific legal provision, or obtain NAPPD authorization for an important public interest.

Where you process health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management, do so only through a health professional or another person bound by professional secrecy, notify NAPPD of the processing, and secure it with appropriate information-security measures.

An app that derives a faceprint, voiceprint, or other identity-linked biometric identifier from an individual in Saudi Arabia, for any purpose the purpose-based Sensitive Data definition would reach, must obtain the Data Subject's explicit consent before processing it, and must destroy it once the processing purpose is fulfilled or consent is withdrawn.

Before collecting or processing data revealing racial, ethnic, or regional origin, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, confirm one of the Act's narrow exceptions applies.

Process data on criminal offences, convictions, or security measures only if you are a court, a public authority, a public-service body, or a legal auxiliary acting within your legal mission.

Do not process data revealing racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or process genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the person's explicit consent for one or more specified purposes.

Where a minor is 15 years old or older, their own consent is enough to process personal data for an information-society service; below that age, get consent from the parent exercising parental responsibility or another legal representative, and take reasonable steps to verify it.

Do not process race, ethnic origin, biometric, genetic, political, religious or health-related personal data unless a specific exception in section 22 applies.

Obtain consent from a parent or legal guardian before processing the personal data of a person below 18 years, and verify that such consent has been given.

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Slovakia.

Use the Slovak birth number (rodne cislo) to identify a person only where that use is necessary for the purpose, obtain explicit consent where consent is the legal basis, and do not publish it unless the data subject published it themself (Act No. 18/2018 Coll., Section 78(4)).

Obtain consent from a parent or other appropriate legal representative before processing the personal data of a child or of an individual otherwise lacking legal capacity, unless the child is sixteen or older and is asking for an electronic service themselves.

Apply appropriate processes to verify the identity and age of a data subject and of a representative giving consent for them.

Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.

Do not process a child's personal information unless a competent person has given prior consent, another listed ground in section 35(1) applies, or the Information Regulator has authorised the processing as being in the public interest with appropriate safeguards.

Obtain a South Dakota consumer's opt-in express consent, separately for collection, third-party transfer, research use, retention beyond the initial test, and marketing use of genetic data or a biological sample, if you operate a direct-to-consumer genetic testing service.

Honor a consumer's revocation of consent and destroy their biological sample within 30 days.

An app that derives a faceprint, voiceprint, or other unique biometric identifier from a Korean data subject, including one derived from a photo, video, or audio recording, must treat it as sensitive information under PIPA Art. 23 and obtain separate, specific consent before processing it.

Do not deploy a biometric employee time-and-attendance system in Spain on the Estatuto de los Trabajadores alone; the AEPD's own guidance holds that statute does not itself authorize biometric means, and a genuine GDPR Article 9(2) basis is needed.

Do not run a facial-recognition matching system against members of the public without a valid Article 9.2 exception.

An app that derives a faceprint, voiceprint, or other biometric identifier used to uniquely identify a person in Sri Lanka must treat it as a special category of personal data and satisfy one of Schedule II's conditions, ordinarily the data subject's consent, before processing it.

Process a child's personal data based on consent only where the child is at least sixteen, or where a legal representative has consented for a younger child after you take reasonable steps to verify that; never process a child's personal data in a way inconsistent with the child's interest.

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data about a person's sexual behaviour or orientation, unless a listed exception applies, such as the data subject's explicit consent.

Obtain express, affirmative consent, opt-in rather than opt-out, before creating a voiceprint or other biometric identifier from a person in Switzerland, or establish another Article 6 basis for the processing.

Obtain the data subject's written and explicit consent before processing their sensitive personal data, unless a legally authorized case applies.

Obtain the consent of a child's legal guardian before processing a child's personal data, and where a child takes part in a game, competition or other activity that calls for personal data, collect no more than participation requires.

Obtain the data subject's prior written consent before processing genetic, biometric or other sensitive personal data, including data related to a child, and where the data subject is a minor or otherwise unable to consent, seek that consent from a parent, guardian or other legal representative.

Obtain a Tennessee consumer's consent before processing sensitive data, including biometric or genetic data processed to uniquely identify the individual.

Obtain a Texas consumer's opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexuality, immigration status, or precise geolocation.

Follow the Children's Online Privacy Protection Act's consent framework, not TDPSA's general consent rule, when processing a known child's sensitive data.

An app that captures or processes a faceprint, iris scan, fingerprint, voiceprint, or other biometric identifier from an individual in Thailand must obtain that individual's explicit consent under Section 26 before processing, unless a statutory exception applies.

Obtain the person's consent before processing data on their private life, political or philosophical convictions, religious faith, party or trade union membership, or ethnical origin.

Do not rely on a legitimate-interest, contract or public-task basis for those categories: the Constitution prohibits processing them without consent and states no alternative.

Do not collect or process data revealing racial or ethnic origin, filiation, political, religious or philosophical opinions, trade union membership, sex life, or health or genetic data, unless a listed exception applies, such as the data subject's written consent or a vital interest that prevents them from consenting.

Process data on criminal offenses, convictions or security measures only as a court, a public authority, a body managing a public service, or a legal auxiliary acting within your legal duties.

Do not process sensitive personal information, including biometric data such as a voiceprint or facial image, unless a section 27 basis is met and, in addition, the data subject has given and not withdrawn consent to that specific purpose or another section 28 ground applies.

Before processing a child's personal information, or that of an individual lacking capacity to consent, obtain the consent of a parent or other appropriate legal guardian and apply appropriate age and consent verification mechanisms, including government approved identification documents.

Section 6(h)'s general principle already binds everyone who handles, stores or processes personal information: do not process sensitive personal information (racial or ethnic origin, political affiliation or trade union membership, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a written law otherwise provides for it.

Once Part III is in force, a public body may process sensitive personal information only with the person's consent, or where a listed exception applies, such as health care treatment by a health care professional, information the person already made public, research under section 43, law enforcement or national security, or determining access to social services.

Do not process personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record.

Do not process data revealing racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express written consent, the data is already manifestly public, or the processing serves a historical, scientific or vital-interest purpose.

An app that captures or processes biometric data, including a voiceprint or faceprint, from a person in Turkey must treat it as special-category data under KVKK Art. 6 and obtain explicit consent or rely on one of Art. 6(3)'s other statutory grounds before processing, even though the Act does not itself define what counts as biometric data.

Do not collect or process a child's personal data unless the child's parent, guardian, or another person with authority to decide for the child has given prior consent, or the collection or processing is necessary to comply with the law or is for research or statistical purposes.

Do not collect or process personal data about an individual's religious or philosophical beliefs, political opinion, sexual life, financial information, or health status or medical records, unless a listed exception applies.

Obtain explicit consent, or establish another UK GDPR Article 9(2) or Data Protection Act 2018 Schedule 1 basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.

Treat biometric data as covered from the moment you collect it once you have determined a purpose of unique identification, not only from the point you actually perform identification or verification, per the ICO's Biometric recognition guidance.

If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.

Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary.

Obtain the consumer's informed, written consent before disclosing personally identifiable information about the consumer's video-viewing history to a third party.

Do not require anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life), and process what you do collect only with the data subject's express written consent.

Collect and process sensitive data absent that consent only where an interest-general law authorizes it, the requesting body has a legal mandate to do so, or the purpose is statistical or scientific and the data is disassociated from its subject.

Obtain a Utah consumer's initial express consent before collecting, using, or disclosing their genetic data through a direct-to-consumer genetic testing product or service, and give them a public privacy notice describing your data practices.

Obtain separate express consent before transferring genetic data outside your vendors, using it beyond the primary testing purpose, or retaining a biological sample after testing.

If you are a third-party contractor that receives personally identifiable student data under a contract with a Utah education entity, use that data strictly to provide the contracted product or service within the negotiated contract terms.

Do not sell student data, use it for targeted advertising, or collect, use, or share it in a way that is inconsistent with your contract with the education entity.

Do not process special categories of personal data, including biometric data such as a voiceprint or facial image, genetic data, or data revealing racial or ethnic origin, political opinions, trade-union membership, religious belief, health or sexual life, unless an exception in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.

Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put appropriate age-verification mechanisms in place, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.

Treat any genetic or biometric data you collect about a Vermont consumer as sensitive data requiring opt-in consent, without needing to show the data was collected to identify that person.

Treat a voiceprint, faceprint, vein pattern, or gait pattern you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Vermont's exclusion for recording-derived data does not reach data generated for that purpose.

If you are a supplier dealing with Virginia consumers, do not obtain, disclose, sell, or disseminate a consumer's personally identifiable reproductive or sexual health information without the consumer's consent, including location information that may indicate an attempt to obtain reproductive or sexual health services or supplies.

Obtain the consumer's consent before obtaining, disclosing, selling, or disseminating reproductive or sexual health information that you derive or extrapolate from non-health data by proxy, inference, or algorithm.

Obtain a Virginia consumer's opt-in consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual.

Obtain a further signed authorization before selling consumer health data.

Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.

Obtain explicit consent, or rely on another applicable ground, before processing sensitive personal data, including biometric or genetic data, a child's data, political opinions, or health information.

Process a child's or a vulnerable person's personal data only with the consent of their parent, legal guardian or a person exercising parental responsibility.

Obtain the data subject's written consent, withdrawable at any time, before processing sensitive data such as race, political opinion, religion, trade union membership, sex life, health or criminal history.

Do not process genetic data, biometric data or health data at all unless the data subject has given written consent.

Obtain the consent of a parent or legal guardian before processing a child's personal information, and do not subject a child's data to automated decision-making that affects the child's rights.

Make reasonable efforts to verify that the consent to process a child's personal information was given or authorised by the parent or legal guardian, taking available technology into account.

An app that collects, uses, or discloses the personal data of an individual in Bahrain must obtain the Data Subject's consent or rely on a listed alternative lawful basis under the Personal Data Protection Law.

An app that collects, uses, or discloses the personal data of an individual in Bangladesh, including a voiceprint, faceprint, or other biometric identifier, must have a lawful basis before processing, ordinarily the data principal's voluntary, specific, and revocable consent or one of the Act's enumerated legitimate-interest grounds, and must not retain the data beyond what its stated purpose requires.

Before processing personal data, establish a lawful basis and confine processing to the stated purpose.

Establish a lawful basis, generally the personal data subject's consent unless another basis in this Law applies, before processing personal data of a person in Belarus, and limit processing to explicit, pre declared, legitimate purposes, under Article 4.

Take consent that is freely given, unambiguous and informed, obtainable in writing, as an electronic document, or in another electronic form, and be ready to prove that it was obtained, under Article 5.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Belgium, and treat 13 as the digital-consent age under Act Article 7 for information-society services offered directly to a child.

Before processing personal data of a person in Belize, establish a lawful basis such as consent, a contract with the data subject, or a legal obligation, and process it fairly, transparently, and only for the specified purpose.

Do not process sensitive personal data, including biometric data such as a voiceprint or faceprint, unless a listed condition applies, such as the data subject's consent or a deliberate act by the data subject making the information public.

Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.

Obtain verifiable consent from a parent or guardian before relying on consent to use a child's personal information in a service targeted at children or known to be used by a child.

An app that collects, uses, or discloses the personal data of an individual in Bhutan, including a voiceprint, faceprint, or other biometric identifier, must obtain the subject's express written permission before collecting it and must not disclose it to a third party without authorization. An ICT or media service provider or vendor must additionally publish a privacy policy, limit collection and use to what is reasonably appropriate, store and use data only for its intended purpose, and remain responsible for data it transfers to a third party.

Obtain a person's prior knowledge and express consent before collecting, processing, blocking, cancelling, transferring, consulting, or interconnecting their personal data.

Do not use, communicate, or transfer personal data to a third party without the data subject's consent or a competent court's written order.

Establish a lawful basis under Article 8 before processing personal data of a person in Bosnia and Herzegovina, and appoint a Data Protection Officer under Articles 39 to 41 wherever the processing meets the threshold the Act sets, such as processing carried out by a public authority or large-scale monitoring or special-category processing.

Obtain a lawful basis before processing personal data of a person in Botswana, or of a person elsewhere if the processing is by a controller or processor established in Botswana.

Be able to demonstrate that a data subject has consented to processing based on consent, and let the data subject withdraw that consent at any time.

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.

Take consent only when it is provided in writing or by another means demonstrating the data subject's free will, in a clause set apart from the other contract terms, and be ready to prove it meets these requirements.

Do not collect, use or disclose personal information about an individual without the individual's consent, unless the Act authorizes it without consent or deems the consent given. Consent obtained by false or misleading information, or by deceptive or misleading practices, is not validly given.

Do not require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide a product or service, as a condition of supplying it.

Brunei's Personal Data Protection Order 2025 has been in effect since 1 January 2026 for Parts 3 to 9, section 42, and Schedules 1 to 5, the commencement date Government Gazette No. S 11/2025 directly confirms. An app that collects, uses, or discloses the personal data of a person in Brunei, including a voiceprint, faceprint, or other biometric identifier, since the Order draws no sensitive-category distinction, must obtain the individual's consent or rely on a Schedule 1, 2, or 3 consent-free basis before processing.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Bulgaria.

Obtain the data subject's prior consent before processing their personal data, unless a specific legal exception applies, such as performing a contract, complying with a legal obligation, protecting a vital interest, or a public interest ground.

Process personal data only where the data subject has unambiguously consented or where processing is necessary for a contract, a legal obligation, the data subject's vital interests, a public interest task, or your or a third party's legitimate interest that does not override the data subject's rights.

Process personal data lawfully, transparently and in good faith, collect it only for determined, explicit and legitimate purposes, keep it adequate, relevant and limited to the minimum necessary, keep it accurate and up to date, and do not keep it identifiable for longer than the purposes require.

A data controller or processor needs one of six legal bases, including the data subject's consent, before processing personal data, and needs a parent or guardian's verified consent before processing the personal data of a data subject under the age of 16.

Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.

Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.

Have a lawful basis for collecting and processing personal data, and hold it only for specified purposes.

Have a lawful basis, such as a contract's performance, a legal obligation, a legitimate interest that does not override the data subject's rights, the data subject's freely given and revocable consent, a vital interest, or a public interest mission, before processing someone's personal data.

Obtain a lawful basis before processing personal data of a person in Chile through a registry or data bank, whether the processor is a public body or a private party, per Ley 19.628 Article 1.

From 1 December 2026, obtain a lawful basis before processing personal data of a person in Chile.

Establish one of PIPL's enumerated lawful bases, most commonly informed consent, before collecting or processing personal information of a person in China.

Obtain the data subject's prior, explicit and informed authorization before collecting or processing their personal data, unless a statutory exception applies.

Keep proof of the data subject's authorization, tell them at authorization the purpose of the processing, keep their personal data updated and accurate, secure it against unauthorized alteration, loss, consultation, use or access, and correct it once it is shown to be incorrect.

Before collecting personal data from the internet to develop, train, test or deploy an artificial intelligence system, obtain the data subject's prior, express and informed authorization; a datum being accessible online does not make it a public datum exempt from that requirement.

Obtain the consumer's affirmative opt-in consent before processing or selling sensitive data, including biometric data used for identification and precise geolocation data, or before resuming processing for targeted advertising or sale after a consumer opts out.

Do not sell a consumer's precise geolocation data, whether as a controller or as a third party.

