[
  {
    "id": "law-001",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "",
    "law": "Children's Online Privacy Protection Rule (COPPA Rule), 16 CFR Part 312 (implementing COPPA, 15 U.S.C. 6501-6506)",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Operators of websites/online services directed to children, or with actual knowledge they collect personal information from a child",
    "status": "in_force",
    "effective_date": "2025-06-23",
    "source_url": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "§312.2: 'Child means an individual under the age of 13.' Verifiable parental consent required before collecting a child's personal information. Not an account ban. 2025 amendments (90 FR 16977, published 2025-04-22) effective 2025-06-23, general compliance date 2026-04-22 (https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule). FTC issued a COPPA age-verification policy statement in Feb 2026."
  },
  {
    "id": "law-002",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-AR",
    "law": "Social Media Safety Act, Act 689 (SB 396, 2023)",
    "rule_type": "parental_consent",
    "age": null,
    "applies_to": "Social media platforms: age verification and parental consent for minors' accounts",
    "status": "enjoined",
    "effective_date": "",
    "source_url": "https://arkleg.state.ar.us/Bills/Detail?id=SB396&ddBienniumSession=2023%2F2023R",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Act 689 of 2023. Reported permanently enjoined (NetChoice v. Griffin, W.D. Ark., Mar 2025). Age threshold and litigation status not confirmed on a primary page."
  },
  {
    "id": "law-003",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-AR",
    "law": "Act 900 of 2025 (amending Social Media Safety Act) and Act 901 of 2025",
    "rule_type": "design_code",
    "age": null,
    "applies_to": "Social media platforms: ban on 'addictive practices', default minor settings, overnight notification limits (Act 900); parental private right of action (Act 901)",
    "status": "enjoined",
    "effective_date": "",
    "source_url": "https://arkleg.state.ar.us/Acts/Document?type=pdf&act=900&ddBienniumSession=2025%2F2025R",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Act 901 preliminarily enjoined Dec 2025; Act 900 preliminarily enjoined Apr 2026 (W.D. Ark.) for NetChoice members; 8th Cir. No. 26-1962 pending. Age threshold and effective date unverified (PDF empty). Status from secondary sources. Age left blank: no single age threshold confirmed."
  },
  {
    "id": "law-004",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-CA",
    "law": "Protecting Our Kids from Social Media Addiction Act, SB 976 (2024)",
    "rule_type": "parental_consent",
    "age": 18,
    "applies_to": "Operators of addictive internet-based services: parental consent for minors' addictive feeds and for night/school-hour notifications; age assurance from 2027",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://oag.ca.gov/sb976",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Reported partly in force after the 9th Circuit largely upheld it (NetChoice v. Bonta, Sep 2025); some provisions remain enjoined; age-assurance duty from 2027. Dates and injunction scope not confirmed on a primary page."
  },
  {
    "id": "law-005",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-CA",
    "law": "Digital Age Assurance Act, AB 1043 (2025), Ch. 675, Stats. 2025",
    "rule_type": "age_assurance_duty",
    "age": 18,
    "applies_to": "Operating system providers and app stores: age input at device setup and age-bracket signal to developers",
    "status": "enacted_not_in_force",
    "effective_date": "2027-01-01",
    "source_url": "https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1043",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Approved 2025-10-13; operative 2027-01-01 (earlier devices until 2027-07-01). Details via leginfo search snippets."
  },
  {
    "id": "law-006",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-FL",
    "law": "CS/CS/HB 3 (2024), Ch. 2024-42, Laws of Florida (Online Protections for Minors; Fla. Stat. 501.1736)",
    "rule_type": "account_ban",
    "age": 14,
    "applies_to": "Social media platforms meeting addictive-feature criteria; under-14 accounts prohibited, 14-15 require parental consent",
    "status": "in_force",
    "effective_date": "2025-01-01",
    "source_url": "https://www.flsenate.gov/Session/Bill/2024/3",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Effective 1 Jan 2025 per flsenate.gov. A district-court preliminary injunction was stayed by the 11th Circuit in Nov 2025, so the law is enforceable; litigation status not confirmed on a court page."
  },
  {
    "id": "law-007",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-GA",
    "law": "Protecting Georgia's Children on Social Media Act of 2024, SB 351",
    "rule_type": "parental_consent",
    "age": 16,
    "applies_to": "Social media platforms: age verification and parental consent for account holders under 16",
    "status": "enjoined",
    "effective_date": "2025-07-01",
    "source_url": "https://law.georgia.gov/node/21766",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Georgia AG page confirms age verification, parental consent under 16, preliminary injunction 2025-06-26 and appeal. 11th Cir. argued (reported 2026-03-10), no decision found."
  },
  {
    "id": "law-008",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-LA",
    "law": "Secure Online Child Interaction and Age Limitation Act, Act 456 (SB 162, 2023), R.S. 51:1751-1760",
    "rule_type": "parental_consent",
    "age": null,
    "applies_to": "Social media companies: age verification, express parental consent for minor account holders, parental supervision tools",
    "status": "enjoined",
    "effective_date": "2024-07-01",
    "source_url": "https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1333673",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Effective 1 Jul 2024 per legis.la.gov digests. Age threshold not confirmed from the enrolled text. Reported permanently enjoined; appeal pending. Litigation status not confirmed on a court page."
  },
  {
    "id": "law-009",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-LA",
    "law": "Act 481 (HB 570, 2025), app store and developer duties regarding minors",
    "rule_type": "parental_consent",
    "age": 18,
    "applies_to": "App store providers and developers: age-category verification, linked parent accounts, parental consent for downloads/purchases",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.legis.la.gov/legis/ViewDocument.aspx?d=1427667",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Enrolled Act defines a minor as under 18. Effective date not confirmed on a primary page."
