# Data privacy laws for AI training data by country

URL: https://sellmydatatoai.net/guides/data-privacy-laws-for-ai-training-by-country
Reviewed: 2026-11-08

The US has no federal privacy law for AI training data, so state privacy laws in 19 states, the FTC and sector rules apply. Elsewhere, most regimes let personal data train AI only with consent or a documented legitimate interest, treat properly anonymized data as outside the law and restrict transfers abroad. Regulators in the UK, EU, Canada, Australia and Singapore have published AI-specific guidance.

## Key takeaways

- The US relies on the FTC Act, sector laws and state statutes. 19 comprehensive state privacy laws are in force, and four more passed in 2026 take effect in 2027 and 2028.
- California's CCPA treats a transfer of personal information for value as a sale, and excludes data that meets its deidentified standard.
- The ICO, the EDPB and France's CNIL accept legitimate interests as a possible basis for AI training, subject to a documented balancing test and safeguards.
- Canada, Australia and Singapore lean on consent, reasonable expectations or narrow exceptions, so reusing customer data for training is harder there.
- Most regimes outside the US restrict transfers abroad. The US now restricts bulk sensitive data transfers to countries of concern under the DOJ Data Security Program.

Privacy law decides whether the personal data inside your records can be licensed for AI training, and the answer changes at every border. This guide starts with the US federal and state position, then compares 17 jurisdictions in one table, with a link to the main AI-training guidance in each.

It summarizes what the laws and regulators say as of November 2026. It is not legal advice for your records, and the rules are moving quickly, so take independent advice in each country where your data subjects live. For a step-by-step view of the three biggest regimes, see our guide to [UK GDPR, EU GDPR and CCPA](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training).

## Is there a US federal privacy law for AI training data?

There is no comprehensive US federal privacy law for AI training data. Federal rules come from the FTC Act, sector statutes and a national security rule on foreign transfers.

| Rule | What it does for training data | Source |
| --- | --- | --- |
| Section 5 of the FTC Act | Privacy promises must be kept. FTC staff wrote in February 2024 that quietly changing terms to allow AI training could be unfair or deceptive | [FTC Technology Blog, February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) |
| COPPA Rule, as amended in 2025 | Operators need separate verifiable parental consent before disclosing children's personal information to third parties | [FTC, January 16, 2025](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) |
| Gramm-Leach-Bliley Act | Limits disclosure of nonpublic personal information by financial institutions | [FTC](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act) |
| DOJ Data Security Program, 28 CFR Part 202 | Prohibits or restricts transfers of bulk genomic, geolocation, biometric, health, financial and other sensitive personal data to countries of concern, in force since April 8, 2025 | [US Department of Justice](https://www.justice.gov/nsd/data-security) |

The DOJ rule matters for licensing. A license that gives a covered person linked to a country of concern access to bulk sensitive personal data can be a prohibited or restricted transaction, and due diligence and audit duties for restricted transactions applied from October 5, 2025. Every buyer we introduce is verified for company identity and onward transfer limits before seeing a sample.

## Which US states have comprehensive privacy laws?

23 US states have passed comprehensive consumer privacy laws, and 19 are in force as of November 2026. The Future of Privacy Forum's effective dates chart lists the dates below. Florida's Digital Bill of Rights is left out because it applies only to a narrow set of businesses.