If you use facial recognition technology on your premises to prevent, detect or respond to security incidents, fraud or similar activity, use it only to match images against a database you maintain, and post signage at each entrance, other than an entrance to an area restricted to authorized employees, that links to your facial recognition technology policy.

Before collecting a person's personal data, inform them of the purpose of collection and obtain their express, written consent, unless the data are publicly accessible or a law or judicial order compels disclosure.

Do not process data revealing racial or ethnic origin, political opinions, religious convictions, health, or sexual orientation without the data subject's consent or another narrow statutory ground.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Croatia, following the Act's institutional and procedural rules.

Obtain the data subject's express, unambiguous, free and informed consent before collecting or processing sensitive data (sex, gender identity, sexual orientation, ethnic origin, health, disability, genetic information, religious belief, political affiliation, or criminal record), absent a statutory exception.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Cyprus, including data collected by crawling.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in the Czech Republic.

Have a lawful basis, such as the person's express consent, before collecting, transmitting, storing or using anyone's personal data, whether the processing is automated or not.

Do not send unsolicited electronic direct-marketing messages using a person's personal data without their consent.

From January 1, 2027, comply with DPDPA if you control or process the personal data of 10,000 or more Delaware consumers, or of 5,000 or more where more than 20% of your gross revenue comes from selling personal data, or if you are a third party that acquires personal data from a controller. From that date, do not treat biometric data that can be associated with a specific consumer and was collected without the consumer's consent as publicly available information, and do not treat personal data processed in connection with profiling and reports under section 12D-106(f) as exempt because it concerns an applicant, employee, agent, or contractor.

Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Denmark, including data collected by crawling.

Obtain a lawful basis, most often the data subject's express, unambiguous, free, specific and informed consent, before processing their personal data.

Obtain the data subject's free, express, and conscious consent before processing or transferring their personal data, unless the law lists an exception.

Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.

Obtain the data subject's explicit consent before processing their personal data unless another lawful ground applies, such as performing a contract, complying with a legal obligation, or acting under a judicial order.

Obtain a person's express, informed, free, specific and individualized consent, or another lawful basis this Law recognizes such as contractual necessity, a legal obligation, vital interests, or a legitimate interest that does not override the data subject's rights, before processing their personal data, unless this Law excuses consent for the specific processing.

Let a data subject revoke their consent at any time without retroactive effect, and act on a revocation within five business days of the request.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Estonia, including data collected by crawling.

Obtain a lawful basis, such as the data subject's explicit consent, contractual necessity, compliance with a legal obligation, or another listed ground, before processing personal information of an identifiable individual, whether by automated or non-automated means.

Have a lawful basis for processing personal data before collecting, storing, or otherwise processing it, whether by automated means or in a filing system.

Take consent only where it is free, informed, specific and clear and requires an active action from the data subject, request it separately from other terms rather than bundled with them, let the data subject withdraw it at any time, and be able to prove it was given.

Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.

Process personal data lawfully, fairly and in a transparent manner in relation to the data subject (Article 5(1), point (a)).

Do not require an employee to take part in genetic testing when hiring or during the employment, and do not seek to learn whether a genetic test has been done on an employee (Act on the Protection of Privacy in Working Life Section 15).

If you operate camera surveillance in premises you use, do it only to ensure the personal safety of employees and others, protect property, monitor the operation of production processes or prevent or investigate situations that endanger them, and do not use it to monitor a particular employee or particular employees (Section 16, paragraph 1).

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Finland, including data collected by crawling.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in France, and follow Loi 78-17 Article 6's cross-reference to GDPR Article 9 for any special-category data.

Have a lawful basis for processing, such as the data subject's consent, a legal obligation, a public-service mission, contract performance, or a legitimate interest that does not override the data subject's own rights and freedoms.

Where you rely on consent, be able to demonstrate it was given and present the request clearly and separately from other terms; never treat acceptance of general terms of use or a pre-checked box as consent, and in an electronic transaction take it through an unambiguous act such as a checkbox.

Establish one of the Act's seven lawful bases before processing personal data, whether you are established in The Gambia or process the data of individuals in the country from outside it.

An app that collects, uses, or discloses the personal data of an individual in Georgia must establish a lawful basis for the processing under Art. 5 of the Law on Personal Data Protection.

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Germany.

Where you process employee data, including biometric data for workplace access or time and attendance, satisfy BDSG Section 26(3)'s stricter conditions rather than relying on employee consent alone.

Have a lawful basis for processing personal data, and register with the Data Protection Commission before processing begins.

Do not require a person to supply or produce a particular record, including a health record, as a condition of providing them goods, facilities, or services, unless the requirement is authorised by law or is in the public interest.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Greece, including data collected by crawling.

Where an employee's consent is used by way of exception as the legal basis for processing the employee's personal data in Greece, take into account the employee's dependence under the contract of employment and the circumstances in which consent was given, and give the consent in writing or electronically, clearly distinguishable from the contract of employment (Law 4624/2019, Article 27(2)).

Establish a lawful basis, ordinarily the data subject's consent, before processing personal data about them, or rely on one of the Act's specific alternative grounds such as contractual necessity, a legal obligation, or a statutory or government function.

Do not disseminate, distribute, or commercialize personal data held in an information system without the data subject's express written consent.

Never commercialize sensitive personal data (racial or ethnic origin, political ideology, religious belief, health, sexual life, or similarly intimate data) by any means.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Hungary; the Infotorveny supplements the GDPR with mainly procedural rules rather than a substantive addition to that basis.

Establish a lawful basis under Act No. 90/2018 Article 8 (mirroring GDPR Article 6) before processing personal data of a person in Iceland, including data collected by crawling.

Under India's Digital Personal Data Protection Act, an app that collects, uses, or discloses the personal data of an individual in India, including a voiceprint, faceprint, or other biometric identifier, which the Act treats as ordinary personal data since it has no separate sensitive-category tier, needs a lawful basis under section 4, ordinarily the data principal's free, specific, informed, and unambiguous consent under section 6, or one of section 7's enumerated legitimate uses.

An app that collects, uses, or discloses the personal data of an individual in Indonesia must establish a lawful basis under Article 20, most commonly consent, though the procedural detail for several related duties is delegated to Government Regulation No. 33 of 2026.

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.

Establish a lawful basis before collecting or otherwise using personal data, including publicly accessible personal data, to train an AI model on people in Ireland, and account for the purpose the person originally made that data public for, not only whether it was public.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Italy, following the Codice Privacy's institutional and procedural rules.

Have at least one condition under section 23 for every processing operation, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest that is not outweighed by the data subject's rights and freedoms.

If you handle the personal information of a person under 16 in Japan, obtain the consent of the person's legal representative, not the person's own consent, wherever Article 18 (use beyond the specified purpose of use), Article 20(2) (acquisition of special care-required personal information), Article 27 (provision of personal data to a third party) or Article 28 (provision to a third party in a foreign country) requires the data subject's consent (Article 40-2(1)).

Before you provide information related to personal information about a person under 16 to a recipient that is expected to acquire it as personal data, confirm that the person's legal representative, not the person, has given the consent Article 31(1) requires (Article 40-2(2)).

An app may provide personal information or personal-related information to a third party that needs it for statistics creation, without the data subject's consent, if both parties publish the statistics-creation details over the internet and a written agreement with the third party states the provision is made under this provision; the recipient may not use it beyond that stated purpose or pass it on to a further third party.

An app that collects, uses, or discloses the personal data of an individual in Jordan must obtain consent or rely on one of the Law's enumerated alternative bases, must confine retention to the processing purpose unless legislation specifies otherwise, and must appoint a data-protection lead if it processes Sensitive Personal Data or transfers personal data to a database outside Jordan.

An app that collects, uses, or discloses the personal data of individuals in Kazakhstan must obtain the subject's consent, or rely on one of the Law's limited consent-free grounds, before processing, and must confine that processing to the stated purpose of collection.

Obtain consent from a child's parent or guardian, verified through an age-verification mechanism, before processing that child's personal data.

Process personal data only on one of the Act's lawful bases, such as consent, contract necessity, legal obligation, or legitimate interests, and only for a purpose that is explicit and not prohibited by law.

Establish a lawful basis under Article 5 before processing personal data of a person in Kosovo, and apply the Article 4 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability throughout.

Use personal data collected from public sources for direct marketing only as Article 73 allows, limited to name, address, telephone number and email address unless the data subject has separately consented, and obtain written consent before using sensitive personal data for marketing.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Latvia, including data collected by crawling.

Obtain a lawful basis, such as the data subject's explicit consent, contractual necessity, compliance with a legal obligation, or another listed ground, before processing personal information of an identifiable individual, whether by automated or non-automated means.

Process personal information only on a lawful basis: the data subject's consent, performance of a contract with the data subject, a legal obligation of the controller, protection of vital interests, response to a national emergency or the functions of a public authority, or the legitimate interests of the controller or a third party that the data subject's fundamental rights do not override.

Do not process sensitive personal information or privileged information unless an exception in section 13 applies, such as the data subject's consent specific to the purpose.

Collect, use, maintain, or disclose a telecommunications customer's information or communications only as permitted or required by law, or with that customer's consent.

Before collecting personal data for issuing, maintaining, or facilitating an authentication certificate, obtain the person's explicit consent, and do not use it for a different purpose without a further explicit consent.

Do not collect, disclose, provide, or process personal data without the data subject's consent unless it is necessary to prevent or detect a crime under an official request from investigative bodies, required or permitted by law or a court decision, needed for a tax assessment or collection, or needed to protect the person's vital urgent interest.

Establish a lawful basis under Article 6 of the GDPR, which applies in Liechtenstein as EEA law, before processing personal data of a person in Liechtenstein, including data collected by crawling.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Lithuania, including data collected by crawling.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Luxembourg, including data collected by crawling.

If you monitor employees through the processing of personal data, do so only in the cases of GDPR Article 6(1)(a) to (f) and in accordance with Labour Code Article L.261-1 (paragraph 1).

Have the data subject's consent, or another of the five lawful grounds in article 17, before processing personal data.

Process data on a subcontractor's behalf only on the controller's instructions, and use only a subcontractor that offers sufficient guarantees to implement the required security measures.

Have a lawful basis before processing personal data: the data subject's unambiguous consent, contractual necessity, compliance with a legal obligation, protecting the data subject's vital interests, a public interest or official task, or your own legitimate interests where they do not override the data subject's rights and freedoms.

An app that collects, uses, or discloses the personal data of an individual in Malaysia must obtain consent, subject to the contract, legal-obligation, or vital-interest exceptions, and processing sensitive personal data needs the data subject's explicit consent under the Act's stricter standard.

A Controller or Processor needs a lawful basis before processing personal data, must collect it only for specific, explicit and legitimate purposes declared before collection, and must not process it further in a way incompatible with those purposes.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Malta, including data collected by crawling.

Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose that fits one of the Act's listed lawful-processing grounds.

Obtain the consent of a child's parent or guardian, verified with reasonable effort, before processing the personal data of a child below 16.

Obtain the data subject's consent, express or tacit, before processing their personal data, unless a listed statutory exception applies, and treat consent for financial or patrimonial data as requiring express consent.

Establish a lawful basis and allocate controller and processor duties before processing personal data of a person in Moldova.

Take consent only on the conditions article 7 sets, and be able to demonstrate the data subject gave it.

Establish one of the lawful bases Article 5 lists, such as consent, contract necessity, a legal obligation, vital interests, an important public interest ground, or legitimate interest, before processing personal data of a person in Monaco.

Take consent only as a free, specific, informed and unambiguous act, present a bundled consent request separately from other terms, and do not make consent a condition of a good or service unless the processing is indispensable to providing it.

Establish a lawful basis, such as the data subject's prior consent or one of the grounds listed in Article 10, before processing personal data of a person in Montenegro.

Have one of the lawful bases Article 7 lists, such as the data subject's consent, performance of a contract or a legal obligation, before processing the personal data of a person in Montenegro, and be able to show that you comply with the principles in Article 6.

Where you rely on consent, be able to prove it, ask for it in clear and plain language that is distinct from other matters, and let the person withdraw it as easily as they gave it, as Article 8 requires.

Obtain the data subject's unambiguous consent before processing their personal data, unless a legal obligation, contract performance, vital interest, public interest mission, or legitimate interest ground applies.

As a licensed communications service provider, do not disclose information concerning a subscriber without the subscriber's written consent, unless the Act or another written law requires or authorises the disclosure.

Take reasonable steps to maintain the confidentiality of a subscriber's communications, and do not intercept, monitor, alter, or modify their content except as permitted or required by law.

An app that collects, uses, or discloses the personal information of an individual in Nepal, including a voiceprint, faceprint, or other biometric identifier, must have the person's consent or fall within a statutory exception before collecting it, and a body corporate must limit use to its stated purpose and obtain consent before using the information for another purpose.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in the Netherlands, following the UAVG's institutional and procedural rules and Chapter 3-4 national derogations.

Do not collect personal information unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.

Before processing personal data, obtain the data subject's consent, unless a listed exception applies.

Assign or transfer personal data domestically only for a purpose directly related to your legitimate interest and that of the recipient, and only with the data subject's prior, informed, and revocable consent, unless a listed exception applies.

Obtain the data subject's express prior consent before processing their personal data, unless the processing is necessary for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's own vital interests or fundamental rights.

Process personal data on one of the lawful bases section 25 recognises, and hold to the section 24 principles of fairness, lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, integrity and availability.

Take consent for cookies and other tracking tools freely, informed and specific, display a conspicuous cookie banner at the first part of the page, and let a data subject reject every cookie other than the necessary ones that carry security, network stability and accessibility.

Obtain the written consent of at least 70% of the owners or tenants of a single-unit or multi-unit residential building before introducing video surveillance there, and never transmit its recordings over cable television, the internet or another electronic means, or record the entrances to other individual apartments.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Norway, including data collected by crawling.

Ground the processing of a Norwegian national identity number (fodselsnummer) or other unique identifier on a legitimate need for secure identification, under Personal Data Act Section 12.

Do not sell precise geolocation data or process a known Oregon minor's (under-16) data for targeted advertising, sale, or profiling; both are prohibited outright as of January 1, 2026.

Have a lawful basis, such as consent, contractual necessity or a legal obligation, before processing a person's personal data, and use it only for the purpose for which it was collected.

Establish a valid legal basis, such as the data subject's consent or a contract, before processing any personal data, and make sure any consent obtained is prior, free, informed and unambiguous.

Obtain the consent of a child or adolescent only on the terms article 7 sets, and rely on legitimate interest only where article 8 allows.

Obtain a person's prior, informed, express, and unequivocal consent before processing their personal data, unless a law authorizes the processing without it, and let them revoke that consent at any time under the same requirements that applied when they gave it.

An app that processes the personal information of an individual in the Philippines must satisfy one of the Act's lawful-processing criteria, with a stricter, separate standard for sensitive personal information, even though the Act's own sensitive-category list does not name biometric data specifically; a faceprint or voiceprint is still personal information subject to the Act's general processing criteria.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Poland; the Act adds no Polish derogation to the Article 6 list.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Portugal, including data collected by crawling.

An app that collects, uses, or discloses the personal data of an individual in Qatar, including a voiceprint, faceprint, or other biometric identifier, must have a lawful, consent-and-purpose-based basis for processing under the PDPPL; Qatar's special-nature-data list does not name biometric data as its own heightened category, but ordinary personal data duties still apply to it.

Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.