  },
  {
    "id": "law-010",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-MS",
    "law": "Walker Montgomery Protecting Children Online Act, HB 1126 (2024)",
    "rule_type": "parental_consent",
    "age": null,
    "applies_to": "Digital service providers allowing social interaction/posting: age verification, parental consent for minors, harmful-content mitigation",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://billstatus.ls.state.ms.us/2024/pdf/history/HB/HB1126.xml",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Approved 30 Apr 2024. Reported enforceable after the 5th Circuit stayed an injunction (Jul 2025) and the Supreme Court denied vacatur (Aug 2025). Age threshold and litigation status not confirmed on a primary page."
  },
  {
    "id": "law-011",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-NE",
    "law": "Parental Rights in Social Media Act, LB 383 (2025)",
    "rule_type": "parental_consent",
    "age": null,
    "applies_to": "Social media companies: age verification, parental consent for minors' accounts, parental monitoring tools",
    "status": "enjoined",
    "effective_date": "",
    "source_url": "https://nebraskalegislature.gov/bills/search_by_number.php?DocumentNumber=LB383",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Reported partially enjoined (D. Neb., June 2026): age-verification and parental-consent duties blocked. Age threshold, dates and status not confirmed on a primary page."
  },
  {
    "id": "law-012",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-OH",
    "law": "Social Media Parental Notification Act, Ohio Rev. Code 1349.09 (enacted in HB 33, 2023)",
    "rule_type": "parental_consent",
    "age": null,
    "applies_to": "Online services/games/sites targeting or likely accessed by children: verifiable parental consent before under-16s contract or create accounts",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://codes.ohio.gov/ohio-revised-code/section-1349.09",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Reported enforceable after the 6th Circuit reversed a permanent injunction on 18 Jun 2026. The Ohio code site was not reachable for this check, so age and dates are not confirmed."
  },
  {
    "id": "law-013",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-TN",
    "law": "Protecting Children from Social Media Act, HB 1891 (2024), Public Chapter 899",
    "rule_type": "parental_consent",
    "age": null,
    "applies_to": "Social media companies: age verification, parental consent for minors' accounts, supervision tools",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.tn.gov/attorneygeneral/news/2026/2/4/pr26-7.html",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "TN Attorney General page (4 Feb 2026) describes the duties and the 6th Circuit appeal. Age threshold, effective date and post-Aug 2026 status not confirmed on a primary page."
  },
  {
    "id": "law-014",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-TX",
    "law": "Securing Children Online through Parental Empowerment (SCOPE) Act, HB 18 (88R, 2023)",
    "rule_type": "design_code",
    "age": 18,
    "applies_to": "Digital service providers enabling socializing/posting: age registration, parental verification and tools, limits on minors' data and targeted ads, harmful-content filtering",
    "status": "in_force",
    "effective_date": "2024-09-01",
    "source_url": "https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB18",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Signed 06/13/2023 (capitol.texas.gov). Only partly in force: W.D. Tex. enjoined some provisions incl. content monitoring/filtering (CCIA v. Paxton; SEAT v. Paxton, 2024). Injunction scope from secondary sources."
  },
  {
    "id": "law-015",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-TX",
    "law": "App Store Accountability Act, SB 2420 (89R, 2025)",
    "rule_type": "parental_consent",
    "age": 18,
    "applies_to": "Mobile app stores and developers: age verification and parental consent for minors' downloads and purchases",
    "status": "in_force",
    "effective_date": "2026-01-01",
    "source_url": "https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Signed 05/27/2025, effective 1/1/26 (capitol.texas.gov). W.D. Tex. PI 2025-12-23; 5th Cir. stayed it in 2026 (date reported inconsistently) and SCOTUS denied application to vacate stay (No. 25A1390). Appeal pending. Status from secondary sources + supremecourt.gov docket listing."
  },
  {
    "id": "law-016",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-UT",
    "law": "Utah Minor Protection in Social Media Act, SB 194 (2024), with HB 464 (2024)",
    "rule_type": "age_assurance_duty",
    "age": 18,
    "applies_to": "Social media companies: age assurance, default privacy for minors, parental consent to change settings, autoplay/infinite scroll limits; HB 464 private right of action",
    "status": "enjoined",
    "effective_date": "",
    "source_url": "https://le.utah.gov/~2024/bills/static/SB0194.html",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Signed 13 Mar 2024. Preliminarily enjoined (NetChoice v. Reyes, D. Utah, Sep 2024); appeal pending. Litigation status not confirmed on a court page."
  },
  {
    "id": "law-017",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-UT",
    "law": "App Store Accountability Act, SB 142 (2025)",
    "rule_type": "parental_consent",
    "age": 18,
    "applies_to": "App store providers and developers: account age verification, parental consent before minors download/buy apps",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://le.utah.gov/~2025/bills/static/SB0142.html",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Signed 26 Mar 2025. Effective dates and absence of an injunction not confirmed on a primary page."
  },
  {
    "id": "law-018",
    "jurisdiction": "United States",
    "iso2": "US",
    "subdivision": "US-VA",
    "law": "SB 854 (2025), Va. Code § 59.1-577.1 (Consumer Data Protection Act amendment)",
    "rule_type": "design_code",
    "age": 16,
    "applies_to": "Social media platforms: age determination, default 1 hour/day limit for under-16s, changeable only with verifiable parental consent",
    "status": "enjoined",
    "effective_date": "2026-01-01",
    "source_url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577.1/",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "LIS code: minor = under 16, effective 2026-01-01. E.D. Va. preliminary injunction Feb 2026 (NetChoice); AG appealed to 4th Cir. Injunction status from secondary sources."