| State | Law | In force |
| --- | --- | --- |
| California | California Consumer Privacy Act, as amended by the California Privacy Rights Act | January 1, 2020 (CPRA amendments January 1, 2023) |
| Virginia | Consumer Data Protection Act | January 1, 2023 |
| Colorado | Colorado Privacy Act | July 1, 2023 |
| Connecticut | Connecticut Data Privacy Act | July 1, 2023 |
| Utah | Utah Consumer Privacy Act | December 31, 2023 |
| Oregon | Oregon Consumer Privacy Act | July 1, 2024 |
| Texas | Texas Data Privacy and Security Act | July 1, 2024 |
| Montana | Montana Consumer Data Privacy Act | October 1, 2024 |
| Delaware | Delaware Personal Data Privacy Act | January 1, 2025 |
| Iowa | Iowa Consumer Data Protection Act (SF 262) | January 1, 2025 |
| Nebraska | Nebraska Data Privacy Act | January 1, 2025 |
| New Hampshire | SB 255 | January 1, 2025 |
| New Jersey | New Jersey Data Privacy Act (S332) | January 15, 2025 |
| Tennessee | Tennessee Information Protection Act | July 1, 2025 |
| Minnesota | Minnesota Consumer Data Privacy Act | July 31, 2025 |
| Maryland | Maryland Online Data Privacy Act | October 1, 2025 |
| Indiana | Indiana Consumer Data Protection Act | January 1, 2026 |
| Kentucky | Kentucky Consumer Data Protection Act | January 1, 2026 |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act | January 1, 2026 |
| Oklahoma | SB 546, signed March 20, 2026 | January 1, 2027 |
| Louisiana | Louisiana Data Privacy Act (SB 386), signed May 29, 2026 | January 1, 2027 |
| Alabama | Alabama Personal Data Protection Act (HB 351), signed April 16, 2026 | May 1, 2027 |
| Vermont | Vermont Data Privacy and Online Surveillance Act (S.71), signed June 16, 2026 | January 1, 2028 |

Counts of 24 states, such as MultiState's, include Florida. State attorneys general enforce these laws, and California also has a dedicated regulator, the California Privacy Protection Agency. Our [US seller guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-united-states) and [California seller guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-in-california) go further on the state rules.

## What do US state privacy laws mean for AI training data?

US state privacy laws mostly regulate AI training data through three rules: the definition of a sale, consent for sensitive data and the exclusion for deidentified data.

- Sale: the CCPA treats a transfer of personal information for monetary or other valuable consideration as a sale, so a paid license of identifiable customer records triggers opt-out and notice duties
- Sensitive data: Vermont's law requires prior consent to process sensitive data and consent to process data for a material new purpose, according to Mayer Brown, and other states set their own consent rules
- Deidentified data: in California, data that meets the deidentified standard falls outside the definition of personal information. The test in Civil Code section 1798.140(m) needs reasonable technical measures, a public commitment not to re-identify and contracts binding every recipient
- Training data disclosure: California's AB 2013, in force since January 1, 2026, requires developers of public generative AI systems to post a summary of training datasets, including whether they contain personal information as defined by the CCPA, according to Crowell and Moring

Illinois adds the Biometric Information Privacy Act for faces, voices and other biometric identifiers, and Washington's My Health My Data Act covers consumer health data. Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) explains how to meet the deidentified standards in practice.

## How do privacy laws for AI training compare by country?

Privacy laws for AI training differ most on lawful basis and transfers, and agree more on anonymization. The table compares 17 jurisdictions, with the main AI-training guidance linked in the last column.