Obtain the data subject's consent before processing their personal data, unless a legal obligation, public-interest mission, vital-interest, or another statutory ground applies.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Romania.

Have a lawful basis under this Law, such as the data subject's consent or one of the other seven grounds article 46 lists, before processing personal data.

Where consent is the basis for processing, obtain it only after the data subject is informed of the consequences of consenting, and let the data subject withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Obtain a data subject's consent before processing their personal data other than sensitive personal data, unless a listed exception applies.

Obtain a person's express consent before processing their personal data, unless a specific ground applies such as performing a contract with them, complying with a legal obligation, or a legitimate interest that does not override their privacy rights, and let them object to processing done on public interest or legitimate interest grounds and revoke consent at any time.

Establish a lawful basis before processing personal data of a person in San Marino under Law 171/2018.

Take consent only where you can demonstrate the data subject gave it, and for an information society service offered to a child, only on the terms article 7 sets.

Obtain the data holder's unequivocal authorization before processing their personal data, or rely on one of the Law's specific grounds: performing a contract with them, a legal obligation you face, protecting their vital interests, a public-interest mission, or your own legitimate interest weighed against their rights.

An app that collects, uses, or discloses the personal data of an individual in Saudi Arabia must establish a lawful basis under the Personal Data Protection Law, most commonly the Data Subject's consent, following the consent mechanics set out in the Implementing Regulations.

Have a lawful basis, ordinarily the person's consent, before collecting, processing, transmitting, storing, or using their personal data.

Under the draft, a controller may train an AI system on personal data on a legitimate-interest basis only in exceptional cases where that interest overrides the rights of data subjects.

Under the draft, a controller operating video surveillance may keep footage for no longer than six months, and may not monitor employees' work absent narrow exceptions.

Have one of the lawful grounds Article 12 lists, such as consent, contract necessity, legal obligation, vital interest, public interest, or legitimate interest, before processing personal data of a person in Serbia.

Take consent only where you can demonstrate it was given, present a bundled consent request separately from other matters in plain, simple language, and let the person withdraw consent at any time as easily as they gave it.

Have a lawful basis for processing personal data, such as informed and explicit consent, contractual necessity, a legal requirement, or a legitimate interest.

Allow a data subject to withdraw consent at any time, without this affecting the lawfulness of earlier processing.

An app that collects, uses, or discloses the personal data of an individual in Singapore must obtain the individual's consent, or rely on a Part 3 or Schedule exception, and must state its purpose for the collection, use, or disclosure.

Establish a lawful basis under Section 13(1) of the Act and GDPR Article 6 before processing personal data of a person in Slovakia.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Slovenia.

If operating as a licensed telecommunications service provider in Solomon Islands, do not collect, use, maintain, or disclose a consumer's information without the consumer's consent, other than publishing the consumer's name, address, and listed telephone number in a directory.

Take all reasonable steps to keep a consumer's communications confidential, and do not intercept, monitor, alter, or modify the content of a message without authorisation.

Establish a lawful basis before processing personal data, such as the data subject's consent, the performance of a contract, a legal obligation, or the data subject having intentionally made the data public, and process it fairly and transparently.

Where you rely on consent, be able to prove the data subject gave it.

Obtain a lawful basis, such as the data subject's consent, before processing personal information, and limit processing to the purpose for which it was collected.

An app that collects, uses, or discloses the personal data of individuals in South Korea must establish one of PIPA's lawful processing grounds, most commonly consent or a documented legitimate interest justification, before processing, and must confine use to the stated purpose of collection.

An app training AI models on personal data scraped from publicly accessible Korean web sources must rely on and document PIPA Art. 15(1)(6)'s legitimate interest basis, since publicly available data is not exempt from PIPA.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Spain, and rely on a statute-rank Spanish or EU norm rather than mere regulation if the basis is public interest or legal obligation, per LOPDGDD Article 8.

An app that collects, uses, or discloses the personal data of an individual in Sri Lanka, including a voiceprint or faceprint, must have a lawful basis under Schedule I, ordinarily consent, contract necessity, or a legitimate interest satisfying a balancing test, and must give a data subject a way to seek review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights.

Have a lawful basis, such as a contract, a legal obligation, vital interests, a public interest task, official authority, a legitimate interest that does not override the data subject's rights, or the data subject's consent, before processing personal data.

Where processing rests on consent, present the request separately from other matters, in clear and simple language, and let the data subject withdraw consent as easily as it was given.

Establish a GDPR Article 6 lawful basis before processing personal data of a person in Sweden; Dataskyddslagen adds domestic legal bases mainly for public-sector processing, not a modification of the private-sector Article 6 list.

Have a justification, consent, an overriding private or public interest, or a legal basis, before processing personal data of a person in Switzerland in a way that would otherwise violate their personality rights.

Determine a lawful basis under one of the grounds article 7 lists before processing personal data, such as the data subject's consent to a specific purpose, a contractual or legal obligation, or a court order.

Collect, process, or use the personal data of an individual in Taiwan only for a specific purpose and on one of the Act's stated lawful bases, and confine use to the purpose stated at collection unless a further basis under Article 16 or 20 applies.

An app that collects or processes the personal data of individuals in Tajikistan must obtain the subject's consent, limit processing to a specific, predetermined, lawful purpose, and notify the subject of the data collected about them with a right to correction.

An app that collects, uses, or discloses the personal data of an individual in Thailand must obtain consent by default before processing, unless a Section 24 statutory exception applies.

Rely on Section 38's own two operative rules, the access right and the sensitive-category consent bar, rather than on a statutory definition of personal data, because none exists to scope a Timor-Leste deployment against.

Have a lawful basis for processing personal data, generally the data subject's consent, or rely on a legal obligation, a public interest task, contract performance, or safeguarding the data subject's interest or fundamental rights and freedoms.

Do not process personal information unless the data subject has given specific, informed consent that has not been withdrawn, or another lawful basis in section 27 applies, such as contractual necessity, a legal obligation, vital interests or the public interest.

Whether or not Part III or Part IV binds you yet, be responsible for the personal information under your control, identify the purpose of collection before or at the time of collection, and get the individual's knowledge and consent for its collection, use or disclosure.

Do not make providing a service or granting a benefit conditional on a person accepting that their data be processed or reused for a purpose other than the one it was collected for.

Do not communicate personal data to a third party without the person's express consent given in a form leaving a written trace, unless a listed public security, defense or criminal prosecution exception applies.

An app that collects, uses, or discloses the personal data of an individual in Turkey must establish one of KVKK Art. 5's lawful bases, most commonly explicit consent, before processing, and must confine use to the stated purpose of collection.

Obtain the data subject's prior consent before collecting or processing their personal data, unless a specific ground in section 7(2) applies, such as a legal requirement, a public duty, national security, a contract with the data subject, or a legal obligation.

Establish a lawful basis before processing personal data of a person in Ukraine under Law No. 2297-VI.

An app that is a controller or processor established in or targeting the ADGM free zone must establish a lawful basis for processing personal data, and must obtain explicit consent or another qualifying condition before processing a faceprint, voiceprint, or other biometric identifier, including one derived from a photo, video, or audio recording.

An app that collects, uses, or discloses the personal data of an individual in the onshore UAE must establish a lawful basis under PDPL Art. 4, ordinarily consent, and must obtain the Data Subject's explicit consent before processing a faceprint, voiceprint, or other identity-linked biometric identifier, including one derived from a photo, video, or audio recording, since biometric data is a category of Sensitive Personal Data.

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.

Do not rely on the recognised legitimate interests basis if you are a public authority exercising your own core functions; a necessity test still applies even though no balancing test is required.

Obtain the data subject's free, prior, express, and informed consent, documented in writing, before processing their personal data, unless a listed exception applies (data from public sources, a legal mandate, a state function, or a contractual, scientific, or professional relationship).

Communicate personal data to a third party only for a purpose directly tied to the sender's and recipient's legitimate interest, only with the data subject's prior consent, and only after telling them the purpose of the communication and identifying the recipient.

Do not process personal data unless it is processed fairly and transparently for an explicit, specified and legitimate purpose under one of the lawful purposes in section 5, such as the data subject's consent, contract necessity, a legal obligation, the public interest, or a legitimate interest that does not override the data subject's rights.

Be able to demonstrate evidence of a data subject's consent, present any request for consent clearly and separately from other matters, obtain it for each specific purpose, and let the data subject withdraw it at any time, free of charge.

Obtain a Virginia consumer's opt-in consent before processing sensitive data, and treat information a consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.

Do not sell precise geolocation data collected from Virginia residents. A 2026 amendment added an outright ban on that sale.

Before processing personal data, establish a lawful basis such as consent, a contract, a legal obligation, or a legitimate interest, and process it fairly, transparently, and only for the purpose collected.

Tell a data subject of the right to withdraw consent before they give it, present the request separately from other matters in clear and plain language, be able to prove the consent was given, and destroy immediately every piece of personal data collected after a withdrawal.

Do not exhibit, reproduce, or offer for sale a person's photograph or image without that person's consent, unless the image concerns a fact, event, or ceremony of public interest or one that took place in public, or the person's notoriety, public office, or the requirements of justice, police, or a scientific, cultural, or didactic interest justifies the use.

Do not divulge the contents of a confidential letter, electronic message, or other private communication addressed to another person without the consent of its author.

Do not base a solely automated decision with legal or similarly significant effects on a person in Estonia on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Where the user is not the data subject whose personal data is requested, make personal data generated by the use of a connected product or related service available to the user only where there is a valid legal basis for processing under Article 6 of Regulation (EU) 2016/679 and, where relevant, the conditions of Article 9 of that Regulation and of Article 5(3) of Directive 2002/58/EC are fulfilled (Article 4(12)).

Where the user is not the data subject whose personal data is requested, make personal data generated by the use of a connected product or related service available to the third party only where there is a valid legal basis for processing under Article 6 of Regulation (EU) 2016/679 and, where relevant, the conditions of Article 9 of that Regulation and of Article 5(3) of Directive 2002/58/EC are fulfilled (Article 5(7)).

Once a natural person has exercised the right to opt out, and where personal electronic health data relating to them can be identified in a dataset, do not make those data available or otherwise process them pursuant to data permits issued under Article 68 or health data requests under Article 69 approved after the person exercised the right; this does not affect processing under data permits or health data requests issued or approved before (Article 71(3)).

Do not base such a decision on special category data under Article 9(1) unless the data subject gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Do not base a solely automated decision with legal or similarly significant effects on a person in Finland on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not base a solely automated decision with legal or similarly significant effects on a person in France on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Before accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, tell them the purpose and how to object, and proceed only once they have consented, except where the access is strictly necessary to provide an electronic communication service they expressly requested.

Do not base a solely automated decision with legal or similarly significant effects on a person in Germany on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not provide, use, obtain, or procure a data subject's personal data for direct marketing without their prior written consent, and stop on their written request at any time.

Do not base a solely automated decision with legal or similarly significant effects on a person in Greece on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Use data about the use of the service for any other purpose, such as targeted advertising or market research, only after defining the purpose in advance and obtaining the recipient's consent (Section 13/A, paragraph 4).

Let the recipient prohibit that other processing before and during use of the service, and do not link the data to the recipient's identifying data or pass them to a third party without the recipient's consent (Section 13/A, paragraphs 5 and 6).

Do not base a solely automated decision with legal or similarly significant effects on a person in Hungary on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Check only employment-related data stored on the device the employee uses for the employment, which includes the data needed to verify that a device you provided is used only for the employment unless otherwise agreed (Section 11/A, paragraphs 2 to 4).

Apply the same limit to an employee's own device that the employee uses for the employment by agreement (Section 11/A, paragraph 5).

Do not base a solely automated decision with legal or similarly significant effects on a person in Iceland on the special categories of personal data in the incorporated GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of a proportionate law, and suitable measures to safeguard their rights are in place, under the incorporated GDPR Article 22(4).

Do not base a solely automated decision with legal or similarly significant effects on a person in Ireland on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not base a solely automated decision with legal or similarly significant effects on a person in Italy on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not process personal data for direct marketing unless the data subject consents or is your customer, and do not approach the same data subject for that consent more than once.

Let a data subject withdraw consent previously given, or object to processing that rests on voluntary provision with no lawful basis, as easily as they gave it, tell them the consequences of doing so, and promptly stop the processing that relied solely on it.

Do not base a solely automated decision with legal or similarly significant effects on a person in Latvia on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Mark an online promotional advertisement as a promotional advertisement and name the person it was placed for, send no unsolicited marketing email to a real person's name and address without their consent unless you obtained the address lawfully through a previous engagement with them, and put in every marketing email a reply address through which the recipient can ask to stop receiving them permanently and free of charge.

Do not process personal data where doing so causes harm to, or infringes the rights or freedoms of, the person it was collected from.

Do not use a person's data for a purpose other than the one they agreed to without obtaining their consent.

Do not base a solely automated decision with legal or similarly significant effects on a person in Liechtenstein on the special categories of personal data in the incorporated GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of a proportionate law, and suitable measures to safeguard their rights are in place, under the incorporated GDPR Article 22(4); DSG Article 37(3) lets a decision in an insurance matter under Article 37(1)(a) rest on health data where appropriate and specific measures are in place.

Do not base a solely automated decision with legal or similarly significant effects on a person in Lithuania on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not base a solely automated decision with legal or similarly significant effects on a person in Luxembourg on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Obtain a Maine broadband customer's express, affirmative, opt-in consent before using, disclosing, selling, or permitting access to their customer personal information, and let them revoke that consent at any time.

Do not refuse service, or charge a penalty or offer a discount, based on a customer's consent decision under this statute.

Do not base a solely automated decision with legal or similarly significant effects on a person in Malta on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not base a decision producing a legal or similarly significant effect on a data subject solely on automated processing, including profiling, unless a listed exception (contractual necessity, a safeguarded legal authorisation, or the data subject's explicit consent) applies.

Do not base automated processing intended to evaluate personal aspects of an individual on special categories of personal data.

Do not send direct marketing by automated call, fax, or electronic mail to anyone who has not given prior consent, and, for the narrow email exception the law allows to existing customers, always let the recipient opt out, free of charge, of further messages.

Do not base a solely automated decision with legal or similarly significant effects on a person in the Netherlands on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Include personal data in a file built for advertising, promotions, offers, or direct sale only with the data subject's consent or from a publicly accessible source, give the data subject free access to it, and let them request removal from it at any time.

Do not send electronic advertising to a person who has expressly stated they do not want to receive it, offer every recipient of an electronic advertisement the means to refuse further advertising or revoke consent, and keep a contract proving the personal data you use for marketing were obtained with consent or from a public access source.

Do not use a person's data for direct marketing without their prior consent, and stop processing their data for direct marketing, free of charge, as soon as they object, telling them of that right before you first use or disclose their data for that purpose.

Do not base a solely automated decision with legal or similarly significant effects on a person in Norway on the special categories of personal data in the incorporated GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of a proportionate law, and suitable measures to safeguard their rights are in place, under the incorporated GDPR Article 22(4).

Respond to a consumer rights request without undue delay and within 45 days of receipt, decide an appeal within 45 days, and honor a consent revocation within 15 days.

Do not base a solely automated decision with legal or similarly significant effects on a person in Poland on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not base a solely automated decision with legal or similarly significant effects on a person in Portugal on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Let a minor consent alone to processing of their personal data for an information-society service from age sixteen; below that age, take consent jointly from the minor and the holder or holders of parental authority, and write the information addressed to the minor in clear, simple terms.

