FTC Act advertising claims/unfair practices; CAN-SPAM business email including B2B; TCPA/FCC calls and texts; FTC Telemarketing Sales Rule; COPPA if service targets or knowingly collects from covered children; E-SIGN Act; UETA state enactments; sector-specific federal obligations. Enforce federal and relevant state/local layers together.
Primary review sources: FTC https://www.ftc.gov/business-guidance | FCC https://www.fcc.gov | Congress https://www.congress.gov
CCPA/CPRA applies only if jurisdictional criteria are met, including updated regulations effective January 2026. Offer applicable know/delete/correct/opt-out/limit rights, GPC recognition, notice at collection, contracts and human review where specific ADMT requirements apply. Review CPPA risk assessment/audit triggers and deadlines. California also has state-specific automatic renewal, recording and consumer statutes.
Primary review sources: CPPA https://cppa.ca.gov/regulations/ccpa_updates.html
Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, New Jersey, Nebraska, New Hampshire, Maryland, Minnesota and other states may require threshold-dependent privacy rights, universal opt-out signals or data protection assessments. Do not assume identical exemptions or response periods.
Primary review sources: IAPP comparison https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
Primary review sources: EU law https://eur-lex.europa.eu | EDPB https://www.edpb.europa.eu
UK GDPR, Data Protection Act 2018 as amended, PECR and changes under the Data (Use and Access) Act 2025 where applicable; ICO guidance for cookies and electronic/telephone marketing; UK consumer cancellation/recurring rules; UK AI/data regulator guidance; UK international transfer tools where needed.
Primary review sources: ICO https://ico.org.uk | legislation https://www.legislation.gov.uk
PIPEDA where applicable plus Alberta/BC/Quebec provincial regimes, Quebec Law 25 transparency and cross-border review, CASL for commercial electronic messages, CRTC calling rules, consumer sales/renewal requirements by province.
Primary review sources: OPC https://www.priv.gc.ca | CRTC https://crtc.gc.ca
Privacy Act/APPs where applicable, Spam Act and ACMA telemarketing/do-not-call, Australian Consumer Law guarantees and fair cancellation provisions.
Primary review sources: OAIC https://www.oaic.gov.au | ACMA https://www.acma.gov.au
Privacy Act 2020 and Privacy Principles, cross-border disclosures, Unsolicited Electronic Messages Act, consumer guarantees/fair trading requirements.
Primary review sources: Privacy Commissioner https://www.privacy.org.nz
LGPD controller/operator obligations, ANPD authority, consumer protection including distance-selling withdrawal rights where applicable, Marco Civil, electronic contracts and marketing/calling restrictions.
Primary review sources: ANPD https://www.gov.br/anpd
Digital Personal Data Protection Act and rules according to operative commencement dates; IT Act, telecom anti-spam/TRAI directives, consumer protection and payments/tax laws. Do not claim universal DPDP compliance without effective-rule verification.
Primary review sources: MeitY https://www.meity.gov.in | TRAI https://www.trai.gov.in
PDPA controller organization duties, Do Not Call registry and messaging obligations, cross-border transfer, sector-specific financial and health rules.
Primary review sources: PDPC https://www.pdpc.gov.sg
Federal PDPL coverage/exclusions, free-zone regimes as applicable (DIFC/ADGM), telecom and e-marketing rules, UAE consumer/ecommerce provisions and health/financial sector restrictions.
Primary review sources: UAE government https://u.ae
PDPL and implementing regulations, SDAIA requirements, personal data transfers, e-commerce and communications anti-spam rules; regulated sectors require separate assessment.
Primary review sources: SDAIA https://sdaia.gov.sa
APPI transparency, third-party and cross-border transfers, telecom and commercial marketing restrictions, consumption tax and relevant consumer rules.
Primary review sources: PPC https://www.ppc.go.jp/en/
PIPA and PIPC guidance, information-network and telecom rules, e-commerce consumer withdrawal and notice requirements.
Primary review sources: PIPC https://www.pipc.go.kr/eng/
POPIA rights and lawful processing; communications consent rules; cross-border transfer; Consumer Protection Act and ECTA.
Primary review sources: Information Regulator https://inforegulator.org.za/
Federal personal data protection regime and regulator updates; applicable privacy notice, data transfer and consumer/telecom restrictions.
Primary review sources: Mexico government https://www.gob.mx
Any other customer location requires jurisdiction screening for sale eligibility, data hosting, recordings, telecom, payments, taxes, accessibility, consumer withdrawal, children, biometrics, workforce, AI use and dispute resolution prior to enabling restricted capabilities.
Primary review sources: General research https://www.oecd.org/privacy/