| Jurisdiction | Main law and regulator | Lawful basis for training | Anonymization standard | Cross-border rules | Key AI-training guidance |
| --- | --- | --- | --- | --- | --- |
| United States (federal) | FTC Act, sector laws, FTC | No general lawful-basis rule. Privacy promises must be kept | No general standard, sector rules such as HIPAA apply | DOJ Data Security Program limits bulk sensitive data to countries of concern | [FTC staff, February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) |
| California | CCPA, California Privacy Protection Agency and Attorney General | Notice at collection and purpose limits. A paid transfer is a sale | Deidentified under Civil Code section 1798.140(m) | No transfer restriction | [CCPA, Attorney General](https://oag.ca.gov/privacy/ccpa) |
| United Kingdom | UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, ICO | Legitimate interests is "the sole available lawful basis" for training on web-scraped data, per the ICO | Effectively anonymized, judged by means reasonably likely to be used | Chapter V of the UK GDPR | [ICO consultation response, December 2024](https://ico.org.uk/media/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai-0-0.pdf) |
| European Union | GDPR, national DPAs and the EDPB | Legitimate interest possible with a three-step test, per the EDPB | Recital 26. A model is anonymous only if extraction of personal data is insignificant | Chapter V. The EU-US Data Privacy Framework was upheld by the General Court on September 3, 2025 | [EDPB Opinion 28/2024](https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en) |
| Ireland | GDPR and Data Protection Act 2018, Data Protection Commission | Legitimate interest, with objection rights and safeguards, in the Meta review | GDPR Recital 26 | GDPR Chapter V | [DPC statement on Meta AI, May 21, 2025](https://www.dataprotection.ie/news-media/latest-news/dpc-statement-meta-ai) |
| Germany | GDPR and BDSG, BfDI and state DPAs, coordinated by the DSK | GDPR Article 6, assessed case by case | GDPR Recital 26 | GDPR Chapter V | [DSK guidance on AI and data protection, May 6, 2024](https://datenschutzkonferenz-online.de/media/pm/2024_05_06_DSK_PM_OH_KI_und_Datenschutz.pdf) |
| France | GDPR and Loi Informatique et Libertés, CNIL | Legitimate interest without consent, with safeguards, per the CNIL | GDPR Recital 26 | GDPR Chapter V | [CNIL recommendations, June 19, 2025](https://cnil.fr/fr/recommandations-developpement-ia-interet-legitime) |
| Netherlands | GDPR and UAVG, Autoriteit Persoonsgegevens | GDPR Article 6. The AP says scraping is illegal in most contexts | GDPR Recital 26 | GDPR Chapter V | [Autoriteit Persoonsgegevens](https://www.autoriteitpersoonsgegevens.nl) |
| Italy | GDPR, Privacy Code and Law No. 132/2025 on AI, Garante | GDPR Article 6. The Garante fined OpenAI €15 million in 2024 for training without an adequate legal basis, and the Rome Tribunal upheld OpenAI's appeal in March 2026 | GDPR Recital 26 | GDPR Chapter V | [Garante, December 20, 2024](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432) |
| Canada | PIPEDA, Office of the Privacy Commissioner of Canada | Documented legal authority, usually meaningful consent | Not about an identifiable individual: no "serious possibility" of identification | Accountability for transfers to processors | [OPC generative AI principles, December 7, 2023](https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/) |
| Australia | Privacy Act 1988, OAIC | Secondary use needs consent or reasonable expectation under APP 6 | De-identified: no longer about a reasonably identifiable individual | APP 8 reasonable steps, and section 16C accountability | [OAIC guidance, October 21, 2024](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-developing-and-training-generative-ai-models) |
| India | Digital Personal Data Protection Act 2023 and DPDP Rules 2025, Data Protection Board of India | Consent or a listed legitimate use under section 7. Data made public by the person is outside the Act | No statutory definition | Section 16 lets the government restrict transfers to listed countries | [DPDP Act 2023](https://www.indiacode.nic.in/bitstream/123456789/22037/2/a2023-22.pdf) |
| Singapore | Personal Data Protection Act 2012, PDPC | Consent, or the business improvement or research exceptions | No serious possibility of re-identification | Transfer limitation obligation | [PDPC advisory guidelines, March 1, 2024](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf) |
| Japan | Act on the Protection of Personal Information, Personal Information Protection Commission | Use within the stated purpose of use. Consent to obtain special care-required information | Anonymously processed information and pseudonymously processed information | Consent, an adequate country or an equivalent system | [PPC alerts on generative AI, June 2023](https://www.ppc.go.jp/news/careful_information/230602_AI_utilize_alert/) |
| South Korea | Personal Information Protection Act, PIPC | Existing bases, plus an AI development amendment passed on August 20, 2026 that takes effect six months after promulgation | Pseudonymized and anonymized information | Consent or another listed transfer ground | [PIPC, August 2026](https://www.pipc.go.kr/eng/user/ltn/new/noticeDetail.do?nttId=3171) |
| Brazil | LGPD, ANPD | Legitimate interest must respect users' expectations, per the ANPD's 2024 Meta order | Anonymized data is not personal data | Adequacy or ANPD standard contractual clauses | [ANPD, July 2, 2024](https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-determina-suspensao-cautelar-do-tratamento-de-dados-pessoais-para-treinamento-da-ia-da-meta) |
| China | Personal Information Protection Law, Cyberspace Administration of China | Consent or another legal ground under Article 7 of the generative AI measures | Anonymized information is not personal information | Security assessment, certification or standard contract | [Interim Measures for generative AI services, in force August 15, 2023](https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm) |