Do not base a solely automated decision with legal or similarly significant effects on a person in Romania on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not make a decision that produces legal consequences for a Russian data subject, or otherwise affects their rights and legitimate interests, solely on the basis of automated processing of their personal data, unless they consented in writing or a federal law that protects their rights provides for it.

Do not disclose information concerning a telecommunications customer without the customer's written consent, unless disclosure is required or permitted by the Regulator or by law.

Take all reasonable steps to keep customer communications confidential, and do not intercept, monitor, alter, or modify their content except as the Act permits.

Do not send a person direct-marketing communications using their personal data unless they have first expressed consent to receive them.

Do not base a solely automated decision with legal or similarly significant effects on a person in Slovakia on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not base a solely automated decision with legal or similarly significant effects on a person in Slovenia on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Let a data subject withdraw consent as easily as they gave it, and tell them what withdrawing means.

Do not process personal information for direct marketing by electronic communication unless the data subject has consented, or is an existing customer given a free and simple chance to opt out at collection and on every marketing contact afterward.

Do not base a solely automated decision with legal or similarly significant effects on a person in Spain on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and never base such a decision on special categories of personal data unless a narrow exception applies with appropriate safeguards.

Rectify or erase a data subject's personal data on request where it has been processed in violation of this law, and let them withdraw consent at any time as easily as they gave it.

Do not base a solely automated decision with legal or similarly significant effects on a person in Sweden on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).

Do not process, disclose or divulge personal data without the data subject's explicit consent, unless a legally authorized case applies.

Obtain a data subject's consent, identify yourself as sender, give a correct return address, and label the message as direct marketing before sending any electronic marketing contact, and give the data subject a clear and easy way to refuse it or withdraw consent.

Do not send unsolicited direct marketing to a person using their personal data without their prior consent to receive it.

Obtain the person's express, written consent before processing their personal data, and let them withdraw that consent at any time.

Do not rely on a consent given for one form or purpose of processing to cover a different form or purpose, and do not process personal data for advertising without the person's separate, express consent.

Do not take a significant decision based solely on automated processing where your processing for it relies in any part on the recognised legitimate interests basis in UK GDPR Article 6(1)(ea), and base one on special category data only with the person's explicit consent, or where it is necessary for a contract or required or authorised by law and the Article 9(2)(g) substantial public interest condition applies, under UK GDPR Article 22B.

Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.

Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.

Do not listen to, tap, store, interfere with or otherwise monitor communications or the related traffic data unless you are one of the users communicating with each other, the users concerned have consented, or paragraph 3 allows it. A recording of conversations and traffic data that the law permits in the course of lawful business practice, to provide evidence of a commercial transaction or other business communication, is left outside that prohibition (Article 99, paragraphs 2 to 4).

Do not allow eavesdropping, storage of messages or other interception or monitoring of messages and related data by anyone other than the users without the consent of the users concerned, unless a law provides otherwise; technical storage of data necessary for the transmission of messages is not prevented.

If you are an employer, do not intrude on an employee's privacy by open or secret monitoring, by interception and recording of the employee's telephone calls, or by checking the employee's electronic mail, unless a serious reason lying in the special nature of your activity justifies it.

If you run an internal reporting system, make an audio recording of an oral report only with the whistleblower's consent; otherwise capture the report in a record that faithfully captures its substance.

Do not trespass on property intending to subject anyone to eavesdropping or other surveillance in a private place.

Do not install, in a private place, a device for observing, photographing, recording, amplifying or broadcasting sounds or events there, without the consent of the person or persons entitled to privacy there.

Do not intercept, or endeavor or procure another to intercept, a wire, oral or electronic communication unless you are a party to it or one of the parties has given prior consent, and never for the purpose of a criminal or tortious act; one party's consent is enough under this chapter.

Do not intentionally disclose or use the contents of a wire, oral or electronic communication that you know, or have reason to know, were obtained by an interception made in violation of this chapter.

If you run an internal whistleblower scheme, document each oral report either by recording the conversation or meeting after the whistleblower consents, or by accurate minutes that the whistleblower can check, correct and accept by signing (section 24, paragraph 1).

Under the national law that transposes Article 5(1), do not listen to, tap, store, or otherwise intercept or monitor, as a person other than its users, the content or related traffic data of a communication carried over a public electronic communications network without the consent of the users concerned, unless legislation adopted under Article 15(1) authorises it as a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.

Limit the processing to what is strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organizations acting in the public interest against child sexual abuse, and of detecting solicitation of children and reporting it, keep it proportionate and limited to the technologies you use for those purposes, and limit it to the content data and related traffic data that are strictly necessary (Article 3(1), point (a)).

It reaches you if you are a legal entity in the private sector with 50 or more workers, a legal entity in the private sector within the scope of the Union acts referred to in Parts I.B and II of the Annex whatever its number of workers, a legal entity in the public sector that your Member State has not exempted, or a competent authority designated to receive reports (Article 8(3), (4) and (9), Article 11(1)): where an oral report is made through a recorded telephone line or another recorded voice messaging system, you may document it, subject to the consent of the reporting person, by making a recording of the conversation in a durable and retrievable form or through a complete and accurate transcript prepared by the staff members responsible for handling the report (Article 18(2)).

Where a person requests a meeting with your staff members for reporting purposes, ensure, subject to the consent of the reporting person, that complete and accurate records of the meeting are kept in a durable and retrievable form, either by recording the conversation in a durable and retrievable form or through accurate minutes of the meeting prepared by the staff members responsible for handling the report (Article 18(4)).

Record an oral report only with the reporter's consent (section 37).

Do not, without right, use a technical device to listen to or record a conversation, speech or other sound arising from private life that is not meant for your knowledge and occurs in a place protected by domestic peace, or secretly listen to or record speech not meant for you or any other outsider in circumstances where the speaker has no reason to assume an outsider hears it (Chapter 24, section 5).

Do not, without right, open a letter or other closed message addressed to another, break a protection to obtain information from an electronically stored message protected from outsiders, or obtain information on the content of a call, telegram, text, image or data transmission being transmitted in a telecommunications network or information system, or on its sending or receipt (Chapter 38, section 3).

Get the prior consent of every party to a wire, oral, or electronic communication before intercepting, recording, or disclosing its contents; consent from only one party, including yourself as a party to the call, is not enough under Florida law.

Do not record the non-public spoken word of another person on a sound-recording device without that person's authorization, and do not use or share a recording made without it.

This reaches a party to the conversation: do not record the other side of your own call or meeting without authorization, even though the words were addressed to you.

Do not obtain knowledge of the content or circumstances of telecommunication beyond what providing the service, operating the network or installation and protecting its technical systems requires, and use what you learn only for that purpose (TDDDG § 3(3)).

Pass on knowledge covered by the secrecy of telecommunications only where the TDDDG or another statute that expressly refers to telecommunications processes provides for it (TDDDG § 3(3)).

Do not listen in on, intercept, store or otherwise monitor or survey electronic communications and the related traffic and location data, unless a law provides otherwise.

Record a conversation, and the related traffic data, in the course of lawful professional practice to provide evidence of a commercial transaction or other professional communication only if both parties have been informed beforehand of the purpose of the recording and have consented.

Do not surreptitiously record or transmit a private conversation, including one you take part in, without the consent of every other party.

Do not surreptitiously intercept, record or transcribe a private electronic communication to which you are not a party without the consent of every party.

Do not listen to, tap, store, or otherwise intercept or monitor the content or related traffic data of a communication without the consent of the users concerned, unless a legally authorised exception for national security, defence, public security, or the investigation and prosecution of crime applies.

Do not listen to, or record by any means, a telecommunications message in the course of its transmission unless either the person on whose behalf the message is sent or the person intended to receive it has consented to the listening or recording.

Do not disclose the existence, substance or content of a message you know was intercepted without that consent, or use any information obtained from it.

Do not, by means of visual or sound recording instruments, unduly procure news or images concerning private life taking place in the places indicated in Article 614.

Do not reveal or disseminate, through any means of public information, the news or images obtained in that way.

Do not fraudulently take cognizance of a telephone or telegraph communication or conversation between other persons, or in any case not directed to you, and do not interrupt or prevent it.

Do not reveal, through any means of public information, all or part of the content of such communications or conversations.

Do not, outside the cases the law permits and in order to take cognizance of a telephone or telegraph communication or conversation between other persons, or in any case not directed to you, or to prevent or interrupt it, procure, hold, produce, reproduce, distribute, import, communicate, deliver, make available to others or install apparatus, instruments or parts of them suitable to intercept, prevent or interrupt such communications or conversations.

If you are an electronic communications merchant, do not disclose information about an end user, or about the electronic communications or value-added services the end user has received, without the end user's consent, except where the institutions and authorities the Law names need it for their legal functions and the Law's purposes (article 94, paragraph 1).

If you are an electronic communications merchant, do not disclose without the end user's consent the information that is transmitted or has been transmitted in providing electronic communications services to the end user, except where the authorities the Law names need it for their legal functions and the Law's purposes (article 94, paragraph 2).

Do not listen to, record, store or otherwise intercept the content of messages or traffic data carried over public electronic communications services, or become acquainted with them, without the consent of the actual users of the services, except where the law lawfully allows it under Articles 77, 78 and 96 of the Electronic Communications Law.

Do not disclose the content of messages carried over electronic communications networks, or the related traffic data, and do not make it possible to learn them, without the users' consent, except in cases set by law.

Do not listen to, intercept or store communications and the related traffic data, or subject them to any other means of interception or surveillance, unless you are the user concerned or the user concerned has consented; technical storage necessary for the routing of a communication is not prevented.

Do not listen to, tap, store or undertake any other form of interception or surveillance of communications or the related traffic data unless you are the user or the user concerned has consented. A legally authorised recording of communications and the related traffic data in the course of lawful business practice, for the purpose of providing evidence of a commercial transaction or of any other business communication, is not affected (regulation 4).

Do not intercept a wire, oral, or electronic communication, including one you take part in, unless every party has given prior consent or another exception in the subtitle applies; your own consent as a participant is not enough.

Do not disclose or use the contents of a communication you know or have reason to know was intercepted in violation of the subtitle.

Obtain the prior authorization of every party to a wire or oral communication before secretly hearing, recording, or transmitting its contents, or aiding another to do so, with any device; a recording made openly, with the parties aware it is happening, is not restricted by this duty, because the statute's own definition of an interception requires secrecy.

Do not disclose or use the contents of a wire or oral communication, or aid another to do so, knowing it was obtained through an unlawful interception.

Get the consent of every party to a private conversation before using a device to overhear, record, amplify or transmit any part of it; the chapter defines eavesdropping by the private discourse of others and does not say whether a party recording their own conversation is covered.

Do not use or divulge information you know or reasonably should know was obtained by eavesdropping in violation of the chapter.

Obtain the reporter's prior consent before you record such a conversation.

Do not use a technical device to eavesdrop intentionally on a conversation held in a home, closed premises or yard other than on the instruction of a participant in it, and do not record such a conversation unless you take part in it or record on a participant's instruction (Article 139a(1)).

Do not secretly eavesdrop on or record, with a technical device, a conversation held elsewhere than in a home, closed premises or yard, when you act with the intention of eavesdropping or recording, other than on a participant's instruction or without being a participant (Article 139b(1)).

Do not intercept a telephone call or other wire communication, which includes writing, signals and pictures sent by wire or cable, on one party's consent alone; the section permits it only with one party's prior consent together with an emergency that makes a court order impractical, followed by an application for a judge's ratification within 72 hours.

Do not surreptitiously listen to, monitor or record a private conversation of other persons with a listening device unless one of the persons engaged in it authorizes you.

Do not intercept, disclose or use the contents of a telecommunication or oral communication without the consent of every party to it.

Being a party to the conversation, or holding only one other party's prior consent, does not excuse you: knowingly intercepting a telecommunication or oral communication that way is itself an offense, and the chapter has no exception for a business recording its own sales or customer-service calls.

Do not intercept, disclose, or use the contents of a wire, oral, or electronic communication unless you are a party to it or one of the parties has given prior consent, and, if you are not acting under color of law, do not rely on that consent where the interception is for the purpose of committing a criminal act.

Do not disclose or use the contents of a wire, oral, or electronic communication, or evidence derived from it, knowing or having reason to know it was obtained through an unlawful interception.

Do not obtain, or attempt to obtain, the whole or any part of a telecommunication or radio communication to which you are not a participant, unless at least one participant has consented.

Do not obtain a conversation, telecommunication or radio communication from another person while knowing or having good reason to believe it was first obtained in a way the section prohibits, and do not use or divulge one obtained by prohibited means, unless you took no part in first obtaining it and it concerns a matter of public concern.

Do not intercept, disclose or use the contents of a wire, electronic or oral communication unless every party has given prior consent or another exception in section 5704 applies; outside law enforcement, being a party to the communication is not an exception.

If your website loads a third-party script that routes a visitor's communications to the vendor's servers, get the visitor's prior consent; it is no defense that the visitor communicated directly with those servers, and consent may be implied only where the visitor knew or should have known of the interception.

Do not process the content of an electronic message, transmission data, location data or data on connection attempts that fall within the secrecy of electronic communications if you are neither the sender nor the recipient of the message.

If you have read an electronic message not meant for you by using radio or terminal equipment, keep its contents secret.

Do not eavesdrop, install listening devices, store, or otherwise intercept or monitor communications and the related traffic data as a third party without the prior and express consent of the users, except in the cases provided for by law.

Record communications and the related traffic data in lawful commercial practice, to prove a commercial transaction or any other communication made within a contractual relationship, only if the data subject has been informed and has given consent.

If you are an obliged entity with internal reporting channels, register a report made orally through a recorded telephone line or another recorded voice message system, or at an in-person meeting, with the whistleblower's consent, by a recording in a durable and retrievable medium or by a complete and accurate transcription or faithful minutes.

If you must have an internal reporting channel and it is a telephone line or other voice messaging system, document each report either by recording the conversation in a durable and accessible form with the whistleblower's consent, or by a complete and exact transcript of the conversation (article 7, paragraph 3).

Where the whistleblower asks for the report to take place in your presence, draw up minutes in a durable and accessible form with the whistleblower's consent, and give the whistleblower the chance to check, correct and agree to them by signing (article 7, paragraph 5).

Do not listen to, record, store or otherwise intercept or monitor communications transmitted through public electronic communications networks or publicly available electronic communications services, or the related traffic data, unless the users who take part in the communication carry out the operation, those users gave their prior written consent, or the competent authorities carry it out under the law (article 4, paragraph 2).

Make recordings of such communications in the course of lawful professional practices only as the law authorizes, and only to provide proof of a commercial act or of a communication made for commercial purposes (article 4, paragraph 4).

Do not, without justification, use special devices to listen to a conversation or statement not meant for you or to record its sound, and do not relay it to a third person, play such a recording to them or otherwise let them become directly acquainted with it (article 137, paragraph 1).

Do not record the sound of a confidential statement of another person that is addressed to you without that person's consent in order to misuse it, and do not relay such a statement or play such a recording to a third person (article 137, paragraph 2).

Do not monitor or intercept communications as a third person who is not a user taking part in the communication, whether by listening, intercepting, recording, storing or passing them on, without the consent of the users concerned, unless this Act allows it or it is strictly needed to carry the message (article 214, paragraph 5).

