{ "edition": "2026-10-11", "status": "educational-prototype", "independentLegalReview": false, "coverage": "Six selected starting points; not comprehensive and not an applicability determination.", "entries": [ { "id": "ftc-basics", "title": "Start with the information you hold.", "jurisdiction": "United States / general business guidance", "regions": [ "us", "ca", "il", "fl" ], "topics": [ "basics", "security" ], "kind": "Regulator guidance", "summary": "The FTC recommends understanding your data, collecting less, protecting it, disposing of it appropriately, and preparing for incidents.", "scope": "A practical starting point for businesses handling personal information. This entry is guidance, not a standalone privacy statute.", "question": "Could you explain where customer information goes and who can see it?", "nextStep": "Create a data inventory and an access list. Then decide what to keep and how to dispose of it.", "limit": "This general guide does not cover every applicable federal, state, or industry-specific requirement.", "sourceName": "Federal Trade Commission", "sourceUrl": "https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business", "sourceChecked": "2026-10-11" }, { "id": "coppa", "title": "Children need a different starting point.", "jurisdiction": "United States / COPPA", "regions": [ "us", "ca", "il", "fl" ], "topics": [ "children", "personal" ], "kind": "Law / regulator explanation", "summary": "COPPA covers certain online services directed to children under 13, and some services that know they are collecting information from a child under 13. Parental notice and verifiable consent are central requirements.", "scope": "Review audience, actual knowledge of age, collection by third parties, and the exceptions in the current rule. Asking for age can change what you know.", "question": "Does your service collect information from children under 13?", "nextStep": "Review the current COPPA rule and your collection flow before implementing parental notices and consent.", "limit": "This scope summary is not a complete description of COPPA or its amended requirements.", "sourceName": "Federal Trade Commission", "sourceUrl": "https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-not-just-kids-sites", "sourceChecked": "2026-10-11" }, { "id": "ccpa", "title": "Some businesses must support specific data rights.", "jurisdiction": "California / CCPA, as amended", "regions": [ "us", "ca" ], "topics": [ "personal" ], "kind": "Law / regulator explanation", "summary": "Covered businesses must support California consumers’ privacy rights, including access, deletion, correction, and opting out of sale or sharing, subject to the law’s conditions and exceptions.", "scope": "Applicability depends on doing business in California and meeting relevant thresholds or other coverage conditions. Having a California customer does not by itself establish coverage.", "question": "Have you checked your business model, scale, and role against the coverage criteria?", "nextStep": "Review applicability first, then map relevant rights to notices, request handling, and downstream providers.", "limit": "An exemption from this law does not establish an exemption from all other privacy or security rules.", "sourceName": "California Department of Justice", "sourceUrl": "https://www.oag.ca.gov/privacy/ccpa", "sourceChecked": "2026-10-11" }, { "id": "bipa", "title": "A face scan can be more than a photo.", "jurisdiction": "Illinois / Biometric Information Privacy Act", "regions": [ "us", "il" ], "topics": [ "biometrics" ], "kind": "Law / regulator explanation", "summary": "BIPA places requirements on covered private entities collecting biometric identifiers or information, including written disclosures and a written release before collection, and a public retention and destruction policy.", "scope": "Investigate whether the activity and information fall within the statute’s definitions and territorial reach. An ordinary photograph is not automatically a covered biometric identifier.", "question": "Is your app or provider creating a face-geometry scan or another covered identifier?", "nextStep": "Review definitions, collection, disclosures, storage, and destruction requirements before enabling biometric features.", "limit": "Definitions, exclusions, and your specific facts need review; this is a screening summary.", "sourceName": "Illinois General Assembly / 740 ILCS 14", "sourceUrl": "https://ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57", "sourceChecked": "2026-10-11" }, { "id": "florida-security", "title": "A security incident can start a legal clock.", "jurisdiction": "Florida / Information Protection Act", "regions": [ "us", "fl" ], "topics": [ "security", "personal" ], "kind": "Law / regulator explanation", "summary": "Florida law addresses reasonable protection of covered electronic personal information and notice following certain breaches. The Attorney General’s overview describes notice to affected people and reporting to the department.", "scope": "Check covered-entity and personal-information definitions, affected people, notice thresholds, exceptions, and timing under section 501.171.", "question": "Do you have a plan for finding and responding to an exposure of customer information?", "nextStep": "Document who investigates an incident and how notification requirements will be assessed promptly.", "limit": "Not every incident triggers the same notice duties. The statute and incident facts control.", "sourceName": "Florida Attorney General", "sourceUrl": "https://www.myfloridalegal.com/consumer-protection/how-to-protect-yourself-data-security", "sourceChecked": "2026-10-11" }, { "id": "gdpr", "title": "Your users may put another jurisdiction in view.", "jurisdiction": "European Union / GDPR", "regions": [ "eu" ], "topics": [ "personal" ], "kind": "Law / regulator explanation", "summary": "GDPR can cover processing connected to an EU establishment. It can also cover an organization outside the EU when its processing relates to offering goods or services to people in the EU or monitoring their behavior there.", "scope": "Review establishment, targeting, and monitoring. Website accessibility from the EU alone does not determine applicability.", "question": "Are you serving or monitoring people in the EU, and how?", "nextStep": "Assess territorial scope and your role before mapping processing purposes, legal bases, rights, safeguards, and vendors.", "limit": "This entry covers the initial scope question, not the full set of GDPR obligations.", "sourceName": "European Commission", "sourceUrl": "https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/application-gdpr_en", "sourceChecked": "2026-10-11" } ] }