Method and limits

This is a reference to primary sources, not a summary of them. Every claim on every page links to the statute, the regulation or the regulator that backs it, and the difference between those is shown rather than assumed — a Primary badge means the text with legal force, and Official means a government body describing it.

What is in it

Jurisdictions
85
Laws
113
Pending bills
5
Citations
241 (148 primary)
Laws with a primary source
113 of 113 — 100%
Machine-readable sources listed
46
Built as of
September 27, 2026

Every law in this atlas cites at least one primary source. That is enforced by a test that fails the build, not by review — data/integrity.test.ts.

Coverage by tier

California
1
US federal
1
US states and DC
50
European Union
1
European national
32

Coverage by status

Comprehensive law in force
53
Comprehensive bill pending
2
Sectoral laws only
8
No comprehensive law
22

Gaps in this atlas

None. Every jurisdiction drawn on a map has been researched and carries a finding — including the ones whose finding is “no comprehensive law”. Those two states are tracked separately and always have been: “we checked and there is no omnibus law” is a result, and “we have not checked” is not. A build containing the second cannot ship.

Separately, 32 jurisdictions have no comprehensive privacy law. That is a finding about them, not a gap here — each still carries its breach statute, its regulator, and any sectoral law that bites.

And 11 official sources on the Sources page cover jurisdictions this atlas does not map at all — Canada, Japan, Korea, Singapore, Australia, Brazil. They are listed so the absence is visible instead of silent.

What this atlas does not do

  • No case law.

    Court decisions shape what these statutes mean, and none are recorded here. The regulator and court links are the route to them.

  • No enforcement history, and no settlement figures.

    Those change constantly, and a stale enforcement figure in a legal reference is worse than none. Each regulator's own enforcement page is linked instead, which is current by definition.

  • US breach-notification records carry the citation and the link, not per-state deadlines.

    All fifty states have a breach statute and their deadlines and thresholds differ in detail this atlas has not verified state by state. The operative wording is one click away.

  • European national records do not cover each member state's GDPR derogations clause by clause.

    The GDPR leaves roughly seventy matters to national law. This atlas carries the authority, the implementing act and the age of digital consent; the rest is with the authority.

  • Bill statuses are a snapshot, not a feed.

    Each is stamped with the date it was checked and is shown with that date everywhere it appears.

  • Nothing here is legal advice.

    It is a reference to primary sources. Whether a law applies to a particular business is a question about that business.

How it stays honest

  • Every law must cite at least one primary source, and every source URL must be HTTPS on an allowlist of official publishers. A citation to a blog or a law firm cannot enter the dataset — the build fails.
  • Every jurisdiction drawn on a map must resolve to a law, a regulator and a summary. There is no code path that renders an empty panel.
  • Dates are checked for ordering, and a law marked in force must actually have taken effect.
  • A jurisdiction marked comprehensive must state its exemptions. A privacy law with no carve-outs does not exist anywhere, so an empty list means research that was never done.
  • Findings that look like mistakes are pinned by tests saying they are not — Utah really does grant no correction right, Iowa really does grant no targeted-advertising opt-out, and HIPAA really has no private right of action.
  • The numbers on this page are computed from the dataset, never typed. A limits page that can drift from what it describes is worse than no limits page.
  • Every citation is checked to still resolve, and checked on the page’s title rather than its status code — a legislature URL for a renumbered section will happily answer 200 with a “not found” page. At the last run, 207 of 245 URLs verified and none were broken. The remaining 38 are official sites — congress.gov, hhs.gov, fcc.gov, nysenate.gov, legifrance.gouv.fr among them — whose bot protection refuses automated clients, including real headless browsers. They are reported as unverified rather than as either working or broken, because that is what is actually known about them.

The oldest bill status in this build was checked on September 27, 2026.