Do not record or store communications without the prior consent of the participants where such processing is not usual and the participants cannot expect it because of the nature of the communication (article 214, paragraph 6).

Record an oral report as audio only with the whistleblower's consent, and document a report made by telephone by recording the call only after prior notice and with the whistleblower's consent (article 7, paragraph 2).

Do not, to discover another person's secrets or violate their privacy and without their consent, intercept their telecommunications or use technical devices for listening, transmission, recording or reproduction of sound or image, or of any other communication signal (Article 197(1)).

Do not, for the same purpose and without their consent, seize another person's papers, letters, e-mail messages or any other documents or personal effects (Article 197(1)).

Do not unlawfully gain access to a message that a postal or telecommunications company conveys as a postal item or in an electronic communications network (Chapter 4, section 8).

Do not unlawfully and secretly listen to or record, by a technical device for reproducing sound, speech in solitude, a conversation between others, or negotiations at a meeting or other gathering to which the public has no access, if you do not take part in it or have gained access to it without authority (Chapter 4, section 9 a).

If you are obliged to have internal or external reporting channels and you receive oral reports, document each oral report by a recording that can be saved in a durable and accessible form or by minutes, and record it only if the reporting person consents (Chapter 8, sections 1 and 2).

Do not take part of, or otherwise process, the data in an electronic message transferred in a public electronic communications network or with a publicly available electronic communications service, or the traffic data belonging to the message, unless one of the users has consented to the processing or an exception in Chapter 9, section 27 or in Chapter 9, sections 1 to 3, 6 a and 31 applies; the consent of any one of the users is enough (Chapter 9, section 27).

Do not intercept, or procure another to intercept, a wire, oral or electronic communication unless you are a party to it or one of its parties has given prior consent, and never for the purpose of committing an unlawful act; one party's consent is enough.

Do not disclose the contents of a communication you know or have reason to know were obtained by unlawful interception, and do not use contents you know, or are reckless about whether, were obtained that way.

Do not intentionally intercept, or procure another person to intercept, a communication in the course of its transmission by a telecommunication system or a public postal service in the United Kingdom unless you have lawful authority to do so.

Before you make the content of a call or message available to anyone who is neither its sender nor its intended recipient, a recording, transcription or monitoring vendor included, get the consent of both the sender and the intended recipient or rely on the business-monitoring authority below; recording a call you are a party to, for your own use, is not interception.

Get the consent of at least one party to a wire, oral, or electronic communication before intercepting, recording, transcribing, or disclosing its contents; consent from a person who is themselves a party to the call is enough under federal law even without the other party's knowledge, unless the interception is for the purpose of committing a crime or a tort.

Do not intentionally intercept a wire, electronic or oral communication, or have someone else intercept one, unless you are a party to it or one of its parties has given prior consent; one party's consent is enough.

Do not intentionally disclose or use the contents of a wire, electronic or oral communication you know, or have reason to know, was obtained through interception.

Obtain the consent of every participant to a private telephone, radio, or other transmitted communication, and every person engaged in a private conversation, before recording or intercepting it by any device; consent is established when one party announces to all the others, in a reasonably effective manner, that the recording or transmission is about to happen, provided the announcement is itself recorded.

Do not read or answer a private message sent to someone else, on the device it was sent to, before that person has seen it, without the consent this chapter requires; the Washington Supreme Court has held that doing so is an interception even though the message has already arrived.

Do not offer marketing advertising or a similar offer of goods or services through electronic communications networks or services to subscribers or users who have not stated, in the public directory, that they wish to be contacted for marketing.

Obtain the subscriber's or user's prior consent before you use a subscriber directory, or an electronic communications network or service, for direct marketing by an automated calling system without human involvement, by fax machine or by electronic mail.

Do not, with intent to harass, annoy or alarm another person, communicate with that person by telephone, telegraph, mail or any other written or electronic means, including an intrastate sales call, in a manner you know is likely to cause annoyance or alarm.

Do not knowingly permit a telephone under your control to be used for a purpose this section prohibits.

Do not market a mobile network telephone subscription to a consumer by telephone unless the consumer has expressly asked for it. A telecommunications company may market to its own mobile telephone customers (section 201).

Obtain the called party's prior express written consent, naming the seller and the number to be called, before placing an unsolicited telephonic sales call, text message, or voicemail transmission that uses an automated system for the selection and dialing of telephone numbers or a recorded message played on connection.

Do not phone a consumer to canvass, yourself or through a third party acting for you, unless the consumer has first consented to commercial canvassing by telephone.

Collect consent as a free, specific, informed, unambiguous and revocable expression of will given by a clear positive act, and be able to prove that you obtained it on those terms.

Document a consumer's prior express consent to telephone advertising in an appropriate form at the time the consent is given.

Obtain a consumer's prior express consent before advertising to them by telephone call.

Before advertising by telephone call to another business or professional market participant (not a consumer), obtain at least that participant's presumed consent, judged by whether the call fits their known or reasonably inferable interests.

Obtain the subscriber's explicit consent beforehand before you use an automated calling system for direct commercial promotion of products or services or for advertising of any kind.

Do not play a prerecorded sales message placed by an autodialer without the called party's consent.

Disconnect within 30 seconds after the call ends; if that is not technically feasible, have a live operator state their name, the name, address, and telephone number of the business or organization represented, and the purpose of the call, and ask at the outset whether the called person consents to hear the prerecorded message.

As a live operator, immediately state your name, the name of the business or organization you represent, and the purpose of the call, ask at the outset whether the called person consents to the solicitation, and do not continue without that consent.

Get the called subscriber's or user's prior consent, or check it is recorded as consenting in the National Directory Database, before making an automated-calling or telephone call for direct marketing to a mobile telephone number.

Obtain the prior consent of the subscriber or user before you use an automated calling system without human intervention for direct marketing, where the subscriber is a natural person.

Obtain the prior consent of the subscriber or user before you send unsolicited communications for direct marketing by any other means than automated calling systems, fax machines or electronic mail, where the subscriber is a natural person.

Do not use an automated dialing, push-button, or tone-activated system with a prerecorded message to solicit a purchase, lease, or rental, offer a gift or prize, conduct a poll, or request survey information used to solicit purchases, unless you have a preexisting business relationship with, or the consent of, the person called.

Before making, or causing to be made, a telephone solicitation that uses an automated system for the selection or dialing of telephone numbers, or that plays a recorded message when the call connects, get the called party's prior express written consent: a signed written agreement (an electronic signature can qualify) naming the number to be called, with a clear and conspicuous disclosure that signing authorizes those automated or recorded solicitations and that the called party need not sign it, or agree to it as a condition of any purchase.

Do not make a telephone solicitation, including one made through automated dialing or a recorded message, between 8 p.m. and 8 a.m. in the called party's time zone, more than three times to the same person in a 24-hour period on the same subject matter regardless of the numbers used, or while intentionally altering your voice to disguise your identity in order to defraud, confuse, or injure the called party or obtain their personal information.

Do not place an unsolicited telephonic sales call to a consumer whose name and telephone number appear on the office's current no sales solicitation calls listing, call between 8 p.m. and 8 a.m. local time at the consumer's location, send the solicitation by fax, or use a recorded message device.

Do not make a telephone solicitation that consists in whole or in part of a recorded message.

Do not use a telephone line to contact a subscriber at a residential, business or toll-free number to deliver a recorded message presenting commercial advertising unless the subscriber has knowingly and voluntarily requested, consented to, permitted or authorized the contact, or has knowingly and voluntarily given you the subscriber's telephone number; do not transfer, assign or sell that authorization without the subscriber's written permission.

Do not use an automated telephone system, device, or facsimile machine to dial a telephone number and play a recorded message to offer or sell goods or services, convey information soliciting a purchase, solicit information, gather data, or promote a political campaign.

Do not use a telephone facsimile machine, computer, or other device to send an unsolicited advertisement, material advertising the commercial availability or quality of property, goods, or a service, to a telephone facsimile machine without the recipient's prior express invitation or permission; this does not reach public safety information sent by a law enforcement or public safety entity.

Obtain the natural person's prior consent before using any means other than an automatic calling or communication system without human intervention, a fax or an electronic message to send unsolicited communication for commercial, idealistic or charitable purposes, and be able to show that consent.

Do not solicit a person by telephone at their residence between 8 p.m. and 9 a.m.

Do not use such a device to place a call received in Nevada between 8 p.m. and 9 a.m., or a call-back or second call to a number whose occupant ended the original call.

Obtain the called party's prior express written consent before making, or knowingly allowing, a commercial telephonic sales call, text message or voicemail that uses an automated system for the selection or dialing of telephone numbers or plays a recorded message when the call connects; the consent must be a signed written agreement (an electronic signature counts where federal law or state contract law recognizes it) that names the telephone number to be called and discloses clearly and conspicuously that the called party need not sign it to buy anything.

Use such a device to call a subscriber only between 8 a.m. and 8 p.m., and no more than three times in 24 hours, unless one of the government-list exceptions applies or you are responding directly to the subscriber's own message; you may rely on a mobile number's area code to decide whether the subscriber is in Oregon.

Do not initiate a telephone solicitation outside the hours of 8 a.m. to 8 p.m., or more than three separate times to a party within a 24-hour period, unless you have an established business relationship with the party (a transaction with the party within the preceding 18 months).

Do not initiate a robocall to a residential, business or wireless line without the called party's prior express written consent: a signed agreement (an electronic signature can qualify) naming the number, clearly and conspicuously disclosing consent to solicitations including a robocall or text message, and stating that consent is not a condition of purchase; do not use an unfair or deceptive practice to obtain it.

Use automated calling and communication systems that make calls to a subscriber's telephone number without human intervention (such as automatic dialers, SMS and MMS) for direct marketing only with the subscriber's or user's prior consent (article 226, paragraph 1).

Use other electronic communications means for direct marketing, including voice calls, only with the subscriber's or user's consent, and make refusing consent free of charge for them (article 226, paragraph 3).

End users of publicly available number-based interpersonal communications services have the right not to receive automated calls without human intervention, or fax messages, for commercial communication without having given their prior consent: do not place such calls or send such faxes without it (Article 66(1)(a)).

End users also have the right not to receive unwanted calls for commercial communication: do not place such a call unless the user gave prior consent to receive it or the communication can rest on another legal basis listed in Article 6(1) of Regulation (EU) 2016/679 (Article 66(1)(b)).

Obtain or renew the consumer's consent to the call expressly at least every two years: where consent was not obtained or renewed expressly in the two years before the communication, the text deems there is no consent to the call that leads to the contract (Article 62(1)).

Do not use an automatic calling system or similar automatic system for individual communication that no individual operates to market to a natural person unless the person has consented in advance (section 19, first paragraph).

Do not use the device for random or sequential number dialing when it plays a recorded message on connection, for a solicitation call terminating in Texas before noon or after 9 p.m. on a Sunday or before 9 a.m. or after 9 p.m. on a weekday or Saturday, or for a collection call at an hour the federal Fair Debt Collection Practices Act prohibits.

Make the device disconnect within five seconds after either party ends the call, or, if it cannot, have a live operator introduce the call and receive the called person's oral consent before the message begins.

Do not make, or use an automatic dial announcing device to make, a telephone call for the purpose of making a sale to a number you know or should know is a mobile telephone the called person will be charged for that specific call, unless that person has consented to receiving it from you or from the business you are calling for.

Do not make or cause a facsimile transmission for the purpose of a solicitation or sale to a device the recipient will be charged for, unless the recipient consented before the transmission, and do not make or cause a solicitation facsimile transmission between 11 p.m. and 7 a.m.

Get the called subscriber's prior consent before transmitting, or instigating the transmission of, recorded matter for direct marketing purposes by an automated calling or communication system (one that can automatically dial a sequence of numbers and play sounds that are not live speech), and either do not prevent presentation of your calling line's identity or present a line on which you can be contacted.

Get the called individual's prior consent before making an unsolicited call marketing claims management services; there is no do-not-call-register or existing-customer exception for this subject.

Do not deliver a prerecorded telemarketing message to induce a purchase or a charitable contribution without the recipient's prior signed written agreement to receive prerecorded calls from that seller, obtained separately from any purchase requirement.

Obtain the called party's prior express consent before initiating any call or text to a wireless number using an automatic telephone dialing system or an artificial or prerecorded voice, and before delivering a prerecorded-voice message to a residential line, unless the call is for an emergency purpose.

Before an automatic dialing-announcing device (equipment that selects and dials numbers and plays a prerecorded or synthesized voice message) delivers a commercial telephone solicitation to a subscriber in Virginia, either have the subscriber's knowing or voluntary request, consent, permission or authorization to receive it, or have a live operator disclose the sending entity's name, the message's purpose, the kinds of goods or services promoted and, if applicable, that the message seeks payment or a commitment of funds, and obtain the subscriber's consent before the message is delivered.

Do not initiate, or cause to be initiated, a telephone or text-message solicitation to a Virginia number or resident outside 8:00 a.m. to 9:00 p.m. local time at the contacted person's location, unless that person has given prior consent.

Do not use an automatic dialing and announcing device, a system that automatically dials numbers and plays a recorded or artificial voice message once a connection is made (including one that goes to voicemail), for commercial solicitation to a Washington telephone customer; commercial solicitation means the unsolicited initiation of a call to encourage a purchase of property, goods or services or to wrongfully obtain anything of value, and the section states no consent-based exception.

Do not substantially assist another person in transmitting a commercial solicitation described above while knowing or consciously avoiding knowledge that the initiator is violating this section, unless you are a telecommunications provider that both complied with federal telemarketing rules and implemented a reasonably effective plan to mitigate such calls.

Do not initiate an unsolicited fax that promotes goods or services for purchase to a recipient with whom you have no prior contractual or business relationship.

Do not send an unsolicited fax to a recipient you knew or reasonably should have known is a government entity, even one with which you have a prior contractual or business relationship.

Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).

Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.

Do not place on the market, put into service, or use an AI system that generates or manipulates realistic images, video, audio, or similar material depicting an identifiable person's intimate parts, or an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent to that generation or manipulation.

Do not place on the market, put into service or use an AI system for the evaluation or classification of natural persons or groups over a certain period of time based on social behavior or personal or personality characteristics where the social score leads to detrimental or unfavorable treatment in unrelated social contexts or treatment that is unjustified or disproportionate. The Guidelines read Article 5(1)(c) as met only where three conditions hold together (Section 4.2, paragraphs 149 and 150). Scoring of legal entities falls outside it in principle, and lawful evaluation practices carried out for a specific purpose in accordance with Union and national law are not prohibited per se (Section 4.3, paragraphs 173 and 175).

Do not use an AI system for risk assessments of natural persons to assess or predict the risk of committing a criminal offence based solely on profiling or on an assessment of personality traits and characteristics. The Guidelines read Article 5(1)(d) as met only where three conditions hold together (Section 5.2, paragraphs 187 and 188). Location-based or place-based crime prediction, which in principle assesses no specific individual, and AI systems that support a human assessment already based on objective and verifiable facts directly linked to a criminal activity fall outside it (Sections 5.3.1 and 5.3.2, paragraphs 212 and 214).

Do not create, or knowingly bring to the knowledge of the public or a third party, an algorithmically generated visual or audio content representing a real person's image or voice without their consent, unless it is obvious that the content is algorithmically generated or you expressly say so.

Do not create or share, by any means, a non-consensual sexual montage, or a non-consensual, algorithmically generated sexual image, video, or audio reproducing a real person's likeness or voice.

