Software law changes on a map
Where software law started to bind since , and where it starts to bind next. Move the slider to a date: every law the map draws is listed under it, and each change is sourced on the Software Law Tracker.
The date the map shows
Changes from to in 1.7 years By this date: 77 places with law in force that started to bind since , and 32 with law not yet in force.
- Not yet in force: enacted, and it starts to bind after the date shown or after today
- In force: started to bind since
- no dated change in the window
The United States is drawn as its states, so its federal law is a button here; pointing at it outlines the country. A union's button outlines its member states, and a city is a dot.
Every law on the map
295 laws in 87 places, each with the dates the map places it on: the changes the tracker lists since , and the start dates the corpus holds up to .
-
Alabama 6 laws- HB161, App Store Accountability Act Starts
- Alabama Personal Data Protection Act (HB 351), Attorney General enforcement Starts
- Alabama Personal Data Protection Act (HB 351), consumer rights Starts
- Alabama Personal Data Protection Act (HB 351), general applicability and scope Starts
- Alabama Personal Data Protection Act (HB 351), sensitive data and biometric consent Starts
- SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization In force from
-
Arizona 1 law- Denial of claims; individualized review requirement In force from
-
Australia 4 laws- Privacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making Transparency Starts
- Security Standards for Smart Devices In force from
- App Distribution Services Online Safety Code (Class 1C and Class 2 Material) In force from
- Designated Internet Services Online Safety Code (Class 1C and Class 2 Material) In force from
-
Berkeley 1 law
All of the law LexLint holds for Berkeley -
All of the law LexLint holds for Brazil
Brazil 1 law -
California 15 laws- AB 1043 (2025), Digital Age Assurance Act Starts
- AB 1709 (2026), minimum age for addictive social media features Starts
- AB 1856 (2026), Digital Age Assurance Act amendments (operating systems and application stores) Starts
- AB 56 (2025), social media warning labels for minors Starts
- Independent Verification Organizations Act (SB 813) Starts
- SB 690 (2025-2026), Attorney General-Only Enforcement of the Pen-Register Private Right Against a Website or App Starts
- AI Training Data Transparency Act (AB 2013) In force from
- CCPA Automated Decisionmaking Technology Regulations In force from
- CCPA Cybersecurity Audit Regulations In force from
- California Data Breach Notification Law, as amended by SB 446 In force from
- Companion Chatbot Safety and Accountability Act (SB 243) In force from
- Generative AI Training Data Transparency Act (AB 2013) In force from
- Generative Artificial Intelligence Training Data Transparency Act (AB 2013) In force from
- Transparency in Frontier Artificial Intelligence Act (SB 53) In force from
- California AI Transparency Act (SB 942, as amended by AB 853) In force from
-
Colombia 1 law- Código Penal, Falsedad Personal, AI Deepfake Aggravation In force from
-
Connecticut 11 laws- AI Companion Chatbot Disclosure and Minor Safety Duties Starts
- SB 5 (2026), An Act Concerning Online Safety, social media protections for minors Starts
- Connected device provider's duty to protect recorded personal information with reasonable security measures In force from
- Connecticut Data Privacy Act (CTDPA), general applicability and controller/processor duties In force from
- Connecticut Data Privacy Act, consumer rights In force from
- Automated Employment-Related Decision Technology Act In force from
- Civil Action and Platform Takedown Duty for Synthetically Created Intimate Images In force from
- Employer AI-Related Layoff Disclosure to the Labor Department In force from
- Frontier Developer Catastrophic-Risk Whistleblower Protections In force from
- Generative AI Content Provenance Duty for Large Providers In force from
- Subscription-Based AI Provider Disclosure Duty In force from
-
All of the law LexLint holds for Czech Republic
Czech Republic 1 law -
European Union 26 laws- AI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material) Starts