  },
  {
    "id": "law-019",
    "jurisdiction": "United Kingdom",
    "iso2": "GB",
    "subdivision": "",
    "law": "UK GDPR Article 8(1) (as amended by DPA 2018 / S.I. 2019/419); formerly Data Protection Act 2018 s.9",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (UK GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/8",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "legislation.gov.uk: UK GDPR art 8(1) reads 'at least 13 years old'. DPA 2018 s.9 omitted from 31.12.2020 (age moved into UK GDPR text). New art 8(2A) lets the Secretary of State change the age by regulations; no change made. Not an EU/EEA state."
  },
  {
    "id": "law-020",
    "jurisdiction": "United Kingdom",
    "iso2": "GB",
    "subdivision": "",
    "law": "Age appropriate design: a code of practice for online services (ICO Children's code), issued under Data Protection Act 2018 s.123",
    "rule_type": "design_code",
    "age": 18,
    "applies_to": "Information society services likely to be accessed by children under 18 (apps, games, social media, connected toys, etc.)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "15 standards (best interests, high-privacy defaults, nudge techniques, profiling, etc.). The ICO says the code 'is not a new law'; it does not set a minimum age for using a service. In-force dates were not re-checked for this release."
  },
  {
    "id": "law-021",
    "jurisdiction": "United Kingdom",
    "iso2": "GB",
    "subdivision": "",
    "law": "Online Safety Act 2023 (c. 50) — protection of children duties (Part 3) and Ofcom Protection of Children Codes",
    "rule_type": "age_assurance_duty",
    "age": 18,
    "applies_to": "User-to-user and search services likely to be accessed by children; highly effective age assurance for pornography and primary priority harmful content",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.legislation.gov.uk/ukpga/2023/50",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "No statutory minimum age. GOV.UK explainer: the Act requires social media companies to enforce their own age limits consistently. Child safety duties apply since summer 2025 (GOV.UK says the Act was fully in effect by summer 2025); exact commencement date not re-checked."
  },
  {
    "id": "law-022",
    "jurisdiction": "United Kingdom",
    "iso2": "GB",
    "subdivision": "",
    "law": "Planned regulations restricting social media services for under-16s (powers under Children's Wellbeing and Schools Act 2026) — 'Growing up in the online world' government response, July 2026",
    "rule_type": "account_ban",
    "age": 16,
    "applies_to": "Social media services offering services to under-16s; further rules on harmful functions in gaming etc., default restrictions for 16-17",
    "status": "proposed",
    "effective_date": "",
    "source_url": "https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Government response (July 2026): intends to lay first regulations before Parliament by end of 2026, with restrictions on social media services for under-16s expected to enter into force spring 2027. Not yet law as of 2026-10-14."
  },
  {
    "id": "law-023",
    "jurisdiction": "European Union",
    "iso2": "EU",
    "subdivision": "",
    "law": "Regulation (EU) 2016/679 (GDPR) art. 8",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child; Member States may lower to 13-16",
    "status": "in_force",
    "effective_date": "2018-05-25",
    "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Default 16; national ages vary (e.g. ES 14, IT 14)."
  },
  {
    "id": "law-024",
    "jurisdiction": "European Union",
    "iso2": "EU",
    "subdivision": "",
    "law": "Regulation (EU) 2022/2065 (Digital Services Act) art. 28 — Commission Guidelines on the protection of minors",
    "rule_type": "age_assurance_duty",
    "age": null,
    "applies_to": "Online platforms accessible to minors: proportionate measures incl. age assurance, privacy/safety by design",
    "status": "in_force",
    "effective_date": "2025-07-14",
    "source_url": "https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Guidelines published 14 Jul 2025. They set no single minimum age (age is blank on purpose); Art. 28 itself applies since 17 Feb 2024."
  },
  {
    "id": "law-025",
    "jurisdiction": "European Union",
    "iso2": "EU",
    "subdivision": "",
    "law": "Proposal for a Regulation — EU KIDS Act",
    "rule_type": "account_ban",
    "age": 13,
    "applies_to": "Social media: under 13 no access; 13 to under 15 parent-managed 'mini account' (limited features, 1 h/day); 15+ own account; safety-by-design duties",
    "status": "proposed",
    "effective_date": "",
    "source_url": "https://commission.europa.eu/news-and-media/news/eu-kids-act-helping-children-navigate-safer-online-world-2026-09-17_en",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Commission proposal of 17 Sep 2026: no social media access under 13; parent-managed accounts from 13 to under 15. Needs adoption by Parliament and Council."
  },
  {
    "id": "law-026",
    "jurisdiction": "Australia",
    "iso2": "AU",
    "subdivision": "",
    "law": "Online Safety Amendment (Social Media Minimum Age) Act 2024 (Part 4A of the Online Safety Act 2021)",
    "rule_type": "account_ban",
    "age": 16,
    "applies_to": "Age-restricted social media platforms; eSafety assessed as restricted: Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X, YouTube. Assessed not restricted: Discord, GitHub, Google Classroom, LEGO Play, Messenger, Pinterest, Roblox, Steam/Steam Chat, WhatsApp, YouTube Kids",
    "status": "in_force",
    "effective_date": "2025-12-10",
    "source_url": "https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/which-platforms-are-age-restricted",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Platforms must take reasonable steps to prevent Australians under 16 from having accounts; no parental-consent exception. eSafety's 21 Nov 2025 list (page updated 16 Sep 2026): restricted - Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X, YouTube; not restricted - Discord, GitHub, Google Classroom, LEGO Play, Messenger, Pinterest, Roblox, Steam, WhatsApp, YouTube Kids. Act text: https://www.legislation.gov.au/C2024A00127"
  },
  {
    "id": "law-027",
    "jurisdiction": "Austria",
    "iso2": "AT",
    "subdivision": "",
    "law": "Datenschutzgesetz (DSG) § 4 Abs. 4",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Consolidated text (RIS) read 2026-10-14: consent lawful if child 'das vierzehnte Lebensjahr vollendet hat'."
