The law library / First edition
Privacy rules.
In human language.
Start with a place or a topic. Find out what to investigate and why.
Where you operate matters. So do where your users are, what information you handle, what you do with it, and your business model.
Initial coverage: six source-linked starting points. US federal guidance, COPPA, California, Illinois, Florida, and EU scope. This is a limited educational library, not a complete legal database or an applicability assessment.
Showing all six entries.
No matching entries in this small library. That does not mean no rules apply. Change the filters or use the official sources to continue your research.
Start with the information you hold.
The FTC recommends understanding your data, collecting less, protecting it, disposing of it appropriately, and preparing for incidents.
Ask yourself: Could you explain where customer information goes and who can see it?
When should I investigate this?
A practical starting point for businesses handling personal information. This entry is guidance, not a standalone privacy statute.
A useful next step: Create a data inventory and an access list. Then decide what to keep and how to dispose of it.
This general guide does not cover every applicable federal, state, or industry-specific requirement.
Federal Trade Commission ↗
Source consulted: October 11, 2026. Editorial summary; no independent legal review.
Children need a different starting point.
COPPA covers certain online services directed to children under 13, and some services that know they are collecting information from a child under 13. Parental notice and verifiable consent are central requirements.
Ask yourself: Does your service collect information from children under 13?
When should I investigate this?
Review audience, actual knowledge of age, collection by third parties, and the exceptions in the current rule. Asking for age can change what you know.
A useful next step: Review the current COPPA rule and your collection flow before implementing parental notices and consent.
This scope summary is not a complete description of COPPA or its amended requirements.
Federal Trade Commission ↗
Source consulted: October 11, 2026. Editorial summary; no independent legal review.
Some businesses must support specific data rights.
Covered businesses must support California consumers’ privacy rights, including access, deletion, correction, and opting out of sale or sharing, subject to the law’s conditions and exceptions.
Ask yourself: Have you checked your business model, scale, and role against the coverage criteria?
When should I investigate this?
Applicability depends on doing business in California and meeting relevant thresholds or other coverage conditions. Having a California customer does not by itself establish coverage.
A useful next step: Review applicability first, then map relevant rights to notices, request handling, and downstream providers.
An exemption from this law does not establish an exemption from all other privacy or security rules.
California Department of Justice ↗
Source consulted: October 11, 2026. Editorial summary; no independent legal review.
A face scan can be more than a photo.
BIPA places requirements on covered private entities collecting biometric identifiers or information, including written disclosures and a written release before collection, and a public retention and destruction policy.
Ask yourself: Is your app or provider creating a face-geometry scan or another covered identifier?
When should I investigate this?
Investigate whether the activity and information fall within the statute’s definitions and territorial reach. An ordinary photograph is not automatically a covered biometric identifier.
A useful next step: Review definitions, collection, disclosures, storage, and destruction requirements before enabling biometric features.
Definitions, exclusions, and your specific facts need review; this is a screening summary.
Illinois General Assembly / 740 ILCS 14 ↗
Source consulted: October 11, 2026. Editorial summary; no independent legal review.
A security incident can start a legal clock.
Florida law addresses reasonable protection of covered electronic personal information and notice following certain breaches. The Attorney General’s overview describes notice to affected people and reporting to the department.
Ask yourself: Do you have a plan for finding and responding to an exposure of customer information?
When should I investigate this?
Check covered-entity and personal-information definitions, affected people, notice thresholds, exceptions, and timing under section 501.171.
A useful next step: Document who investigates an incident and how notification requirements will be assessed promptly.
Not every incident triggers the same notice duties. The statute and incident facts control.
Florida Attorney General ↗
Source consulted: October 11, 2026. Editorial summary; no independent legal review.
Your users may put another jurisdiction in view.
GDPR can cover processing connected to an EU establishment. It can also cover an organization outside the EU when its processing relates to offering goods or services to people in the EU or monitoring their behavior there.
Ask yourself: Are you serving or monitoring people in the EU, and how?
When should I investigate this?
Review establishment, targeting, and monitoring. Website accessibility from the EU alone does not determine applicability.
A useful next step: Assess territorial scope and your role before mapping processing purposes, legal bases, rights, safeguards, and vendors.
This entry covers the initial scope question, not the full set of GDPR obligations.
European Commission ↗
Source consulted: October 11, 2026. Editorial summary; no independent legal review.
What's still missing
A library that earns its coverage.
Other US state laws, health and financial rules, marketing requirements, and other countries are not covered here. A rule can also change after the source-check date.
Read the linked official source and seek qualified review for consequential decisions. These entries explain starting questions; they do not settle your legal obligations.