- AI Act, Article 57 (national AI regulatory sandboxes) Starts
- AI Act, Article 10 (data and data governance) Amended Starts
- AI Act, Article 12 (record-keeping) Amended Starts
- AI Act, Article 14 (human oversight) Amended Starts
- AI Act, Article 15 (accuracy, robustness and cybersecurity) Amended Starts
- AI Act, Article 19 (automatically generated logs) Amended Starts
- AI Act, Article 21(2) (competent authority access to automatically generated logs) Amended Starts
- AI Act, Article 25 (responsibilities along the AI value chain) Starts
- AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) Starts
- AI Act, Article 26(10) (post-remote biometric identification authorisation) Starts
- AI Act, Article 26(11) (informing individuals subject to an Annex III decision) Starts
- AI Act, Article 26(6) (deployer log-keeping) Amended Starts
- AI Act, Article 26(7) (informing workers before workplace use) Starts
- AI Act, Article 26(8) (public-authority deployer registration) Starts
- AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) Starts
- AI Act, Article 27 (fundamental rights impact assessment) Starts
- AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) Starts
- AI Act, Article 9 (risk management system) Amended Starts
- Cyber Resilience Act, Essential Requirements and Manufacturer Obligations Starts
- Commission Recommendation (EU) 2026/1035 on a common framework for EU wide age verification technologies In force from
- AI Act, Article 4a (processing of special categories of personal data for bias detection and correction) In force from
- AI Act, Article 50 (transparency obligations for AI systems and synthetic content) Amended In force from
- AI Act, Article 73 (reporting of serious incidents) In force from
- AI Act, Article 86 (right to explanation of individual decision-making) In force from
- Cyber Resilience Act, Manufacturer Reporting Obligations In force from
-
Greece 1 law- Law 5321/2026, National AI Act Implementation Law In force from
-
Idaho 3 laws- Conversational AI Safety Act Starts
- Generative Artificial Intelligence in Education Act, vendor disclosure duty In force from
- HB 542 (2026), Stop Harms from Addictive Social Media Act In force from
-
Illinois 4 laws- Artificial Intelligence Safety Measures Act Starts
- HB 5511 (2026), Children's Online Social Media Safety Act Starts
- Child sexual abuse material, computer-generated and digitally altered depictions In force from
- Illinois Human Rights Act, use of artificial intelligence in employment decisions In force from
-
India 5 laws- Digital Personal Data Protection Act, 2023, breach notification duties Starts
- Digital Personal Data Protection Act, 2023, comprehensive regime and lawful basis Starts
- Digital Personal Data Protection Act, 2023, cross-border transfer restrictions Starts
- Digital Personal Data Protection Act, 2023, data subject rights Starts
- Synthetically Generated Information Labelling Duty for Intermediaries In force from
-
Indiana 8 laws- HEA 1408 (2026), social media accounts held by minors Starts
- Indiana Consumer Data Protection Act (INCDPA), general applicability and controller duties In force from
- Indiana Consumer Data Protection Act (INCDPA), publicly available information exemption In force from
- Indiana Consumer Data Protection Act, Attorney General enforcement In force from
- Indiana Consumer Data Protection Act, consumer rights In force from
- Indiana Consumer Data Protection Act, sensitive data and biometric data definitions In force from
- Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026) In force from
- House Enrolled Act 1360 (2026), data scraping definition and public-records anti-bot portal authorization In force from
-
Ireland 1 law- Regulation of Artificial Intelligence Act 2026 In force from
-
Kazakhstan 8 laws- Code of Administrative Offences, artificial intelligence violations In force from
- Law on Artificial Intelligence, copyright and training data In force from
- Law on Artificial Intelligence, machine-readable opt-out for training on published works In force from
- Law on Artificial Intelligence, prohibited practices In force from
- Law on Artificial Intelligence, transparency and disclosure duties In force from
- Law on Personal Data and Their Protection, data subject rights In force from