  },
  {
    "id": "law-028",
    "jurisdiction": "Belgium",
    "iso2": "BE",
    "subdivision": "",
    "law": "Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel, art. 7",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.ejustice.just.fgov.be/cgi_loi/change_lg.pl?language=fr&la=F&cn=2018073046&table_name=loi",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Consolidated text on eJustice (Moniteur belge): consent valid from 13; under 13 legal representative consents."
  },
  {
    "id": "law-029",
    "jurisdiction": "Brazil",
    "iso2": "BR",
    "subdivision": "",
    "law": "Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente — ECA Digital)",
    "rule_type": "parental_consent",
    "age": 16,
    "applies_to": "Digital products/services directed at or likely accessed by children and adolescents; social networks (art. 24)",
    "status": "in_force",
    "effective_date": "2026-03-17",
    "source_url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/lei/L15211.htm",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Art. 24: accounts of children and adolescents 'de até 16 anos' must be linked to a legal guardian's account; services improper for minors must restrict and verify; suspension where account appears operated below minimum age; ban on behavioural profiling of minors for ads (art. 26). Art. 41-A (Lei 15.352/2026): in force 17 Mar 2026. Not an outright ban."
  },
  {
    "id": "law-030",
    "jurisdiction": "Bulgaria",
    "iso2": "BG",
    "subdivision": "",
    "law": "Закон за защита на личните данни (Personal Data Protection Act), чл. 25в (new, SG No. 17/2019)",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://cpdp.bg/%D0%BF%D1%80%D0%B0%D0%B2%D0%BD%D0%B0-%D1%80%D0%B0%D0%BC%D0%BA%D0%B0-%D0%BD%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%B0%D0%BB%D0%BD%D0%B0/%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD-%D0%B7%D0%B0-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B0-%D0%BD%D0%B0-%D0%BB%D0%B8%D1%87%D0%BD%D0%B8%D1%82%D0%B5-%D0%B4%D0%B0%D0%BD%D0%BD%D0%B8/",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Law text as published by the DPA (CPDP/KZLD): for a data subject under 14, consent (incl. direct offer of ISS) lawful only if given by parent/guardian. Text from CPDP site (2024 upload); Darzhaven vestnik itself not checked."
  },
  {
    "id": "law-031",
    "jurisdiction": "Canada",
    "iso2": "CA",
    "subdivision": "",
    "law": "Bill C-34, Safe Social Media Act (Digital Safety Act and Digital Safety Commission of Canada Act)",
    "rule_type": "account_ban",
    "age": 16,
    "applies_to": "Social media services, with regulator exemption pathway if safeguards shown; also AI chatbot duties and porn age checks",
    "status": "proposed",
    "effective_date": "",
    "source_url": "https://www.parl.ca/legisinfo/en/bill/45-1/c-34",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "LEGISinfo: first reading 10 Jun 2026, at second reading in the House of Commons. Under-16 content from canada.ca release (search index; fetch failed). No federal age law in force; PIPEDA has no fixed age."
  },
  {
    "id": "law-032",
    "jurisdiction": "Canada",
    "iso2": "CA",
    "subdivision": "CA-QC",
    "law": "Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), s. 4.1 and s. 14",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Personal information of a minor under 14 collected only with consent of person having parental authority or tutor (unless clearly for minor's benefit)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.legisquebec.gouv.qc.ca/en/document/cs/p-39.1",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "LégisQuébec returned 502/403; text via search index of the official page. Added by Law 25 (2021, c. 25); commencement date not verified."
  },
  {
    "id": "law-033",
    "jurisdiction": "China",
    "iso2": "CN",
    "subdivision": "",
    "law": "Personal Information Protection Law of the PRC, art. 31",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Processing personal information of minors under 14 requires parent/guardian consent and special rules",
    "status": "in_force",
    "effective_date": "2021-11-01",
    "source_url": "http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Content via search index of npc.gov.cn; page not fetched. Effective date 1 Nov 2021 not re-fetched."
  },
  {
    "id": "law-034",
    "jurisdiction": "China",
    "iso2": "CN",
    "subdivision": "",
    "law": "Regulations on the Protection of Minors Online (未成年人网络保护条例, State Council Order No. 766)",
    "rule_type": "design_code",
    "age": 18,
    "applies_to": "Online platforms, games, live-streaming, social networks: minor modes, anti-addiction, spending limits, real-identity checks for games",
    "status": "in_force",
    "effective_date": "2024-01-01",
    "source_url": "https://www.gov.cn/zhengce/content/202310/content_6911288.htm",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Promulgated 16 Oct 2023, effective 1 Jan 2024. No account minimum age; minor = under 18."
  },
  {
    "id": "law-035",
    "jurisdiction": "Croatia",
    "iso2": "HR",
    "subdivision": "",
    "law": "Zakon o provedbi Opće uredbe o zaštiti podataka (NN 42/2018), članak 19",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Official Gazette (Narodne novine) text: lawful if child at least 16; applies to children resident in Croatia. Croatia legislated explicitly at the GDPR default."
  },
  {
    "id": "law-036",
    "jurisdiction": "Cyprus",
    "iso2": "CY",
    "subdivision": "",
    "law": "Law 125(I)/2018 (as amended by 26(I)/2022), section 8",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.cylaw.org/nomoi/enop/non-ind/2018_1_125/full.html",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Consolidated text on CyLaw: lawful if child at least 14 (δεκατεσσάρων). CyLaw is the Cyprus Bar Association's legal portal (reproduces Official Gazette text; gazette PDF: http://www.cylaw.org/nomoi/arith/2018_1_125.pdf); not the government gazette site itself."
  },
  {
    "id": "law-037",
    "jurisdiction": "Czechia",
    "iso2": "CZ",
    "subdivision": "",
    "law": "Zákon č. 110/2019 Sb., o zpracování osobních údajů, § 7",
    "rule_type": "data_consent",
    "age": 15,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://e-sbirka.gov.cz/sb/2019/110",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "e-Sbírka current version (in force from 1.8.2025): capacity to consent acquired on reaching age 15."
