Privacy laws
Where you live decides which rights you have, how long an organisation has to answer and who you can complain to. These pages explain each law in plain language and link to the primary texts.
General information, not legal advice
These pages have not yet been reviewed by a lawyer. Check the linked primary sources, and take advice for decisions that matter.
- California privacy rights: CCPA, the Delete Act and DROPWhat the CCPA and the Delete Act give California residents, how to use DROP, the 45-day deadlines, and how these rights apply to AI and face data.
- Illinois biometric privacy: BIPAWhat Illinois's Biometric Information Privacy Act requires before a company scans your face, who can sue, the damages rules since 2024, and its limits.
- US federal law: the TAKE IT DOWN Act and what else appliesWhat the TAKE IT DOWN Act's 48-hour removal rule covers, how to use it and report a platform to the FTC, and what US federal law does not cover.
- EU privacy rights: GDPR and the AI ActYour GDPR rights of access, erasure and objection, the one-month deadline, how to complain, and what the EU AI Act adds for face data and deepfakes.
- UK privacy rights: UK GDPR and the Data Protection Act 2018Your UK rights to access, delete and object to use of your personal data, the one-month deadline, the complaints route, and how they apply to AI.
Not sure which applies to you? The privacy rights finder shows the law, deadline and regulator for where you live.