- Digital Code, algorithmic decision-making rights In force from
- Digital Code, general cybersecurity duty on digital-object owners and holders In force from
-
Kentucky 5 laws- Kentucky Consumer Data Protection Act (KCDPA), general applicability and controller and processor duties In force from
- Kentucky Consumer Data Protection Act, Attorney General enforcement In force from
- Kentucky Consumer Data Protection Act, consumer rights In force from
- Kentucky Consumer Data Protection Act, publicly available information exclusion In force from
- Kentucky Consumer Data Protection Act, sensitive data and biometric data definitions In force from
-
Kyrgyzstan 8 laws- Digital Code, Chapter 23: AI interaction and deepfake disclosure duties In force from
- Digital Code, Chapter 23: AI system design and risk-management obligations In force from
- Digital Code, comprehensive personal data regime In force from
- Digital Code, cross-border transfer of personal data In force from
- Digital Code, digital resilience baseline security measures In force from
- Digital Code, digital resilience incident notification In force from
- Digital Code, sectoral regulator for personal data In force from
- Digital Code, special categories of personal data In force from
-
Louisiana 7 laws- Louisiana Data Privacy Act (Act No. 502), Attorney General enforcement Starts
- Louisiana Data Privacy Act (Act No. 502), applicability and controller duties Starts
- Louisiana Data Privacy Act (Act No. 502), consumer rights Starts
- Louisiana Data Privacy Act (Act No. 502), sensitive and biometric data Starts
- Act 481 (HB 570), App Store Accountability Act In force from
- Act 559 (HB 639), AI-generated voice telephone campaign communication disclosure In force from
- Act 806 (HB 459), AI-manipulated electioneering communication disclosure In force from
-
Malta 3 laws- Cyber Resilience Regulations, MDIA Designation under the Cyber Resilience Act Starts
- Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities In force from
- Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT In force from
-
Maryland 3 laws- SB 141 / Ch. 444 (2026), Election Deepfake Prohibition In force from
- HB 895 / Ch. 154 (2026), Surveillance Pricing and Algorithmic Price Disclosure (Protection from Predatory Pricing Act) In force from
- SB 8 / Ch. 445 (2026), AI and Deepfake Identity Fraud In force from
-
Minneapolis 1 law
All of the law LexLint holds for Minneapolis -
Mississippi 1 law- HB 1224, Mississippi Keeping Kids Safe Online Act In force from
-
Missouri 3 laws- Child sexual abuse material offenses, computer-generated and AI-indistinguishable images included In force from
- Disclosure of an intimate digital depiction In force from
- HB 1839 (HCS HBs 1839, 2921 and 3015), Age Verification on Adult Websites In force from
-
Moldova 8 laws- Law No. 195/2024 on Personal Data Protection In force from
- Moldova Law No. 195/2024, automated decisions In force from
- Moldova Law No. 195/2024, personal data breach notification In force from
- Moldova Law No. 195/2024, rights of the data subject In force from
- Moldova Law No. 195/2024, special categories, a child's consent and conviction data In force from
- Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions In force from
- Moldova Law No. 195/2024, transfers of personal data abroad In force from
- Personal Data Protection Law, Reach Over Scraped Public Personal Data In force from
-
Mozambique 3 laws- Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector In force from
- Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure In force from
- Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers In force from
-
Nebraska 4 laws- Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) Starts
- Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction In force from
- LB 504 (2025), Age-Appropriate Online Design Code Act In force from
- LB 838 (2026), amendments broadening the Age-Appropriate Online Design Code Act In force from
-
Netherlands 2 laws- Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance In force from
- Cyberbeveiligingswet, Significant-Incident Reporting Obligations In force from
-
New Hampshire 3 laws- HB 1460, prohibiting the sale of a child's personal data Starts
- AI Chatbot Solicitation of Children In force from