Do not circulate a realistic deepfake depicting an identifiable person in a sexual situation without their express consent.

Do not knowingly disclose explicit synthetic media (an image or video created or altered using technical means such as artificial intelligence to realistically misrepresent an identifiable person as engaging in conduct they did not engage in) of a real, identifiable person without their consent where disclosure would cause substantial emotional distress, or with intent to annoy, terrify, threaten, intimidate, harass, offend, humiliate, or degrade that person, or to extort money or other valuable consideration by threatening disclosure.

Do not intentionally disseminate or threaten to disseminate a private sexual image, including one that is digitally altered, of an identifiable person without their consent.

Do not knowingly distribute, transmit, or make available to the public a sound recording or audiovisual work that you know contains an unauthorized digital replica of a real person's voice, image, or likeness.

Do not distribute an intimate image, including one created or altered by a computer program, artificial intelligence, or other digital editing tool, of an identifiable person who does not consent, when you know or reasonably should know the person does not consent

Do not disseminate, publish, distribute or post a visual depiction showing another person nude or engaged in a sex act without that person's consent, including a synthetic or deepfake image created, adapted or modified from their face, likeness or other distinguishing features.

Do not publish, distribute or otherwise make available to the public an individual's name, photograph, voice or likeness in any medium for advertising, fundraising or political purposes, or to influence an election or referendum, without the individual's prior consent (or that of a parent or guardian for a minor, or of the executor or heirs of a deceased individual), where you intend to cause harm or are reckless as to whether harm is caused (Section 2(1)(a)).

Do not distribute, transmit or otherwise make available an algorithm, software, tool, service or device whose primary purpose or function is producing an individual's photograph, voice or likeness, without that consent and with that intent or recklessness (Section 2(1)(b)).

If you are a police force, label, filter or categorise lawfully acquired biometric datasets only on the four conditions in article 7, comma 1, including that the result is not the sole basis of a decision producing legal effects on natural persons.

If you are a police force, use real-time remote biometric identification in public or publicly accessible places only for the purposes in article 8, comma 1, and only to confirm the identity of, or to search in a targeted way for, specifically named persons (art. 8, commi 1 and 2).

Do not intentionally or knowingly disseminate, display, or publish an image of an identifiable person in a state of nudity or engaged in a sexual act or sexual contact without that person's consent, with intent to harass, torment, or threaten; this reaches an image that has been AI-created or AI-modified to appear to show the person in that state, not only an authentic photograph.

Do not create, distribute, share, or publish images, videos, or audio depicting a person's intimate sexual content without their consent, approval, or authorisation.

Do not intentionally create or disseminate a deep fake realistically depicting the intimate parts of, or a sexual act involving, an identifiable individual if you know or should know it would cause that person physical, emotional, reputational, or economic harm.

Do not rely on the depicted individual's consent to the deep fake's creation or transmission unless it is contained in a plain-language agreement, signed knowingly and voluntarily, that describes the depiction and, if applicable, the work it will be incorporated into.

Do not distribute, transmit, or otherwise make available an algorithm, software, tool, or other technology, service, or device with actual and specific knowledge that its primary purpose is to produce an unauthorized digital voice or visual depiction of a particular, identified individual for commercial use

Do not intentionally publish, perform, distribute, transmit, or make available a digital voice or visual depiction of an individual for commercial use, knowing it is not authorized by the individual or the holder of the individual's property rights

Do not publish, distribute, or disclose a real or digitally fabricated intimate image or video of an identifiable person without consent, when done to terrify, intimidate, threaten, harass, or injure the person or to obtain money or other valuable consideration

Do not knowingly distribute or cause to be distributed a photorealistic, digital, computer, or AI-generated image that would lead a reasonable person to believe it is an actual depiction of an identifiable person's intimate body parts or sexual conduct, without that person's prior consent.

Do not use a living person's name, portrait, picture, likeness, or voice for advertising purposes or for the purposes of trade without first obtaining that person's written consent, or a minor's parent's or guardian's written consent (section 50).

Obtain the written consent before the use begins: section 51 refers to consent "first obtained" in writing, and the protection is for a living person.

Do not knowingly disclose, without the depicted person's consent, a realistic AI-generated or AI-modified image depicting them nude or engaged in sexual conduct, if you intend to coerce, harass, intimidate, demean, humiliate, or cause financial loss to them.

Do not surreptitiously create or knowingly possess a sexually expressive image, whether real, altered, or computer-generated, of an identifiable individual without that individual's written consent.

Do not distribute or publish a sexually expressive image, including a computer-generated or AI-altered one, with intent to cause emotional harm or humiliation, or after the depicted individual or their parent or guardian has told you they do not consent.

Do not create or use a nonconsensual AI-generated replica of a real person's voice, image, or likeness to induce a financial decision or extend credit, or to damage that person's or an entity's reputation.

Do not disseminate an artificially generated sexual depiction of another person, a realistic image made with the substantial help of artificial intelligence or photo editing software that shows the person nude or in sexual conduct that did not occur, with the intent or with reckless disregard to harass, annoy, threaten, alarm, or cause the person harm, unless the person has effectively consented.

Do not knowingly cause the disclosure of an intimate image of another person, including a digitally created, manipulated or altered depiction that is reasonably realistic, with intent to harass, humiliate or injure that person, where the person has not consented and a reasonable person would be harassed, humiliated or injured.

Do not disseminate an artificially generated sexual depiction of an individual, or a genuine intimate image of a current or former sexual or intimate partner, with intent to harass, annoy, or alarm them.

Do not carry out mass surveillance using an AI-based system without a legal basis, or in a way that generates or may generate a disproportionate impact on fundamental rights.

Do not analyze, classify, or infer a person's racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation from their biometric data using an AI-based system, and do not evaluate or classify people in a way that produces discriminatory or disproportionate results violating fundamental rights.

Do not produce, acquire, distribute, sell, import, export, or otherwise offer pornographic or other sexual material that depicts a minor or realistically depicts what appears to be a minor, including material generated or accessed through information or communication technology, and do not possess such material or disclose the identity of a minor it depicts.

Do not use, publish, perform, distribute, or transmit an individual's voice, photograph, or likeness, including an AI-simulated voice, without the individual's consent.

Do not distribute, transmit, or otherwise make available an algorithm, software, tool, or other technology whose primary purpose is producing a particular identifiable individual's unauthorized voice, photograph, or likeness replica.

Do not intentionally disclose, or threaten to disclose, an intimate digital depiction, including one that is AI-generated or AI-manipulated, of an identifiable person without that person's consent.

Do not knowingly produce or distribute by electronic means deep fake media that, without the depicted person's effective consent, appears to show them with computer-generated intimate parts or engaging in sexual conduct they did not engage in; doing so is a Class A misdemeanor, elevated to a third-degree felony if you have a prior conviction under this section or the person depicted is younger than 18.

Do not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative consent, if you operate a generation service

Verify the identity of the person giving consent and keep a record of the consent for at least seven years

Get an individual's consent before distributing an AI-generated, computer-animated, or digitally manipulated replica of that individual's likeness or voice

Do not traffic in identity-replication tools without the depicted individual's consent

Do not knowingly and intentionally disclose, cause to be disclosed, or threaten to disclose a fabricated (AI-generated or AI-altered) intimate image of an identifiable person, with intent to harass, intimidate, threaten, humiliate, embarrass, or coerce them.

Do not post, publish, distribute, or exhibit a synthetic intimate representation, meaning a realistic AI-generated or technologically-generated depiction using an identifiable person's face, likeness, or other distinguishing characteristic to portray an intimate scene involving that person, with intent to coerce, harass, or intimidate them.

Do not distribute, transmit, promote, or threaten to distribute AI-created or digitally altered synthetic sexual material that realistically depicts an identifiable person's intimate parts without that person's knowledge or consent, where the depicted person had a reasonable expectation of privacy and the distribution causes or is intended to cause harm.

Obtain the user's prior consent before you use the details of an electronic contact to spread commercial communications by electronic means, unless you obtained a customer's electronic mail contact details in connection with a sale and use them only for commercial communications about your own similar products or services.

Do not, without authorization, intentionally or recklessly distribute unsolicited bulk commercial electronic mail to a receiving address or account under the control of an authorized user of a computer system, unless the mail is sent between individuals, the recipient requested it, an organization sends it to its own members, or a preexisting business relationship exists.

Do not contact anyone by electronic mail, an automatic calling system or fax for direct marketing unless they have given prior consent, tell them before they consent that they can withdraw it, and give them an easy and free way to withdraw it (section 10, paragraph 1).

You need no prior consent to market your own similar products by electronic mail to a customer whose electronic address you received in connection with a sale, but you must give the customer a clear and unambiguous, easy and free opportunity to object when you receive the address and in every later contact (section 10, paragraph 2).

Use a natural person's electronic contact details for direct marketing only with their prior consent, and make the consent meet the conditions the GDPR sets (section 103^1(1)).

You need no prior consent to market your own similar products or services to a buyer whose electronic contact details you obtained in connection with a sale, but you must give the buyer a clear and understandable chance to refuse free of charge and in a simple way when you first collect the details and every time you use them, and let the buyer exercise the right to refuse through the electronic communications network (section 103^1(3)).

Obtain the recipient's prior consent before using an automated calling machine, a fax machine, or electronic mail (including a text message, which the Directive's own definition of electronic mail reaches) to send direct marketing to an individual.

Where you collected a customer's electronic contact details in the course of selling them a product or service, in accordance with Directive 95/46/EC, you may market your own similar products or services to that customer without fresh consent, provided you offered a free, easy opt-out at the time of collection and offer it again, free of charge, in every message, unless the customer already refused.

Aim direct marketing by automated calling systems, fax machines, e-mail, text messages, voice messages, sound messages or image messages only at natural persons who have consented to it in advance (section 200, paragraph 1).

You may use a customer's contact details for e-mail, text, voice, sound or image messages, obtained in the sale of a product or service, to market your own products and services of the same product group or otherwise corresponding, without prior consent, only if the customer can prohibit that use easily and without separate charge when the details are collected and with every message, and you clearly tell the customer of that possibility (section 200).

Obtain the prior consent of an individual, subscriber or user before sending direct marketing that uses their contact details by email, by fax or through an automated electronic communications system within the meaning of 6° of Article L. 32. Consent is a free, specific and informed expression of will to have their personal data used for direct marketing.

You may email direct marketing without fresh consent only where the recipient's details were collected from them, in compliance with the Loi Informatique et Libertés, in connection with a sale or a provision of services, the marketing concerns similar products or services supplied by the same person, and the recipient was offered, expressly and unambiguously, a simple way to object free of charge, apart from the cost of sending the refusal, when the details were collected and in each marketing email where they had not refused at the outset.

Obtain the addressee's prior express consent before advertising using an automatic calling machine, a fax machine, or electronic mail, unless the existing-customer exception below applies.

You may market your own similar goods or services to an existing customer by electronic mail without fresh consent only if you obtained their electronic address in connection with a sale, they have not objected to that use, and you clearly told them, both when collecting the address and at every use, that they may object at any time at no cost beyond the basic transmission tariff.

Obtain the subscriber's explicit consent beforehand before you use automated calling systems, fax machines or electronic mail, or make any other unsolicited communication by electronic means, for direct commercial promotion of products or services or for advertising of any kind.

If you use electronic mail contact details lawfully obtained in a sale of products or services or another transaction to promote your own similar products or services without prior consent, give the recipient a clear and distinct way to object easily and free of charge when you collect the details and in every message.

Unless a separate law provides otherwise, obtain the recipient's prior, clear and express consent before you communicate advertising to a natural person by direct approach, in particular by electronic mail or an equivalent individual means of communication (section 6, paragraph 1).

Keep a register of the personal data of the persons who have consented, within the scope of the consent, process that data only as the consent states until it is withdrawn, and pass it to a third party only with the prior consent of the person concerned (section 6, paragraph 5).

If you hold a gambling licence under the Gambling Regulation Act 2024, do not advertise relevant content, or cause a person to advertise it on your behalf, by electronic communication (including by telephone, text message or e-mail) unless the intended recipient has consented to receiving advertising from you by that electronic communication.

Obtain the recipient's prior consent before sending direct marketing to an individual by automated calling machine, fax, or electronic mail, a term that reaches SMS as well as email.

If an SMS is sent for a purpose other than marketing but includes direct-marketing content, treat it the same as a marketing message and obtain the recipient's prior consent.

Obtain the consent of the subscriber or user before sending advertising or direct-sale material, market research or commercial communication by an automated calling or communication system without an operator, or by email, fax, MMS, SMS or another type of electronic message.

If you use for direct sale of your own products or services the email contact details that a data subject gave you in the context of a sale of a product or service, you may do so without consent only for services similar to those sold and if the data subject, adequately informed, does not refuse that use, initially or on later communications. Tell the data subject at collection, and in every communication sent on that basis, that they can object at any time, easily and free of charge.

Be ready to prove that a commercial communication was solicited: the burden of that proof is on you as the provider.

Do not use automatic calling systems that work without human participation, electronic mail or fax machines, through which individual contact with the recipient is possible, to send a commercial notice unless the recipient has given free and unambiguous consent beforehand (article 9, paragraph 1).

You need no consent to use e-mail addresses you obtained from recipients in your commercial transactions for further commercial notices, but only about your similar goods or services, only if the recipient did not object at the outset, and only if every later notice gives a clear free-of-charge chance to refuse further use of the address (article 9, paragraph 2).

Obtain the prior consent of the subscriber or registered user of public electronic communications services before you use electronic communications services, including electronic mail, for direct marketing; where the subscriber or registered user is a legal person, consent is not needed but give it a clear, free and easily exercised possibility to refuse further use for direct marketing.

If you use the electronic mail contact details of a customer who is a natural person, obtained in providing services or selling goods, to market your own similar goods or services without prior consent, give the customer a clear, free and easily exercised possibility to refuse when the details are collected and, unless the customer objected at first, in every message you send.

Send commercial information by electronic mail without the recipient's prior consent only in the cases, in the manner and on the conditions set by the Electronic Communications Law.

Obtain the prior consent of the subscriber or user before you use automated calling and communication systems without human intervention, fax machines or electronic mail for direct marketing, where the subscriber is a natural person.

If you obtained your customers' electronic contact details in a sale of a product or service and use them to market your own similar products or services without prior consent, clearly and expressly give the customers the right to object, free of charge and in a simple manner, when you collect the details and in each message, unless they refused such use from the outset.

Do not use, or cause to be used, a publicly available electronic communications service to send an unsolicited direct marketing communication by an automatic calling machine, a facsimile machine or electronic mail to a subscriber or user, natural or legal person, unless the subscriber or user has given prior consent in writing (regulation 9(1)).

You may use electronic mail contact details obtained from customers in relation to the sale of a product or service to market your own similar products or services without fresh consent only if customers are given the opportunity to object, free of charge and in an easy and simple manner, when the details are collected and on the occasion of each message where the customer has not initially refused (regulation 9(2)).

Obtain the end user's prior consent before using an automatic calling or communication system without human intervention, a fax or an electronic message to send unsolicited communication for commercial, idealistic or charitable purposes, and be able to show that consent.

You may use electronic contact details obtained from your customers in the context of the sale of a product or service for unsolicited commercial communication about your own similar products or services without fresh consent only if you can show that origin and clearly and explicitly offered the customer, free of charge and in an easy manner, the chance to object to that use when the details were collected and, if they did not object then, in every message you send.