  },
  {
    "id": "law-038",
    "jurisdiction": "Denmark",
    "iso2": "DK",
    "subdivision": "",
    "law": "Databeskyttelsesloven (lov nr. 502 af 23/05/2018) § 6, stk. 2-3, as amended by lov nr. 1783 af 28/12/2023",
    "rule_type": "data_consent",
    "age": 15,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.retsinformation.dk/eli/lta/2023/1783",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "CHANGED: was 13; amending Act No. 1783 (Lovtidende 29.12.2023) replaced '13 år' with '15 år' in § 6(2)-(3), in force 1 January 2024; consents given before then keep old rules. Many secondary sources still say 13."
  },
  {
    "id": "law-039",
    "jurisdiction": "Denmark",
    "iso2": "DK",
    "subdivision": "",
    "law": "Draft bill on a national age limit for social media (lovforslag om aldersgrænse på sociale medier)",
    "rule_type": "account_ban",
    "age": 15,
    "applies_to": "Social media platforms such as TikTok and Instagram; exact scope in consultation draft (not reviewed)",
    "status": "proposed",
    "effective_date": "2027-07-01",
    "source_url": "https://ufm.dk/aktuelt/pressemeddelelser/2026/september/nu-kommer-aldersgraense-regering-og-aftalepartier-saetter-haardt-ind-mod-sociale-medier/",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Ministry press release (Sept 2026): bill in public consultation, expected to take effect 1 July 2027 (planned date, not law). Reports that the Nov 2025 deal's parental-consent option from 13 was dropped are not confirmed on primary."
  },
  {
    "id": "law-040",
    "jurisdiction": "Estonia",
    "iso2": "EE",
    "subdivision": "",
    "law": "Isikuandmete kaitse seadus (IKS) § 8",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.riigiteataja.ee/akt/IKS",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Riigi Teataja current version (in force from 01.10.2026): lawful only if child at least 13."
  },
  {
    "id": "law-041",
    "jurisdiction": "Finland",
    "iso2": "FI",
    "subdivision": "",
    "law": "Tietosuojalaki (1050/2018) 5 §",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.finlex.fi/fi/lainsaadanto/2018/1050",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Finlex consolidated (opendata AKN) text: lawful if child at least 13 ('vähintään 13-vuotias')."
  },
  {
    "id": "law-042",
    "jurisdiction": "France",
    "iso2": "FR",
    "subdivision": "",
    "law": "Loi n° 78-17 du 6 janvier 1978 (Informatique et Libertés), article 45",
    "rule_type": "data_consent",
    "age": 15,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.legifrance.gouv.fr/loda/id/LEGITEXT000006068624",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Légifrance, version in force since 1 June 2019: a minor may consent alone from 15; under 15, consent must be given jointly by the minor and the parent(s)."
  },
  {
    "id": "law-043",
    "jurisdiction": "France",
    "iso2": "FR",
    "subdivision": "",
    "law": "Loi n° 2023-566 du 7 juillet 2023 visant à instaurer une majorité numérique et à lutter contre la haine en ligne",
    "rule_type": "parental_consent",
    "age": 15,
    "applies_to": "Online social network services (registration of under-15s requires parental authorisation)",
    "status": "enacted_not_in_force",
    "effective_date": "",
    "source_url": "https://www.senat.fr/dossier-legislatif/ppl22-389.html",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "Promulgated, JO of 8 Jul 2023. The platform obligation depended on an implementing decree that was not published, so the rule was never applied. Légifrance was not reachable for this check; source is the Senate legislative file."
  },
  {
    "id": "law-044",
    "jurisdiction": "France",
    "iso2": "FR",
    "subdivision": "",
    "law": "Loi n° 2026-813 du 24 août 2026 (protection des mineurs sur les réseaux sociaux): under-15 ban provision",
    "rule_type": "account_ban",
    "age": 15,
    "applies_to": "Online social network services provided by online platforms (proposed new art. 6-9 of LCEN 2004-575)",
    "status": "struck_down",
    "effective_date": "",
    "source_url": "https://www.conseil-constitutionnel.fr/decision/2026/2026911DC.htm",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "The Conseil constitutionnel (decision 2026-911 DC, 14 Aug 2026) declared the under-15 social network ban unconstitutional; the law was promulgated on 24 Aug 2026 without it. No French under-15 ban is in force."
  },
  {
    "id": "law-045",
    "jurisdiction": "Germany",
    "iso2": "DE",
    "subdivision": "",
    "law": "No national derogation — GDPR Art. 8(1) applies; BDSG contains no Art. 8 age provision",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.gesetze-im-internet.de/bdsg_2018/BJNR209710017.html",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Checked BDSG (Stand: last amended 3.7.2026, BGBl. 2026 I Nr. 199): no provision on child consent / information society services. No national derogation found; GDPR default 16 (https://eur-lex.europa.eu/eli/reg/2016/679/oj)."
  },
  {
    "id": "law-046",
    "jurisdiction": "Greece",
    "iso2": "GR",
    "subdivision": "",
    "law": "Νόμος 4624/2019 (ΦΕΚ Α' 137/29.8.2019), άρθρο 21",
    "rule_type": "data_consent",
    "age": 15,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.dpa.gr/sites/default/files/2023-06/4624_2019%20%CE%BC%CE%B5%20%CF%84%CF%81%CE%BF%CF%80%CE%BF%CF%80%CE%BF%CE%B9%CE%AE%CF%83%CE%B5%CE%B9%CF%82.pdf",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Consolidated text published by Hellenic DPA (2023): lawful if minor has completed 15th year. Not checked against et.gr for post-2023 amendments."