## What do European regulators say about AI training data?

European regulators say AI training on personal data can be lawful under legitimate interests, but only after a documented balancing test, real transparency and an easy way to object. The [EDPB's Opinion 28/2024](https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en), adopted on December 18, 2024 at the request of the Irish authority, sets the common approach.

National regulators have applied it. Ireland's Data Protection Commission said on May 21, 2025 that Meta had added updated notices, a simpler objection form, de-identification and output filters before training on adults' public posts from May 27, 2025. France's CNIL said on June 19, 2025 that AI development "does not always require" consent, while listing safeguards such as excluding certain data from collection.

The UK went the same way. The [ICO's December 2024 consultation response](https://ico.org.uk/media/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai-0-0.pdf) says developers relying on legitimate interests must show why other sources, such as licensed datasets from publishers, will not work. That makes properly licensed company data a stronger position for a buyer than scraped data. Our [UK seller guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-united-kingdom) covers the UK rules in more detail.

> **Italy's OpenAI decision** The Garante fined OpenAI €15 million on December 20, 2024, partly for processing users' data to train ChatGPT without first identifying an adequate legal basis. The Garante's own page now says the decision was removed after the Rome Tribunal upheld OpenAI's appeal in judgment No. 4153/2026, published March 18, 2026.

## What do regulators outside Europe say about AI training data?

Regulators outside Europe mostly start from consent or reasonable expectations, which makes reusing customer records for training harder than in the EU.

- Canada: the OPC's December 7, 2023 principles say organizations should "Know and document their legal authority" across the AI lifecycle and that public accessibility "does not mean that it can be indiscriminately collected or used"
- Australia: the OAIC's October 21, 2024 guidance says training is usually a secondary use under APP 6, that a privacy policy update alone generally will not change expectations for data collected earlier, and recommends consent or a meaningful opt-out where the tests are not clearly met
- Singapore: the PDPC's March 1, 2024 guidelines allow the business improvement and research exceptions, and encourage anonymizing datasets "as far as possible instead of using personal data"
- South Korea: the PIPC announced that the National Assembly passed a PIPA amendment on August 20, 2026 allowing lawfully collected data to be used for AI development where pseudonymized or anonymized data is not enough, with enhanced safeguards
- Brazil: the ANPD ordered Meta on July 2, 2024 to suspend a privacy policy allowing AI training, finding preliminarily that users did not expect old posts to train AI, with a daily fine of R$50,000 for noncompliance
- China: Article 7 of the Interim Measures for generative AI services requires lawful sources and, where personal information is involved, consent or another legal ground

India's Digital Personal Data Protection Rules 2025 were notified in November 2025 with a phased rollout of 12 to 18 months, so most duties are still being phased in. Our [Canada](https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-canada) and [Australia](https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-australia) seller guides go further for those markets.

## What does this mean for a company licensing its own records?

For a company licensing its own records, the safest position in almost every jurisdiction is to remove personal data or de-identify it to the local standard before any buyer sees it. Where personal data must stay in, you need a lawful basis that covers the new use and a privacy notice that supports it.

1. **Map where data subjects live**: The law that applies usually follows the people in the records, not where your servers are.
2. **Check the notice in force at collection**: Compare what you told people with AI training. The FTC, the ICO and the OAIC all look at what people were told and could expect.
3. **Choose exclude, de-identify or keep**: Exclude sensitive and HR data, de-identify to the strictest standard that applies and document the method.
4. **Check the transfer route**: Identify where the buyer will store the data and which transfer mechanism, if any, the law requires.
5. **Write it into the license**: Set use limits, a ban on re-identification and onward transfer limits, as in our [licensing agreement checklist](https://sellmydatatoai.net/guides/ai-data-licensing-agreement-checklist).