Before sending, or causing to be sent, email that includes an advertisement, either have a preexisting business or personal relationship with the recipient, obtain the recipient's express consent, or make the advertisement identifiable as promotional and clearly give your legal name, complete street address and email address, a notice of how to decline further advertising mail, and ADV or advertisement as the first word of the subject line.

Do not disguise the source of an advertisement, use false or misleading subject-line information, give a false return address or a false address for declining mail, ignore a recipient's request to stop, or obtain a recipient's address by a method they did not authorize.

Do not initiate an electronic mail message that you know or have reason to know misrepresents or omits information identifying its point of origin or transmission path, falsely claims to be sent by a legitimate online business, or links the recipient to a web page falsely represented as associated with a legitimate online business, to obtain identifying information the recipient believes is being given for a legitimate purpose.

Do not use a covered mobile telephone messaging system to transmit an unsolicited commercial email message.

Get the subscriber's or end user's prior consent before using an automatic calling system or telecommunications terminal equipment, in particular in the use of interpersonal communications services, to send commercial information, including direct marketing.

Get the same prior consent before sending commercial information by any means of electronic communication to a subscriber or end user.

Obtain the prior express consent of the subscriber who is a natural person, or of the user, before you send unsolicited communications for direct marketing, in particular by automated calling and communication systems that do not depend on human intervention, by fax machine, or by electronic mail including SMS, EMS and MMS; for a subscriber that is a legal person, stop once the subscriber refuses future communications or registers on the list provided for in Article 13-B.

If you obtained your customers' electronic contact details in a sale of a product or service and use them to market your own similar products or services without prior consent, clearly and explicitly give the customers a free and easy chance to refuse, when you collect the details and on the occasion of each message where the customer did not refuse initially.

Send commercial communications through automatic calling and communication systems that need no human operator, through fax or electronic mail, or through any other method that uses publicly available electronic communications services, only to a subscriber or user who has first given express consent (article 12, paragraph 1).

You need no prior consent to use a client's electronic mail address, which you obtained directly when selling the client a product or service, for commercial communications about your own similar products or services, but you must clearly and expressly offer a simple and free way to object when you obtain the address and with each message, where the client did not object initially (article 12, paragraph 2).

Use automated calling and communication systems without human intervention, telefax, e-mail, SMS and MMS for direct marketing to a subscriber or user only with their provable consent obtained before you contact them, and do not call or use those systems to obtain that consent (section 116, paragraphs 3 and 4).

Keep a durable medium recording the provable consent for at least four years from its withdrawal, and state when you obtain the consent how it can easily be withdrawn (section 116, paragraph 5).

Use automated calling and communication systems that make calls to a subscriber's telephone number without human intervention (such as automatic dialers, SMS and MMS), telefaxes or electronic mail for direct marketing only with the subscriber's or user's prior consent (article 226, paragraph 1).

You need no prior consent to use a buyer's e-mail address, obtained from the buyer of your products or services, for direct marketing of your own similar products or services, but you must clearly and expressly offer a free and simple way to refuse when you obtain the address and with every message, where the buyer did not refuse at the start (article 226, paragraph 2).

Do not send advertising or promotional communications by e-mail or another equivalent electronic means that the recipient has not previously requested or expressly authorized (Article 21(1)).

Obtain a natural person's consent in advance before you use electronic mail, fax or an automatic calling system or similar automatic system for individual communication that no individual operates to market to them (section 19, first paragraph).

You need no consent for marketing by electronic mail to an address you obtained from the person in connection with a sale of a product to them only if they have not objected to that use, the marketing concerns your own similar products, and you clearly and distinctly give them a free and easy chance to object when you collect the address and in every later marketing message (section 19, second paragraph).

Get the individual recipient's prior consent before sending, or instigating the sending of, unsolicited electronic mail, which reaches SMS and other messaging as well as email, for direct marketing purposes, unless the soft opt-in below applies.

You do not need consent if you obtained the recipient's contact details in the course of a sale or sale negotiation with them, you market only your own similar products or services, and you gave the recipient a simple, free means of opting out at the time the details were collected and with every later message.

Do not harvest email addresses from a website or generate them by an automated dictionary attack, and do not falsify the domain name registration information used to send the mail.

Do not send a commercial message to an address that resolves to a wireless carrier's messaging domain on the FCC's wireless domain names list, unless you have the addressee's express prior authorization naming your business and the address to be messaged.

Do not initiate or assist in transmitting a commercial electronic text message to a telephone number assigned to a Washington resident for cellular telephone or pager service with text-messaging capability, unless an exception applies.

You may send one only where the subscriber has clearly and affirmatively consented in advance to receive it, or, if you are the subscriber's own cellular or pager carrier, at no cost to the subscriber, unless the subscriber has said it does not want further commercial text messages from you.

Obtain the user's or subscriber's consent, after giving them clear and comprehensive information about the purposes of the processing, before storing information on their device or accessing information already stored there (cookies, local storage, or any comparable technique that stores information on the device or reads information already stored there), whether or not that information is personal data.

Store cookies or other data describing the use of a service on a user's terminal device, and use that data, only if the user has consented and you give the user understandable and comprehensive information on the purpose of the storing or use (section 205, paragraph 1). Storing or use whose only purpose is to carry out the transmission of a message in communications networks, or that is necessary for you to offer a service the subscriber or user has expressly requested, is outside that rule (section 205, paragraph 2).

Whoever you are, and not only if you are an investigative or law enforcement officer, do not install or use a pen register or a trap and trace device, a device that records the dialing, routing, addressing, or signaling information of a wire or electronic communication without capturing its contents, without first obtaining a court order, unless the user of the service being monitored has consented, or the use is by the service provider itself for network operation or for protecting the provider or a user from fraudulent or unlawful use of the service.

Obtain the user's consent, given after that information, before you store or read the information. Consent may result from appropriate settings of the connection device or of any other device under the user's control.

To be recognized by the Federal Commissioner for Data Protection and Freedom of Information, a consent-management service must apply with a security concept (sections 8, 10 and 12) and meet the Part 2 requirements, among them: store the settings an end user made and transmit them to the provider on each further use, manage only consents for which the end user was informed in advance of the matters section 3(2) lists, and document the information on which a consent rests in a way that is easily accessible to the end user (section 3).

Obtain the end user's consent, given on the basis of clear and comprehensive information and in the manner the GDPR requires, before storing information on the end user's terminal equipment or accessing information already stored there.

Obtain the subscriber's or user's consent, given after clear and comprehensive information, before you store information in, or gain access to information already stored in, their terminal equipment, unless the storage or access is solely for the transmission of a communication over an electronic communications network or is necessary for an information society service that the user or subscriber has expressly requested.

Obtain the subscriber's or user's consent, given after clear and complete information that also covers the purpose of the data processing, before you store data on their electronic communications terminal equipment or access data already stored there (Eht. section 155, paragraph 4).

Obtain the user's or subscriber's consent, after giving them clear and comprehensive information, prominently displayed and easily accessible, about the purposes of the processing, before storing information on their device or accessing information already stored there (cookies, local storage, or a comparable technique).

Before you store information on a subscriber's or user's terminal device, or access information already stored there, obtain their consent after informing them through the simplified procedures that the Garante sets.

Do not use an electronic communications network to access information stored in a subscriber's or user's terminal equipment, to store information or to monitor the user's operations, except as the consent rule permits.

Obtain the subscriber's or user's consent, after giving clear and comprehensive information about the purpose of the processing, before storing information in their terminal equipment or gaining access to information stored there (article 7.1, paragraph 1).

Obtain the subscriber's or user's consent, given after clear and comprehensive information that includes the purposes of processing, before you store information in, or give access to information already stored in, their terminal equipment, unless the storage or use of data is solely to transmit information over an electronic communications network or is necessary to provide an information society service that the subscriber or user has ordered.

Obtain the subscriber's or user's consent, given after clear and complete information that covers, among other things, the purposes of the processing, before you store information in, or obtain access to information already stored in, their terminal equipment, unless the storage or access is solely to carry out the transmission of a communication over an electronic communications network or is strictly necessary for an information society service that the subscriber or user has expressly requested.

Store information in the terminal equipment of a subscriber or user, or gain access to information stored there, only if the subscriber or user has given consent after the controller has provided clear and comprehensive information in terms of article 19 of the Data Protection Act. Technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or strictly necessary for you to provide an information society service the subscriber or user explicitly requested, is not prevented (regulation 5).

Do not install or use a pen register or a trap and trace device, a device or process that records the dialing, routing, addressing, or signaling information of a wire or electronic communication without capturing its contents, without first obtaining a court order, unless you are a provider of the communication service using it to operate, maintain, or test the service, to protect the provider or its users from abuse, fraud, or unlawful use, or with the consent of the user of that service.

Do not install or use a pen register or a trap and trace device, a device that records or decodes the number dialed or the originating number of a wire or electronic communication, without a court order, unless you are the provider of the communication service using it to operate, maintain, test or protect the service or its users, to guard against fraud, or with the consent of each person whose number is recorded or decoded.

Do not use a pen register or trap and trace device that has the ability to record conversations.

Before you store information on a user's terminal equipment, or gain access to information stored there, via an electronic communications network, give the user clear and complete information in accordance with the General Data Protection Regulation, in any case about the purposes for which you use the information, and obtain the user's consent.

If you provide an information society service by or on behalf of a legal person established under public law, do not make a user's access to it depend on giving consent under Article 11.7a(1).

Do not install or use a pen register or trap and trace device without first obtaining an order from a Nevada district court, except as the federal pen register and trap and trace statute otherwise provides.

Do not install or use a pen register or trap and trace device, a device that captures the numbers dialed on, or the originating number of a call to, a telephone line, without first obtaining a superior court order, unless you are the provider of the telecommunication service using it to operate or protect the service, to guard against fraudulent or unlawful use, or with the consent of the user of that service.

Do not install or use a pen register or a trap and trace device on a telephone line without first obtaining a court order, unless you are a wire or electronic communication service provider acting to protect your own operations or property, to prevent fraudulent or unlawful use of your service, or you have obtained the user's consent.

Do not install or use a pen register or trap and trace device unless a court order or statute allows it; a device a provider or its customer uses for billing, or for cost accounting in the ordinary course of business, is not a pen register.

If you are not an authorized user of a computer (its owner, or a person its owner or lessee has authorized to use it), do not cause software to be copied onto the computer of an authorized user in Pennsylvania, or procure its copying, and use the software to do any of the acts listed below; sections 3 and 4 apply where you act with actual knowledge, with conscious avoidance of actual knowledge or willfully.

Do not use deceptive means to collect personally identifiable information gathered by a keystroke-logging function that records all of a user's keystrokes and transfers them to another person, or that includes all or substantially all of the websites the user visits (other than the software provider's own) where the software was installed in a manner designed to conceal the installation from every authorized user, or by extracting from the hard drive, for a purpose wholly unrelated to any purpose of the software or service you described to the user, a credit or debit card or other financial account number, a password or PIN for a financial account, a Social Security number, or account balances or overdraft history in a form that personally identifies the user.

Do not install or use a pen register, a trap and trace device or a telecommunication identification interception device without first obtaining a court order, unless you are a provider of the wire or electronic communication service using it to operate, maintain or test the service, to protect the provider or its users from abuse, fraud or unlawful use, or with the consent of the user of the service.

Before storing information on, or reading information already stored on, a subscriber's or end user's telecommunications terminal equipment, tell them clearly, unambiguously and understandably the purpose of the storage or access and that they can set its conditions through the settings of the software on their device or the configuration of the service, and obtain their consent after they have received that information.

If you provide telecommunications services or services by electronic means and install software on the user's terminal equipment for use of those services, tell the user directly before installation, clearly and understandably, the purpose of the software, how you use it and how to remove it, and obtain their consent to its installation and use before you install it.

Obtain the subscriber's or user's prior consent, based on clear and complete information that covers, in particular, the purposes of the processing, before you store information in, or access information stored in, their terminal equipment, unless the storage or access is solely to transmit a communication through an electronic communications network or is strictly necessary to supply an information society service that the subscriber or user has expressly requested.

Obtain the subscriber's or user's consent before storing information in their terminal equipment or gaining access to information stored there, and give them, before they consent, clear and complete information that is easy to understand and easily accessible and that states the purpose of processing the stored information or the information they can access (article 4, paragraph 5).

Store information in a user's terminal device, or gain access to information stored there, only if the user has given provable consent meeting the requirements of a special regulation. Technical storage or access whose only purpose is the transmission of a message through a network, or that is unconditionally necessary for you to provide an information society service the user expressly requests, is not prevented (section 109, paragraph 8).

Obtain the subscriber's or user's consent before storing data in their terminal equipment or gaining access to data stored there, after clearly and comprehensively informing them in advance about the controller and the purposes of processing in line with the personal data protection rules (article 225, paragraph 1).

Before you store information on a recipient's terminal equipment or access information already stored there, obtain the recipient's consent after giving them clear and complete information about its use, in particular about the purposes of the data processing (Article 22(2)).

Before you store information in, or read information from, a subscriber's or user's terminal equipment, give them access to information about the purpose of the processing and obtain their consent, where consent has the meaning it has in the EU data protection regulation (Chapter 9, section 28; Chapter 1, section 8).

Do not knowingly install or use a pen register or trap and trace device to record or decode electronic or other impulses for the purpose of identifying telephone numbers dialed or otherwise transmitted on a telephone line.

Do not store information on, or gain access to information already stored on, a subscriber's or user's terminal equipment (a phone, computer or other device, including through a browser or an app) unless they have been given clear and comprehensive information about the purpose of the storage or access and have given consent.

Do not install or use a pen register or a trap and trace device (a device or process that records dialing, routing, addressing or signaling information of a wire or electronic communication, excluding its contents) without first obtaining a court order under section 19.2-70.2; a device a provider or customer uses for billing, or for cost accounting in the ordinary course of business, is not a pen register.

An app that captures or stores a facial image, voiceprint, or other biometric identifier from a person in Georgia must have a necessity-based purpose recognized by Art. 9 or the data subject's consent, and must determine in writing, before processing begins, the purpose, volume, storage period, and destruction procedure for that biometric data.

Ground the processing of any biometric identifier of a person in Greece, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent, unless the processing falls within the derogation in Article 22(1) of Law 4624/2019 for social security and social protection or for the assessment of an employee's working capacity.

Obtain a written release, including informed consent or an accepted electronic signature, before collecting or capturing any retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, after disclosing in writing the specific purpose and length of time the data will be collected, stored, and used.

Never sell, lease, trade, or otherwise profit from a biometric identifier or biometric information, and disclose it only with consent, for a transaction the subject requested, or as required by law or a valid warrant or subpoena.

An app that derives a faceprint, voiceprint, or other biometric identifier from an individual in Indonesia must treat it as specific personal data under Article 4 and obtain the stricter consent Article 21 requires for that category.

Do not scrape or process publicly posted facial images to build a biometric identification database without a valid GDPR Article 9 basis.

An app that derives a faceprint, voiceprint, or other individual identification code from a person in Japan, including one derived from a photo, video, or audio recording, must give purpose-of-use notice and avoid wrongful acquisition under APPI's general rules, and must obtain the data subject's consent before disclosing the identifier to a third party.