  },
  {
    "id": "law-047",
    "jurisdiction": "Greece",
    "iso2": "GR",
    "subdivision": "",
    "law": "Bill on the protection of minors in their access to social media services",
    "rule_type": "account_ban",
    "age": 15,
    "applies_to": "Social networking services; platforms must apply reliable age verification (Gov.gr Wallet / Kids Wallet named as tools)",
    "status": "proposed",
    "effective_date": "2027-01-01",
    "source_url": "https://www.moh.gov.gr/articles/ministry/grafeio-typoy/press-releases/14838-sth-boylh-stis-13-oktwbrioy-to-nomosxedio-gia-thn-prosbash-twn-anhlikwn-sta-koinwnika-diktya",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Government press release 12 Oct 2026: in Parliament from 13 Oct 2026, plenary vote scheduled 22 Oct 2026, planned application 1 Jan 2027; prohibits access for those who have not completed 15. No parental-consent exemption per press (not confirmed on primary)."
  },
  {
    "id": "law-048",
    "jurisdiction": "Hungary",
    "iso2": "HU",
    "subdivision": "",
    "law": "No national derogation — GDPR Art. 8(1) applies (Infotv. 2011. évi CXII. törvény has no Art. 8 age rule)",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.naih.hu/files/NAIH-2018-3134-2-V.pdf",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Hungarian DPA (NAIH) official opinion NAIH/2018/3134 applies the GDPR Art. 8(1) 16-year limit to ISS consent. Could NOT open njt.hu (connection reset) to re-check current Infotv. text for 2025-2026 changes; NAIH document is from 2018. GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  },
  {
    "id": "law-049",
    "jurisdiction": "Iceland",
    "iso2": "IS",
    "subdivision": "",
    "law": "Lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga, 10. gr.",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.althingi.is/lagas/nuna/2018090.html",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Althingi current law collection (version 158a, 1 Oct 2026): lawful only if child has reached 13; under 13 guardian must authorise."
  },
  {
    "id": "law-050",
    "jurisdiction": "India",
    "iso2": "IN",
    "subdivision": "",
    "law": "Digital Personal Data Protection Act, 2023 (No. 22 of 2023) s.9 + Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))",
    "rule_type": "data_consent",
    "age": 18,
    "applies_to": "All Data Fiduciaries processing personal data of children (under 18); also bans tracking, behavioural monitoring and targeted ads directed at children",
    "status": "enacted_not_in_force",
    "effective_date": "",
    "source_url": "https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014&reg=3&lang=2",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Act s.2(f): a child is a person who has not completed 18 years. Verifiable parental consent required before processing a child's data; tracking, behavioural monitoring and targeted ads directed at children are barred. Rules notified Nov 2025 with phased compliance of 18 months, so the child provisions are not yet in force; exact date not stated here."
  },
  {
    "id": "law-051",
    "jurisdiction": "Indonesia",
    "iso2": "ID",
    "subdivision": "",
    "law": "Peraturan Pemerintah Nomor 17 Tahun 2025 tentang Tata Kelola Penyelenggaraan Sistem Elektronik dalam Pelindungan Anak (PP Tunas) + Peraturan Menteri Komunikasi dan Digital Nomor 9 Tahun 2026",
    "rule_type": "account_ban",
    "age": null,
    "applies_to": "Electronic system operators (PSE) classified high-risk for children; initial 8: YouTube, TikTok, Facebook, Instagram, Threads, X, Bigo Live, Roblox; Komdigi later listed 22 high-risk platforms (incl. Discord, Telegram, Pinterest)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://jdih.komdigi.go.id/produk_hukum/view/id/965/t/peraturan+pemerintah+nomor+17+tahun+2025",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "PP 17/2025 (enacted 27 Mar 2025) requires age verification, parental consent and parental controls; a child is a person under 18. Implementing Permenkomdigi 9/2026 (6 Mar 2026). The account age bands per platform risk level and the start date were not confirmed on the regulation text for this release, so age is left blank."
  },
  {
    "id": "law-052",
    "jurisdiction": "Ireland",
    "iso2": "IE",
    "subdivision": "",
    "law": "Data Protection Act 2018, section 31(1)",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.irishstatutebook.ie/eli/2018/act/7/section/31/enacted/en/html",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Irish Statute Book (as enacted): 'The age of a child specified for the purposes of Article 8 is 16 years of age.' s.31(3) required a ministerial review within 3 years; no amendment found but revised-act status not checked."
  },
  {
    "id": "law-053",
    "jurisdiction": "Italy",
    "iso2": "IT",
    "subdivision": "",
    "law": "D.Lgs. 196/2003 (Codice privacy), art. 2-quinquies, inserted by D.Lgs. 101/2018",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196~art2quinquies",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Normattiva: minor who has reached 14 may consent; under 14 consent by holder of parental responsibility."
  },
  {
    "id": "law-054",
    "jurisdiction": "Italy",
    "iso2": "IT",
    "subdivision": "",
    "law": "DDL S. 1136 (and joined bills) on the protection of minors in the digital dimension",
    "rule_type": "account_ban",
    "age": 15,
    "applies_to": "Account activation on social networks and video-sharing platforms with age checks via national mini-wallet",
    "status": "proposed",
    "effective_date": "",
    "source_url": "https://www.senato.it/leggi-e-documenti/disegni-di-legge/scheda-ddl?did=58233",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "From search index of Senate pages (not fetched): in 8th Committee; rapporteur's text sets 15. Not passed as of Oct 2026. Camera motion 18 Feb 2026 backed limit of at least 15."
  },
  {
    "id": "law-055",
    "jurisdiction": "Latvia",
    "iso2": "LV",
    "subdivision": "",
    "law": "Fizisko personu datu apstrādes likums, 33. pants",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://likumi.lv/ta/id/300099-fizisko-personu-datu-apstrades-likums",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Likumi.lv (official publisher Latvijas Vēstnesis): child at least 13."
