How we score.

A gap means the law you need to meet scores higher than yours on a requirement. A score is our reading of the law, not legal advice. Laws change, and so do our scores: each cell shows the date it was last checked. If you think a score is wrong, tell us with the section you rely on; correspondents and members review challenges.

Global 21 requirements

Area	Requirement	What the levels mean
Reach and lawful basis	Reach abroad	0 none, 1 limited (e.g. equipment in country), 2 offering goods/services or monitoring residents, 3 any processing of residents' data.
Reach and lawful basis	Lawful basis	1 multiple bases incl. legitimate interests, 2 multiple bases without legitimate interests, 3 consent is the main or default basis. (CCPA-style opt-out regimes: 0 notice and opt-out.)
Reach and lawful basis	Consent	0 implied/opt-out acceptable, 1 express for some uses, 2 express, specific, informed, 3 express plus written/recorded or regulator-prescribed form.
Reach and lawful basis	Sensitive data	0 no special category, 1 defined with extra notice, 2 prohibited unless listed exceptions/explicit consent, 3 plus regulator authorization or licensing.
Reach and lawful basis	Children	record the age threshold in value. Level 0 no rule, 1 age 13 or lower, 2 age 14 to 16, 3 age 17 or 18 or a stricter regime.
People's rights	Rights	which of access, correction, deletion, portability, objection, restrict, automated-decision rights exist. Level = 0 (0 to 1 rights), 1 (2 to 3), 2 (4 to 5), 3 (6 or more).
People's rights	Request deadline	value in days. Level 0 none set, 1 over 30 days, 2 21 to 30 days or one month, 3 under 21 days.
People's rights	Marketing	0 no rule, 1 opt-out, 2 opt-in for electronic marketing, 3 opt-in for all marketing.
Governance	DPO required	0 not required, 1 required in limited cases (large-scale, public bodies), 2 required for most or registered controllers, 3 required for every institution or controller.
Governance	DPO qualifications	0 none, 1 expertise expected, 2 certification or training recommended or local residency, 3 regulator-approved certification or registration of the DPO required.
Governance	Registration	0 none, 1 notification in limited cases, 2 registration of most controllers, 3 licensing with fees and renewal.
Governance	DPIA	0 not required, 1 recommended, 2 required for high-risk processing, 3 required broadly or must be filed with the regulator.
Governance	Records	0 none, 1 limited, 2 required for most, 3 required and filed with regulator.
Governance	Retention	0 no rule, 1 general limitation principle, 2 specific limits or deletion duties, 3 fixed periods set by law or regulator.
Breaches	Tell the regulator	value with the deadline. Level 0 no duty, 1 "as soon as reasonably possible" with no fixed time, 2 fixed deadline over 24 hours (e.g. 72 hours), 3 within 24 hours or "immediately".
Breaches	Tell people	0 no duty, 1 only if regulator directs, 2 when high risk, 3 always or with a fixed deadline.
Transfers	Transfers abroad	0 free, 1 accountability/adequate protection, 2 adequacy or listed safeguards (SCCs, BCRs, consent), 3 regulator approval or authorization needed.
Transfers	Localization	0 none, 1 sectoral, 2 copy must stay or certain data must stay, 3 broad localization.
Enforcement	Maximum fine	value as stated (currency and/or % of turnover). Level 0 none, 1 under USD 100k, 2 USD 100k to 5m, 3 over USD 5m or % of global turnover.
Enforcement	Criminal liability	0 none, 1 limited offenses, 2 imprisonment for listed offenses, 3 broad criminal offenses for officers.
Enforcement	Private action	0 none, 1 limited (via regulator), 2 civil compensation claims, 3 statutory damages or class actions.

US states 20 requirements

Area	Requirement	What the levels mean
Who it covers	Thresholds	value states the thresholds (consumer counts, revenue, data-sale share). Level 0 high thresholds (100k+ consumers and revenue share), 1 standard (100k, or 25k plus 50%+ revenue from sales), 2 lower thresholds (e.g. 35k or 50k, or a revenue test alone), 3 no or very low threshold (e.g. any business not a small business, or Texas-style SBA test).
Who it covers	Exemptions	entity-level vs data-level exemptions for GLBA/HIPAA, nonprofits. Level 0 broad entity-level exemptions incl. nonprofits, 1 entity-level GLBA and HIPAA, 2 data-level only for one of them, 3 data-level only and nonprofits covered.
Who it covers	In force	value is the date the main obligations apply. Level 0 in force before 2024, 1 2024, 2 2025 or 2026, 3 2027 or later (for display; not a demand measure).
Sensitive data and minors	Sensitive data	0 notice/opt-out, 1 opt-in consent, 2 opt-in plus broader categories (e.g. consumer health, transgender/nonbinary status, neural data), 3 processing or sale prohibited unless strictly necessary (Maryland style).
Sensitive data and minors	Children and teens	value gives ages. Level 0 COPPA only (under 13), 1 under 13 parental consent as sensitive data, 2 extra teen protections (13 to 15 or 16, opt-in for ads or sale), 3 teen protections to 17 or a design code duty.
Sensitive data and minors	Data minimization	0 none beyond notice, 1 adequate, relevant and reasonably necessary to disclosed purposes, 2 reasonably necessary and proportionate, 3 strictly necessary to provide the requested product (Maryland style).
Consumers' rights	Rights	access, correct, delete, portability, opt out of sale, targeted ads, profiling, list of third parties, and others. Level 0 (up to 4), 1 (5 to 6), 2 (7 to 8), 3 (9 or more).
Consumers' rights	Request deadline	value in days. Level 2 for 45 days (the norm), 3 if shorter, 1 if longer or not set.
Consumers' rights	Appeals	0 none, 1 internal appeal, 2 appeal plus notify AG route, 3 plus fixed appeal deadline under 60 days.
Consumers' rights	Universal opt-out	0 not required, 1 voluntary or future, 2 required (GPC), 3 required plus other signals or browser mandate.
Business duties	Assessments	0 none, 1 for limited activities, 2 required for targeted ads, sale, profiling and sensitive data, 3 required and filed with or reported to the regulator, or algorithmic assessments.
Business duties	Processor contracts	0 none, 1 basic contract terms, 2 detailed terms plus audits or assessments, 3 plus subcontractor flow-down and notice.
Business duties	Privacy notice	0 minimal, 1 standard notice, 2 plus specific disclosures (e.g. list of third parties, sale of sensitive data notices), 3 plus prescribed formats or extra notices.
Business duties	Loyalty programs	0 not addressed, 1 general non-discrimination exception, 2 specific loyalty program rules, 3 detailed notice and consent rules.
Business duties	De-identified data	0 not addressed, 1 definition only, 2 public commitment and contract duties, 3 plus pseudonymous data rules and limits.
Enforcement	Who enforces	who enforces. Level 1 AG only, 2 AG plus agency or rulemaking, 3 dedicated agency (CPPA) or AG plus rulemaking and audits.
Enforcement	Cure period	0 permanent cure period, 1 cure period that has expired or is discretionary, 2 limited, 3 no cure period.
Enforcement	Maximum penalty	value per violation. Level 0 under 2,500 USD, 1 2,500 to 7,499, 2 7,500 to 14,999, 3 15,000 or more or treble damages.
Enforcement	Private action	0 none, 1 limited (e.g. under a separate consumer protection act), 2 for data breaches only, 3 broad private right of action.
Enforcement	Rulemaking	0 none, 1 limited, 2 AG rulemaking authority, 3 rules in force.