An app that handles a data subject's Specific Biometric Personal Information, an individual identification code converted from a bodily feature obtainable without special technology or great expense and of a kind the data subject cannot easily recognize is being captured, must, except in specified cases, notify the data subject in advance or place the purpose of use where the data subject can readily learn it; may not provide it to a third party under the ordinary opt-out mechanism; and must, on the data subject's request, cease using it or stop providing it to a third party without delay, unless a specified exception applies.

In the public sector, use biometric characteristics only where strictly necessary for the safety of individuals, the protection of property, or safeguarding confidential data and trade secrets, and only where no easier means would achieve that purpose.

In the private sector, apply the same necessity test, inform employees in writing in advance of the measures and their rights, and submit a detailed description of the proposed measures to the Agency for Information and Privacy before taking them.

An app that collects or processes a faceprint, voiceprint, or other biometric identifier from an individual in Malaysia, including one derived from technical processing of a photo, video, or audio recording, must obtain the data subject's explicit consent under Act 709's sensitive personal data standard.

Ground the processing of any biometric identifier captured for commercial authentication or identification purposes on a GDPR Article 9(2) condition such as explicit consent; Cap. 586's research-specific duty does not reach this use case.

Rely on UAVG Article 29 only where processing biometric data of a person in the Netherlands for unique identification is necessary for authentication or for security purposes and only so far as a weighty general interest in lawful access to certain places, buildings, services, products, information systems or work-process systems makes it necessary; otherwise you need another GDPR Article 9(2) basis.

A commercial establishment operating in New York City that collects, retains, converts, stores, or shares a customer's biometric identifier information must post a clear and conspicuous sign at every customer entrance disclosing that practice, and must never sell, lease, trade, or otherwise profit from transacting in biometric identifier information regardless of signage.

Obtain an explicit GDPR Article 9(2) legal basis before processing biometric data of a person in Poland.

Rely on a Polish employee's consent to process their biometric data only where the employee supplied the data on their own initiative, and let only people you have authorized in writing process it, bound to confidentiality, under Kodeks pracy Article 22(1b); processing needed to control access to particularly important information or to premises that need special protection is also permitted under Article 22(1b).

Inside Portland, a product built for or offered to a place of public accommodation must not use face recognition technology to identify, verify, detect, or characterize an individual's facial features, unless the use falls within the ordinance's exceptions for legal compliance, an individual unlocking their own device, or automatic face detection inside a social media application.

Route biometric identification, matching an unknown person against a database, of a person in Russia only through the state Unified Biometric System; a private accredited system may only perform authentication, using derived mathematical vectors rather than the original template, and may not transmit those vectors to a third party.

Obtain written consent before processing a person's biometric data in Russia, never condition service on that consent, and retain any biometric sample your organization holds only up to 10 days before deleting it, since the durable copy of record lives in the state system.

Process biometric personal data of a person in Slovenia in the private sector only where it is necessary for your activity, the safety of people or property, or the protection of classified data or trade secrets, with the processing operations certified under ZVOP-2 Article 52, and use biometrics to verify a customer's identity only where a law, the contract or the customer's explicit consent provides for it, under ZVOP-2 Article 83.

Do not deploy automated license-plate recognition or a biometric-recognition system on a public surface in Slovenia, under ZVOP-2 Article 80.

Do not deploy a facial-recognition or fingerprint attendance-tracking system for a person in Sweden on consent alone; IMY treats employer consent as generally invalid given the employment power imbalance.

Obtain a GDPR Article 9(2) basis, with weighty grounds, and complete a data protection impact assessment before deploying a biometric identification system in Sweden.

An app that processes a faceprint, voiceprint, or other biometric identifier of a Tajikistani data subject for identification purposes must obtain the subject's written consent, unless the processing falls within a justice, security, or law-enforcement exception. Confidentiality of biometric data specifically is deferred to other Tajik legislation, which the Act does not name and which is not identified here.

Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.

Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.

Process biometric data only within a lawful basis under article 9 of Ley N° 18.331 (typically the data subject's free, prior, express, and informed consent), since biometric data is not exempt from that consent framework.

Provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling a biometric identifier such as a voiceprint or faceprint in a database for a commercial purpose. This duty does not reach an identifier generated from a photo, video, or audio recording.

Do not appropriate, copy, transmit, publish, or otherwise give unauthorized treatment to a person's data or images without their authorization, since doing so for one's own or a third party's benefit, to the danger or harm of that person's privacy, is a criminal offense.

Carry the burden of proving that you obtained consent or delivered the privacy notice, and, for an international transfer, that the transfer was lawful.

Do not process personal data without prior consent, deny an ARCO-POL request, use a child's data without parental consent, reverse a pseudonymization, or use, transfer, share or commercialize personal data in violation of this Law.

Do not intentionally intercept, open, or otherwise interfere with a telephone call, letter, electronic message, or other private communication addressed to another person, without lawful authority.

If facts from a communication not addressed to you come to your attention by mistake, inadvertence, or negligence, do not divulge those facts or derive a gain from them.

Do not sell personal data, and do not process personal data unlawfully for financial gain or to cause harm: both are criminal offences under the Act.

Do not purchase, knowingly obtain, or knowingly or recklessly disclose another person's personal data, and do not sell or offer to sell personal data.

Do not intentionally disclose personal information in contravention of the Act, and do not collect, store or dispose of personal information in a manner that contravenes the Act (s. 39).

Do not access, appropriate, alter or use another person's personal data held in a file, register or database, public or private, without authorization and to their detriment.

Do not access another person's documents, papers or communications, or intercept their telecommunications, to learn their secrets or violate their privacy without their consent.

Do not knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, and do not sell or offer to sell personal data obtained that way.

An app that processes personal data or personal-nature information of people in Kyrgyzstan must follow the order, conditions and requirements that Kyrgyz law sets for processing and protecting it, must not disseminate it without authorization, must meet the requirements that apply to children's data and to special categories of personal data, and must transfer personal data abroad only as Kyrgyz law allows.

Do not obtain, without authority, personal data that is not freely accessible from a data processing system.

Do not trespass on property, or install a hidden device, with intent to eavesdrop on, observe, photograph, or record sounds or events in a private place, without the consent of the person entitled to privacy there.

Do not install or use, outside a private place, a device that hears, records, amplifies, or broadcasts sounds originating in that place that would not ordinarily be audible or comprehensible outside, without the consent of the person entitled to privacy there.

Do not wilfully collect, use or disclose personal health information in contravention of the Act or its regulations, and do not wilfully dispose of a record in contravention of the secure disposal duty.

Do not contravene the health number rules in section 34 (2), (3) or (4), and do not wilfully use de-identified information to identify an individual.

Do not access, use, modify, or disclose another person's or another company's reserved personal or family data without authorization; doing so is a felony under Puerto Rico's Penal Code, independent of any separate civil privacy duty.

Do not wilfully disclose personal information in contravention of the Act, or collect, store, or dispose of personal information in a manner that contravenes the Act.

Do not publish or disseminate news or images identifying a child involved in legal proceedings.

Do not unlawfully obtain, disclose, destroy, delete, mislead, conceal, alter, sell or offer to sell personal data, on pain of a fine of two hundred and forty to two hundred and forty five currency points or imprisonment of up to ten years, or both.

Do not engage in unfair or deceptive practices when collecting, using, or sharing personal data.

Do not process personal data unlawfully using artificial intelligence technologies, and do not distribute personal data so processed in the media, telecommunications networks or the internet; Uzbekistan makes this an administrative offence under Article 46-2, Part 2 of its Code of Administrative Responsibility.

If you own a website, a page of a website or another information resource, or are a blogger, do not allow it to be used, where publicly available information is posted on it, for the unlawful processing of personal data using artificial intelligence technologies or for the distribution of such data (Law on Informatization, Article 12-1).

Do not appropriate, use, modify, or delete a person's personal data or information held in a computer system without their consent.

Do not access, intercept, or reproduce a person's private data message, transmission, or communication signal without authorization.

Do not, without lawful authority, retrieve a person's subscriber information or intercept traffic data or content data.

Do not create a data bank or computerized record containing data that could affect a person's privacy.

Do not use a program or program command to disable, alter, damage, or gain unauthorized access to an information system, and do not intercept or capture data transmitted through one.

If you hold an authorization to access a system that processes personal data, do not process that data for purposes other than those for which the authorization was granted.

Do not intercept non-public computer data during its transmission to, from, or within a computer system, including electromagnetic emissions.

Do not improperly seize, copy, use or modify data in transit or held in a database or computer system, or interfere with, intercept, obstruct or prevent its transmission.

Do not possess, buy, receive, sell, exchange, facilitate, or traffic computer data, access credentials, or personal databases that you know or have reason to presume were obtained without the titleholder's consent or through a security breach or a computer offense.

Do not intercept non-public computer data transmissions without authorization.

Do not unlawfully capture, intercept, or spy on traffic data or data being transmitted through an information network while crawling or collecting it.

Do not intercept a non-public transmission of electronic data to, from, or within an electronic system, or the electromagnetic emissions of such a system, without right and with dishonest or otherwise unlawful intent.

Do not enter or break into an information system without authorization, and do not intercept data without authorization during its non-public transmission into or out of an information system.

Do not break into, eavesdrop on, illegally monitor, or hack into a communication or a communication network without authorisation from the National Communication Authority, the Attorney General, the Director of Public Prosecutions, or a court.

Do not receive, record, intercept, or wiretap data sent through the network without authorisation (art. 7).

Do not intercept, disclose, alter, or interfere with a message or the telecommunications apparatus carrying it, and do not operate a competing telecommunications service without the Corporation's authorisation.

Do not intercept a non-public transmission of computer data to, from or within a computer system, or the electromagnetic emission of such a system, without lawful excuse.

Do not intercept a private data transmission, overcome or circumvent a protective security measure, or acquire data within or transmitted to or from a computer system without lawful authority.

Do not retain, sell, or disseminate identifying information.

Do not process the personal data of minors collected or generated for age verification or parental control for commercial purposes (Article 42(8)).

Do not use commercially a minor's personal data obtained through that access control, except where necessary to provide the service itself with the data subject's consent.

Do not process minors' personal data collected under either duty for commercial purposes such as profiling or targeted advertising.

Do not process minors' personal data collected or generated through those age-verification or parental-control measures for commercial purposes such as direct marketing, profiling and behaviourally targeted advertising.

Do not process a minor's personal data collected through these measures for commercial purposes such as direct marketing, profiling or targeted behavioural advertising.

Do not commercially process any personal data of minors collected under this scheme.

Before publication, verify that every individual depicted was at least 18 when the image was created and gave explicit written consent to each act and to distribution, backed by a signed consent form and matching government-issued identification.

Do not process minors' personal data collected or otherwise generated in applying art. 39(1) for commercial purposes such as direct marketing, profiling or behaviorally targeted advertising (art. 39(2)).

Do not process the personal data of minors collected or generated through these measures for commercial purposes such as direct marketing, profiling or behavior-based advertising (art. 42^8 alin. 8).

Process any personal data of a child collected through that control only to verify the user's age.

Do not sell or retain identifying information collected in age verification; the law bars verifiers from doing either.

Do not process the personal data of minors collected or generated under these measures for commercial purposes such as direct marketing, profiling or behavioral advertising.

Do not process personal data collected or generated to meet that requirement for commercial purposes.

From September 1, 2025, ensure that any individual used as a source for artificial sexual material harmful to minors is 18 years of age or older and has consented to the use of the individual's face and body as a source; this does not apply to an entity that qualifies for the exemption above.

Limit profiling and targeted advertising to minors.

Restrict sharing of minors' precise geolocation data.

If you collect a user's personal data for age verification, do not use it for any other purpose (section 87-1305(2)).

Do not process that consumer's personal data for targeted advertising, or sell it, without consent.

Do not target, or allow an advertiser to target, an advertisement to a covered child or covered minor for narcotic drugs, tobacco products, gambling or alcohol, and do not use dark patterns in regard to a covered child or covered minor.

Do not use the personal data of a covered child or covered minor for any reason other than the reason for which it was collected, and process or retain only the minimum amount needed for the specific features they have knowingly engaged.

Obtain the consumer's own opt in consent before processing their personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Treat personal data collected from a known child under 13 as sensitive data and process it in accordance with COPPA.

Do not process, sell, or share the personal data of a user under 18 for targeted advertising, profiling, or other non-essential purposes without informed consent.

Applies to controllers subject to the Oklahoma Consumer Data Privacy Act. Treat personal data collected from a known child (an individual younger than 13) as sensitive data, and do not process it without consent.

Handle a known child's personal data in accordance with COPPA.

Do not sell such a consumer's personal data, use it for targeted advertising, or profile the consumer in furtherance of decisions with legal or similarly significant effects; there is no consent exception.

Do not sell personal data that identifies a consumer's location within a 1,750 foot radius.

As a controller, obtain opt in consent before processing the personal data of a known child under 13.

As a controller, obtain opt in consent before processing a known minor's data under 16 for targeted advertising, sale, or profiling that produces legal or similarly significant effects.

Do not process minors' personal data collected or generated for this child-protection duty for commercial purposes such as direct marketing, profiling or behaviourally targeted advertising, on your platform, another video-sharing platform or a media service.

As a social media user, refrain from creating or publishing videos of child actors in age-inappropriate roles, and from creating or publishing children's images or videos for entertainment or commercial purposes without the consent of a holder of parental responsibility (Article 8).

Do not process personal data collected under the parental-control or age-verification measures for commercial purposes.

Process data collected under these measures only to verify a user's age.

Do not collect, process, publish or share the personal data of a child under 13 unless you obtain explicit, documented, verifiable parental consent, provide a rapid way to withdraw it, disclose your data-privacy policy and restrict access to authorised personnel.

Do not use a child's personal data for commercial purposes, targeted advertising to the child, or tracking beyond the originally authorised purpose.

Do not use minors' data in algorithmic recommendation systems except at the minor's request.

Treat 16 as the minimum age at which a child can consent to the processing of their personal data, including when registering for a social media account; for a child under 16, consent must be given or authorised by a parent or guardian.

Treat 14 as the minimum age at which a minor can independently consent to processing of personal data for the service, including registering for a social media account.

Obtain parental consent for users under 14.

Obtain parental consent for account holders under 16.

Obtain verifiable parental consent for 14 and 15 year old users, verified through the best available age verification technology.

Obtain verifiable parental consent for child accounts.

Do not display addictive interface features such as infinite scroll, autoplay, push notifications, or targeted advertising on child accounts.

Obtain express parental or guardian consent before a known minor (under 18) may hold an account.

Obtain a parent's express, verified consent before a minor may hold an account.

Obtain parental consent before providing an addictive, algorithmically personalized feed to a user you know is a minor.

Use the age-determination and parental-consent methods the Attorney General's rules identify as acceptable.

Obtain parental consent before a 14 or 15 year old holds an account.

Obtain verifiable parental consent before allowing a child under 16 to create an account on a social media platform directed to children or reasonably expected to be accessed by them. Accepted methods include a signed form, credit card verification, a phone or video call, or government ID.

Treat 14 as the minimum age at which a minor can independently consent to the processing of personal data for your service, including registering for a social media account.

Obtain a parent's or guardian's consent for any processing based on consent for users under 14.

Obtain express parental consent before a minor under 18 can create or keep an account.

Let a parent revoke that consent.

Obtain separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising.

Obtain verifiable parental consent before collecting a child's personal information.