  },
  {
    "id": "law-056",
    "jurisdiction": "Liechtenstein",
    "iso2": "LI",
    "subdivision": "",
    "law": "No national derogation — GDPR Art. 8(1) applies; Datenschutzgesetz (DSG) LGBl. 2018 Nr. 272 has no Art. 8 provision",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.gesetze.li/konso/2018272000",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Checked consolidated DSG PDF (Fassung 01.04.2026): no age rule for child consent. No national derogation found; GDPR default 16 (https://eur-lex.europa.eu/eli/reg/2016/679/oj)."
  },
  {
    "id": "law-057",
    "jurisdiction": "Lithuania",
    "iso2": "LT",
    "subdivision": "",
    "law": "Asmens duomenų teisinės apsaugos įstatymas Nr. I-1374, 6 straipsnis",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.e-tar.lt/portal/lt/legalAct/TAR.5368B592234C/asr",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "TAR consolidated version from 2026-06-30: consent lawful if given by child not younger than 14."
  },
  {
    "id": "law-058",
    "jurisdiction": "Luxembourg",
    "iso2": "LU",
    "subdivision": "",
    "law": "No national derogation — GDPR Art. 8(1) applies; Loi du 1er août 2018 (CNPD / régime général) has no Art. 8 provision",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://legilux.public.lu/eli/etat/leg/loi/2018/08/01/a686/jo",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Checked Legilux text of the Law of 1 August 2018: no mention of minors/enfant/société de l'information age. No national derogation found; GDPR default 16 (https://eur-lex.europa.eu/eli/reg/2016/679/oj)."
  },
  {
    "id": "law-059",
    "jurisdiction": "Malaysia",
    "iso2": "MY",
    "subdivision": "",
    "law": "Online Safety Act 2025 (Act 866) — Child Protection Code and Risk Mitigation Code (MCMC, s.80)",
    "rule_type": "account_ban",
    "age": 16,
    "applies_to": "Licensed social media service providers (reported: ≥8 million Malaysian users, e.g. Facebook, Instagram, TikTok, YouTube); age verification against government ID records",
    "status": "in_force",
    "effective_date": "2026-06-01",
    "source_url": "https://www.mcmc.gov.my/en/onsa/under-16",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "MCMC: from 1 June 2026 platforms must verify user age; 15 and below may not hold a social media account; 16-17 permitted with extra protections. Which providers are covered was not confirmed on the MCMC page."
  },
  {
    "id": "law-060",
    "jurisdiction": "Malta",
    "iso2": "MT",
    "subdivision": "",
    "law": "S.L. 586.11 Processing of Child's Personal Data in relation to the Offer of Information Society Services Regulations (L.N. 179 of 2018), reg. 4",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://legislation.mt/eli/sl/586.11/eng",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "legislation.mt PDF: processing lawful where the child is thirteen years of age."
  },
  {
    "id": "law-061",
    "jurisdiction": "Netherlands",
    "iso2": "NL",
    "subdivision": "",
    "law": "No derogation — GDPR Art. 8(1) applies; Uitvoeringswet AVG art. 5 (16 also for consent outside Art. 8)",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://wetten.overheid.nl/BWBR0040940",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "UAVG art. 5 sets 16 ('zestien jaren') for consent where Art. 8 does not apply; NL did not lower the Art. 8 age, so GDPR default 16 (https://eur-lex.europa.eu/eli/reg/2016/679/oj)."
  },
  {
    "id": "law-062",
    "jurisdiction": "Netherlands",
    "iso2": "NL",
    "subdivision": "",
    "law": "Richtlijnen gezond en verantwoord scherm- en sociale mediagebruik (government guidance)",
    "rule_type": "guidance",
    "age": 15,
    "applies_to": "Non-binding advice to parents: wait until 15 for social media such as Instagram and TikTok",
    "status": "in_force",
    "effective_date": "2025-06-17",
    "source_url": "https://www.rijksoverheid.nl/actueel/nieuws/2025/06/16/duidelijk-advies-voor-ouders-wacht-met-sociale-media-tot-15-jaar",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Government advice to parents, not a law."
  },
  {
    "id": "law-063",
    "jurisdiction": "New Zealand",
    "iso2": "NZ",
    "subdivision": "",
    "law": "Online Safety (Minimum Age and Child Safety Assessment) Bill",
    "rule_type": "account_ban",
    "age": 16,
    "applies_to": "Social media and social AI-companion platforms with algorithmic feeds etc.; excludes messaging, multiplayer games, music, general AI chatbots",
    "status": "proposed",
    "effective_date": "",
    "source_url": "https://dia.govt.nz/Resource-material-Our-Policy-Advice-Areas-Online-Safety-Policy?OpenDocument=",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "DIA page: introduced 24 Aug 2026; platforms must take reasonable steps to stop under-16 accounts; penalties up to 10% of global revenue (beehive release, search index). ACT and NZ First oppose per press; first-reading outcome not verified. Separate member's bill Social Media (Age-Restricted Users) Bill (2025) also exists."
  },
  {
    "id": "law-064",
    "jurisdiction": "Norway",
    "iso2": "NO",
    "subdivision": "",
    "law": "Personopplysningsloven (LOV-2018-06-15-38) § 5",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://lovdata.no/lov/2018-06-15-38/%C2%A75",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Lovdata: 'Aldersgrensen er 13 år' for consent under GDPR art. 6(1)(a) in connection with art. 8(1)."
  },
  {
    "id": "law-065",
    "jurisdiction": "Norway",
    "iso2": "NO",
    "subdivision": "",
    "law": "Proposed Act on an age limit for use of social media (lov om aldersgrense for bruk av sosiale medier)",
    "rule_type": "account_ban",
    "age": 15,
    "applies_to": "Social media services; 2025 consultation draft exempted marketplaces, games, closed-group communication and messaging",
    "status": "proposed",
    "effective_date": "",
    "source_url": "https://www.regjeringen.no/no/dokumenter/horing-av-forslag-til-lov-om-aldersgrense-for-bruk-av-sosiale-medier/id3114359/",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "regjeringen.no returned 403 to direct fetch; details from search index of government pages. Consultation closed 7 Oct 2025; Apr 2026 rework to apply from 1 January of the year the child turns 16; EEA notification 8 May 2026. Bill not yet put to the Storting per latest pages found."
  },
  {
    "id": "law-066",
    "jurisdiction": "Poland",
    "iso2": "PL",
    "subdivision": "",
    "law": "No national derogation — GDPR Art. 8(1) applies; Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych has no Art. 8 provision",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20180001000/U/D20181000Lj.pdf",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Checked ISAP consolidated text (t.j. Dz.U. 2019 poz. 1781, amended up to 2026 poz. 1003): no child-consent age provision. No national derogation found; GDPR default 16 (https://eur-lex.europa.eu/eli/reg/2016/679/oj)."
  },
  {
    "id": "law-067",
    "jurisdiction": "Portugal",
    "iso2": "PT",
    "subdivision": "",
    "law": "Lei n.º 58/2019, de 8 de agosto, artigo 16.º",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://diariodarepublica.pt/dr/detalhe/lei/58-2019-123815982",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Diário da República: consent from 13 years; under 13 legal representatives. PENDING: PSD bill Projeto de Lei 398/XVII (raise to 16, parental consent 13-16) approved na generalidade 12 Feb 2026; no final law found published in DR as of 2026-10-14."
  },
  {
    "id": "law-068",
    "jurisdiction": "Romania",
    "iso2": "RO",
    "subdivision": "",
    "law": "No national derogation — GDPR Art. 8(1) applies; Legea nr. 190/2018 has no Art. 8 provision",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.dataprotection.ro/servlet/ViewDocument?id=1520",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Checked Law 190/2018 text published by ANSPDCP: no child-consent age provision; ANSPDCP FAQ applies 16. No national derogation found; GDPR default 16 (https://eur-lex.europa.eu/eli/reg/2016/679/oj). Later amendments (e.g. Law 179/2022) not individually checked."
  },
  {
    "id": "law-069",
    "jurisdiction": "Slovakia",
    "iso2": "SK",
    "subdivision": "",
    "law": "Zákon č. 18/2018 Z. z. o ochrane osobných údajov, § 15 ods. 1",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2018/18/",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Slov-Lex: lawful if data subject has reached 16; Slovakia restated the default in national law."
  },
  {
    "id": "law-070",
    "jurisdiction": "Slovenia",
    "iso2": "SI",
    "subdivision": "",
    "law": "Zakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS 163/2022, 8. člen",
    "rule_type": "data_consent",
    "age": 15,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://pisrs.si/pregledPredpisa?id=ZAKO7959",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "PISRS: child's consent valid if child is 15 or older (ZVOP-2 in force since 26.1.2023; before that no derogation, i.e. 16)."
  },
  {
    "id": "law-071",
    "jurisdiction": "South Korea",
    "iso2": "KR",
    "subdivision": "",
    "law": "Personal Information Protection Act (개인정보 보호법), art. 22-2",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Processing personal data of children under 14 requires legal representative's consent (to be verified by controller)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=270351",
    "checked_on": "2026-10-14",
    "verified": "partial",
    "note": "law.go.kr is JS-rendered; article text not extracted directly, content via search index of law.go.kr/KLRI. Reported Mar 2026 amendment (Act No. 21445) not verified. No social-media account ban in Korea."
  },
  {
    "id": "law-072",
    "jurisdiction": "Spain",
    "iso2": "ES",
    "subdivision": "",
    "law": "Ley Orgánica 3/2018 (LOPDGDD), artículo 7",
    "rule_type": "data_consent",
    "age": 14,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "BOE consolidated text (last update published 27/12/2025): consent only if over 14 ('mayor de catorce años'). A bill to raise it to 16 lapsed in the Congreso on 6 Oct 2026 (see separate row)."
  },
  {
    "id": "law-073",
    "jurisdiction": "Spain",
    "iso2": "ES",
    "subdivision": "",
    "law": "Proyecto de Ley Orgánica para la protección de las personas menores de edad en los entornos digitales (121/000052)",
    "rule_type": "data_consent",
    "age": 16,
    "applies_to": "Would raise LOPDGDD consent age (and social media registration) from 14 to 16, plus age-verification duties",
    "status": "lapsed",
    "effective_date": "",
    "source_url": "https://www.congreso.es/es/proyectos-de-ley?p_p_id=iniciativas&p_p_lifecycle=0&p_p_state=normal&p_p_mode=view&_iniciativas_mode=mostrarDetalle&_iniciativas_legislatura=XV&_iniciativas_id=121%2F000052",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Congreso record: 'Concluido - (Caducado) desde 06/10/2026' - the bill lapsed without becoming law. It would have raised the consent age from 14 to 16. Listed for context; it has no legal effect."
  },
  {
    "id": "law-074",
    "jurisdiction": "Sweden",
    "iso2": "SE",
    "subdivision": "",
    "law": "Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 2 kap. 4 §",
    "rule_type": "data_consent",
    "age": 13,
    "applies_to": "Information society services offered directly to a child, where processing relies on consent (GDPR Art. 8)",
    "status": "in_force",
    "effective_date": "",
    "source_url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/",
    "checked_on": "2026-10-14",
    "verified": "yes",
    "note": "Riksdagen SFS text (updated incl. 2026 amendments): consent valid if child resident in Sweden is at least 13."
  }
]