- Creation of Child Intimate Visual Representations In force from
-
All of the law LexLint holds for New Jersey
New Jersey 1 law -
Oklahoma 7 laws- Oklahoma Consumer Data Privacy Act, Attorney General enforcement Starts
- Oklahoma Consumer Data Privacy Act, consumer rights Starts
- Oklahoma Consumer Data Privacy Act, general applicability and exemptions Starts
- Oklahoma Consumer Data Privacy Act, publicly available information exemption Starts
- Oklahoma Consumer Data Privacy Act, sensitive data and biometric data definitions Starts
- SB 546, Oklahoma Consumer Data Privacy Act Starts
- Security Breach Notification Act In force from
-
Oregon 6 laws- HB 2008, Oregon Consumer Privacy Act minors and geolocation amendments In force from
- Oregon Automatic Dialing and Announcing Device Statute (as amended by 2025 Or. Laws ch. 580, effective January 1, 2026) In force from
- Oregon Consumer Privacy Act (OCPA), general applicability and controller duties In force from
- Oregon Unlawful Telephone Solicitations Act (as amended by 2025 Or. Laws ch. 580, effective January 1, 2026) In force from
- Unlawful dissemination of an intimate image extended to AI-generated depictions (HB 2299) In force from
- Use of nursing titles by a nonhuman entity (HB 2748) In force from
-
Paraguay 7 laws- Ley N° 7593/2025, automated or semi-automated individual decisions Starts
- Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay Starts
- Ley N° 7593/2025, derechos del titular de datos Starts
- Ley N° 7593/2025, la Agencia Nacional, faltas y sanciones Starts
- Ley N° 7593/2025, notificación de un incidente de seguridad Starts
- Ley N° 7593/2025, transferencias internacionales de datos personales Starts
- Ley N° 7593/2025, tratamiento de datos sensibles y categorías especiales Starts
-
Peru 2 laws- Reglamento de la Ley 31814, high-risk AI system duties In force from
- Reglamento de la Ley 31814, prohibited AI uses In force from
-
Poland 3 laws- Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), System Zarządzania Bezpieczeństwem Informacji Starts
- Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów Poważnych Starts
- Ustawa o systemach sztucznej inteligencji, Act on Artificial Intelligence Systems In force from
-
All of the law LexLint holds for Puerto Rico
Puerto Rico 1 law -
Rhode Island 6 laws- Artificial Intelligence Companion Models Act Starts
- Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), general applicability In force from
- Rhode Island Data Transparency and Privacy Protection Act, customer rights In force from
- Rhode Island Data Transparency and Privacy Protection Act, enforcement In force from
- Rhode Island Data Transparency and Privacy Protection Act, publicly available information exemption In force from
- Rhode Island Data Transparency and Privacy Protection Act, sensitive data and biometric data definitions In force from
-
Rockville 1 law
All of the law LexLint holds for Rockville -
Saudi Arabia 4 laws- Copyright Law (2026), circumventing technical protection measures In force from
- Copyright Law (2026), copying to develop artificial intelligence products and algorithms In force from
- Copyright Law (2026), database compilations In force from
- Copyright Law (2026), licence terms for software, applications and databases In force from
-
South Carolina 4 laws- Age-Appropriate Design Code, enforcement In force from
- Age-Appropriate Design Code, sensitive personal data and biometric data In force from
- H.3431 (2026), Age-Appropriate Design Code Act (Act No. 96 of 2026) In force from
- South Carolina Age-Appropriate Design Code, general applicability and minor-protective design duties In force from
-
South Dakota 2 laws- Genetic Data Privacy Act, definitions, consent, and consumer rights In force from
- Genetic Data Privacy Act, enforcement In force from
-
South Korea 3 laws- AI Framework Act, Article 31 (transparency obligations for AI outputs) In force from
- AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems) In force from
- AI Framework Act, Article 34 (business-operator duties for high-impact AI) In force from
-
Sweden 3 laws- Cybersäkerhetslag, Cybersecurity Risk-Management Measures In force from
- Cybersäkerhetslag, Incident Notification In force from