Privacy notice and lawful basis is one of the eight checks in our [seller vetting standard](https://sellmydatatoai.net/how-we-vet), and de-identification method is another. If you want to know which of your records can be licensed and where, [request a free data valuation](https://sellmydatatoai.net/data-valuation). Sellers pay nothing to be assessed.

## Frequently asked questions

### Does the US have a federal law on AI training data privacy?

No. The US has no comprehensive federal privacy law. The FTC enforces privacy promises under Section 5 of the FTC Act, sector laws such as COPPA, HIPAA and GLBA cover specific data, and the DOJ Data Security Program has restricted bulk sensitive data transfers to countries of concern since April 8, 2025. Most rules for training data come from state laws.

### How many US states have comprehensive privacy laws?

24 states have passed comprehensive privacy laws if Florida's narrow law is counted, and 23 without it. 19 of those 23 are in force as of November 2026. Oklahoma, Louisiana, Alabama and Vermont passed laws in 2026 that take effect between January 1, 2027 and January 1, 2028, according to Perkins Coie, Covington and Mayer Brown.

### Can you train AI on personal data under the GDPR without consent?

Possibly. The EDPB's Opinion 28/2024 says legitimate interest can be a legal basis for developing AI models if a three-step test is met and documented. France's CNIL said in June 2025 that consent is not always required. The controller must still be transparent, offer a way to object and apply safeguards, so take advice for your data.

### Is anonymized data covered by privacy laws?

Properly anonymized data is outside most privacy laws, including the GDPR, UK GDPR, LGPD and PIPL, and US state laws exclude deidentified data. The standards differ. The EU and UK ask whether identification is reasonably likely, Canada and Singapore use a serious possibility test and California requires technical measures, a public commitment and contracts with recipients.

### Which countries restrict transferring training data abroad?

The EU, UK, Australia, Singapore, Japan, South Korea, Brazil and China all restrict transfers of personal data abroad, through adequacy decisions, contracts or assessments. India's DPDP Act lets the government block transfers to listed countries. The US restricts bulk sensitive personal data going to countries of concern under the DOJ Data Security Program.

### Did the OpenAI fine in Italy stand?

No. The Garante fined OpenAI €15 million on December 20, 2024, partly for training ChatGPT without an adequate legal basis. The Garante's website says the decision was removed after the Rome Tribunal upheld OpenAI's appeal in judgment No. 4153/2026, published March 18, 2026. The ruling shows that regulator positions on AI training can still change in court.

