Know what is on your site before a plaintiff’s firm does.Free website scanScan Your Site
Log in Sign up Book a demo

Global privacy regulations

Every privacy regulation that matters.

Practical guides to the laws that govern how websites collect, use and share personal data — written for the people who have to implement them. Each guide covers who is in scope, what the law requires in practice, and how Captain Compliance turns those requirements into technical controls and documented evidence.

Explore RegulationsTalk to a Privacy Expert

Jurisdictions covered

EuropeGDPR · UK GDPR · ePrivacy · EU AI Act
United StatesCCPA · CPRA · state laws · CIPA
Canada & LatAmPIPEDA · Law 25 · LGPD
Asia-PacificDPDP · PIPL · APPI · PDPA
Middle East & AfricaPDPL · POPIA

Guides below link to published Captain Compliance resources.

Regulation library

Find the law that applies to you.

Showing all 21 guides

GDPREuropean UnionGeneral Data Protection RegulationEurope’s comprehensive privacy law governing how personal data is collected, used and transferred.Comprehensive PrivacyView guide →UK GDPRUnited KingdomUK General Data Protection RegulationThe United Kingdom’s retained version of the GDPR, operating alongside the Data Protection Act.Comprehensive PrivacyView guide →ePrivacyEuropean UnionePrivacy DirectiveThe directive behind EU cookie consent requirements and rules on electronic communications.Consent & CookiesView guide →EU AI ActEuropean UnionArtificial Intelligence ActRisk-based obligations for providers and deployers of AI systems placed on the EU market.AI & Automated DecisionsView guide →CCPACalifornia, USACalifornia Consumer Privacy ActCalifornia’s consumer privacy law covering access, deletion and opt-out rights.Consumer RightsView guide →CPRACalifornia, USACalifornia Privacy Rights ActThe amendment that expanded the CCPA and created the California Privacy Protection Agency.Comprehensive PrivacyView guide →CPAColorado, USAColorado Privacy ActColorado’s comprehensive privacy statute, including universal opt-out recognition.Comprehensive PrivacyView guide →VCDPAVirginia, USAVirginia Consumer Data Protection ActVirginia’s consumer privacy law covering rights, assessments and processing limits.Comprehensive PrivacyView guide →US State LawsUnited StatesState privacy patchworkHow the growing set of state privacy statutes differ, overlap and apply to your website.Comprehensive PrivacyView guide →CIPACalifornia, USACalifornia Invasion of Privacy ActA 1967 wiretapping statute now driving claims over pixels, chat tools and session replay.Website Privacy & LitigationView guide →ECPAUnited StatesElectronic Communications Privacy ActFederal interception law raised in claims about website tracking technologies.Website Privacy & LitigationView guide →VPPAUnited StatesVideo Privacy Protection ActA 1988 statute behind claims involving video viewing data shared with third parties.Website Privacy & LitigationView guide →PIPEDACanadaPersonal Information Protection and Electronic Documents ActCanada’s federal privacy law for personal information handled in commercial activity.Comprehensive PrivacyView guide →Law 25Quebec, CanadaQuebec Law 25Quebec’s modernized privacy regime, including consent and transparency duties.Comprehensive PrivacyView guide →LGPDBrazilLei Geral de Proteção de DadosBrazil’s general data protection law, closely modelled on the GDPR.Comprehensive PrivacyView guide →DPDPIndiaDigital Personal Data Protection ActIndia’s data protection act covering consent, notice and data fiduciary duties.Comprehensive PrivacyView guide →PIPLChinaPersonal Information Protection LawChina’s personal information law, including cross-border transfer requirements.Comprehensive PrivacyView guide →APPIJapanAct on the Protection of Personal InformationJapan’s personal information law and its rules on third-party provision.Comprehensive PrivacyView guide →PDPASingaporePersonal Data Protection ActSingapore’s data protection regime covering consent, purpose and notification.Comprehensive PrivacyView guide →PDPLSaudi ArabiaPersonal Data Protection LawSaudi Arabia’s personal data protection law and its localisation provisions.Comprehensive PrivacyView guide →POPIASouth AfricaProtection of Personal Information ActSouth Africa’s privacy act governing lawful processing and data subject rights.Comprehensive PrivacyView guide →

From law to control

A requirement is only met when something enforces it.

Reading the law is the first step. These are the stages where a written obligation becomes something running on your website — and something you can show evidence for later.

01
Discover
Find the cookies, pixels, SDKs and third-party requests actually running.
Cookie Scanner · Patrol
02
Control
Hold designated technologies until the required consent condition is met.
Consent Management · Preference Center
03
Explain
Keep notices and cookie disclosures aligned with what the scan found.
Hosted Privacy Notices · Cookie Transparency
04
Respond
Receive, route and fulfill data rights requests on deadline.
DSAR Portal · Universal Consent
05
Assess
Run the assessment the regulation calls for, with approvals recorded.
Privacy Assessments · DPIAs · AI Governance
06
Prove
Preserve consent records, scan history and enforcement activity.
Consent logs · Scan history · Reports

// Compliance Shield support is available for qualifying deployments under a separate written agreement.

Configuration

One privacy program. Different rules by region.

A visitor in California and a visitor in Germany should not necessarily see the same consent experience. Captain Compliance lets you vary the experience along the dimensions below while keeping one set of records, so you are not maintaining disconnected privacy programs per market.

JurisdictionRegulationLanguageWebsitePurposeBusiness unit

// Configuration options depend on your deployment. Captain Compliance does not guarantee compliance with every applicable law.

Already concerned about your website?

Find the cookies, pixels and trackers running right now — and which ones commonly appear in privacy claims.

Scan Your WebsiteRequest an Expert Review →

Questions

Global privacy law, answered plainly.

Which privacy laws apply to my website?

It depends on where your visitors are, what data you collect and how you use it — not on where your company is based. A business with no European office can still fall under the GDPR if it monitors or offers services to people in the EU. The guides above explain scope for each law, and a privacy specialist can help you narrow it down.

Are CIPA, ECPA and VPPA privacy laws?

Not comprehensive ones. They are older statutes — wiretapping, electronic interception and video privacy — now being applied to modern website technologies like pixels, chat tools and session replay. They create private rights of action, which is why they appear in litigation far more often than regulator enforcement.

Do I need separate consent banners for each country?

Not separate programs, no. You can configure different consent experiences by jurisdiction, language and purpose while keeping one set of records and one place to manage them. What differs is the experience a visitor sees, not the system behind it.

Does using Captain Compliance make us compliant?

No software makes an organization compliant on its own. Captain Compliance operationalizes the technical requirements — discovery, enforcement, disclosures, rights workflows, assessments and evidence — and our privacy specialists help with the judgment calls. Whether a specific obligation is met depends on your configuration, your practices and advice from qualified counsel.

How often do these guides change?

Privacy law moves constantly. Guides are reviewed as significant amendments, enforcement decisions and court rulings land. Each guide notes when it was last reviewed, and nothing here should be treated as legal advice.