- Brottsbalken 4 kap. 9 c §, Unauthorized Computer Access (Dataintrång) In force from
-
All of the law LexLint holds for Tennessee
Tennessee 1 law -
Texas 5 laws- Capture or Use of Biometric Identifier Act (CUBI), as amended by HB 149 In force from
- SB 2420 (2025), App Store Accountability Act In force from
- TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty In force from
- TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person In force from
- Texas Capture or Use of Biometric Identifier Act (CUBI), publicly available media clause In force from
-
Turkey 2 laws- Commercial Advertising Regulation, AI Deepfake Endorsement Ban In force from
- Commercial Advertising Regulation, AI Disclosure Duty In force from
-
All of the law LexLint holds for United Arab Emirates
United Arab Emirates 1 law -
United Kingdom 5 laws- Data (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22D In force from
- PECR, Storage of and Access to Information on Terminal Equipment In force from
- UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United Kingdom In force from
- UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025 In force from
- Creating, or Requesting the Creation of, Purported Intimate Image of Adult In force from
-
Utah 8 laws- Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c Starts
- Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b Starts
- Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) Starts
- Motor Vehicle Data Privacy Starts
- SB 142 (2025), App Store Accountability Act, as amended by HB 498 (2026), App Store Accountability Act Amendments Starts
- Genetic sequencing, storage of genetic information (HB 182) Starts
- Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session) In force from
- Utah Consumer Sales Practices Act, deceptive act or practice by a supplier In force from
-
Vermont 6 laws- S.69 (2025), Vermont Age-Appropriate Design Code Act (Act 63 of 2025) Starts
- Vermont Data Privacy and Online Surveillance Act, Attorney General enforcement Enacted Starts
- Vermont Data Privacy and Online Surveillance Act, consumer rights Starts
- Vermont Data Privacy and Online Surveillance Act, general applicability Enacted Starts
- Vermont Data Privacy and Online Surveillance Act, sensitive data and biometric data definitions Starts
- Vermont Synthetic Media in Elections Act In force from
-
Vietnam 11 laws- Law on Personal Data Protection, biometric and location data protection In force from
- Law on Personal Data Protection, breach notification In force from
- Law on Personal Data Protection, comprehensive regime In force from
- Law on Personal Data Protection, cross-border transfer In force from
- Law on Personal Data Protection, enforcement and data subject rights In force from
- Law on Artificial Intelligence, incident management and reporting obligation In force from
- Law on Artificial Intelligence, prohibited practices In force from
- Law on Artificial Intelligence, risk classification and conformity assessment In force from
- Law on Artificial Intelligence, transparency obligation In force from
- Cybersecurity Law, Incident Response and Reporting Duties In force from
- Cybersecurity Law, Information System Classification and Protection Measures In force from
-
Washington 3 laws- AI companion chatbot disclosure and safety act Starts
- AI content provenance and disclosure act Starts
- Forged digital likeness act (Personality Rights Law amendment) In force from
-
All of the law LexLint holds for West Virginia
West Virginia 1 law
2 laws start to bind after , past the slider's last stop, so the map does not place them:
- AI Auditor Registry Act (AB 1405), California, starts
- AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union, starts
152 more laws are enacted with no start date on record, so the map cannot place them on the slider. Each is marked not yet in force on its own LexLint page.
This map reports changes in the law, drawn from the official record each change on the tracker cites. It is not legal advice.
Austria
Bulgaria
Chile
China
Colorado
Delaware
Estonia
Ethiopia
Finland
Georgia
Germany
Hawaii
Indonesia
Iowa
Japan
Kansas
Luxembourg
Malaysia
Mexico
Minnesota
Montana
Nevada
New York
Portugal
Russia
Serbia
Slovenia
Taiwan
United States
Uzbekistan
Virginia
Wyoming