## Sources

- [AI (and other) companies: quietly changing your terms of service could be unfair or deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [FTC finalizes changes to children's privacy rule limiting companies' ability to monetize kids' data](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data), Federal Trade Commission, accessed November 2026
- [Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), Federal Trade Commission, accessed November 2026
- [Data Security](https://www.justice.gov/nsd/data-security), US Department of Justice, National Security Division, accessed November 2026
- [Effective dates chart, US state comprehensive privacy laws](https://fpf.org/wp-content/uploads/2025/07/FPF-Effective-Dates-Chart-v1.7.pdf), Future of Privacy Forum, accessed November 2026
- [Oklahoma and Alabama headline a busy spring for privacy legislation](https://perkinscoie.com/insights/blog/oklahoma-and-alabama-headline-busy-spring-privacy-legislation), Perkins Coie, accessed November 2026
- [Louisiana enacts comprehensive privacy law](https://www.insideprivacy.com/state-privacy/louisiana-enacts-comprehensive-privacy-law/), Covington and Burling (Inside Privacy), accessed November 2026
- [Vermont enacts comprehensive consumer privacy law](https://www.mayerbrown.com/en/insights/publications/2026/06/vermont-enacts-comprehensive-consumer-privacy-law), Mayer Brown, accessed November 2026
- [California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa), State of California Department of Justice, Office of the Attorney General, accessed November 2026
- [California Civil Code section 1798.140 (definitions)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), California Legislative Information, accessed November 2026
- [California's AB 2013 requires generative AI data disclosure by January 1, 2026](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026), Crowell and Moring, accessed November 2026
- [Response to the consultation series on generative AI](https://ico.org.uk/media/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai-0-0.pdf), Information Commissioner's Office, accessed November 2026
- [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en), European Data Protection Board, accessed November 2026
- [Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/), Information Commissioner's Office, accessed November 2026
- [EU-US Data Privacy Framework survives legal challenge: what the Latombe decision means for international data transfers](https://cm.twobirds.com/en/insights/2025/euus-data-privacy-framework-survives-legal-challenge-what-the-latombe-decision-means-for-internation), Bird and Bird, accessed November 2026
- [DPC statement on Meta AI](https://www.dataprotection.ie/news-media/latest-news/dpc-statement-meta-ai), Data Protection Commission, accessed November 2026
- [Künstliche Intelligenz und Datenschutz (press release on the DSK guidance)](https://datenschutzkonferenz-online.de/media/pm/2024_05_06_DSK_PM_OH_KI_und_Datenschutz.pdf), Datenschutzkonferenz, accessed November 2026
- [Développement des systèmes d'IA : la CNIL publie ses recommandations sur l'intérêt légitime](https://cnil.fr/fr/recommandations-developpement-ia-interet-legitime), CNIL, accessed November 2026
- [Netherlands DPA issues guidance against web scraping](https://iapp.org/news/a/netherlands-dpa-issues-guidance-against-web-scraping), IAPP, accessed November 2026
- [ChatGPT, il Garante privacy chiude l'istruttoria](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432), Garante per la protezione dei dati personali, accessed November 2026
- [Principles for responsible, trustworthy and privacy-protective generative AI technologies](https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/), Office of the Privacy Commissioner of Canada, accessed November 2026
- [Interpretation bulletin: personal information](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_02/), Office of the Privacy Commissioner of Canada, accessed November 2026
- [Guidance on privacy and developing and training generative AI models](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-developing-and-training-generative-ai-models), Office of the Australian Information Commissioner, accessed November 2026
- [Chapter 8: APP 8 cross-border disclosure of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information), Office of the Australian Information Commissioner, accessed November 2026
- [The Digital Personal Data Protection Act, 2023](https://www.indiacode.nic.in/bitstream/123456789/22037/2/a2023-22.pdf), India Code, Government of India, accessed November 2026
- [Govt notifies Digital Personal Data Protection Rules 2025, rollout stretched over 18 months](https://yourstory.com/2025/11/digital-personal-data-protection-dpdp-rules-2025-rollout-over-18-months), YourStory, accessed November 2026
- [Twenty-four states now have comprehensive consumer privacy laws](https://www.multistate.us/insider/2026/10/28/twenty-four-states-now-have-comprehensive-consumer-privacy-laws), MultiState, accessed November 2026
- [Advisory guidelines on the use of personal data in AI recommendation and decision systems](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf), Personal Data Protection Commission Singapore, accessed November 2026
- [Alerts and other notices regarding the use of generative AI services](https://www.ppc.go.jp/news/careful_information/230602_AI_utilize_alert/), Personal Information Protection Commission, Japan, accessed November 2026
- [The PIPA amendment bill for AI development passed at the National Assembly plenary meeting](https://www.pipc.go.kr/eng/user/ltn/new/noticeDetail.do?nttId=3171), Personal Information Protection Commission, Korea, accessed November 2026
- [ANPD determina suspensão cautelar do tratamento de dados pessoais para treinamento da IA da Meta](https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-determina-suspensao-cautelar-do-tratamento-de-dados-pessoais-para-treinamento-da-ia-da-meta), Autoridade Nacional de Proteção de Dados, accessed November 2026
- [生成式人工智能服务管理暂行办法 (Interim Measures for the Management of Generative Artificial Intelligence Services)](https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm), Cyberspace Administration of China, accessed November 2026
- [Personal Information Protection Law of the People's Republic of China](http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559.htm), National People's Congress of the People's Republic of China, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation