Current Privacy Laws to Know in 2026

EU/EEA: GDPR + ePrivacy

If you have users in the European Union or European Economic Area, the main laws to know are the GDPR and the ePrivacy rules.

GDPR covers the broader processing of personal data. ePrivacy is especially relevant for cookies, tracking technologies, and electronic communications.

UK: UK GDPR + PECR

In the United Kingdom, the main privacy rules for websites are UK GDPR and PECR.

PECR is particularly important for cookies, similar tracking technologies, email marketing, and electronic communications.

California: CPRA / CCPA

California remains the most widely referenced state privacy law in the United States. Businesses usually talk about the “CPRA,” but in practice this means the CCPA framework administered by the California Privacy Protection Agency.

If you collect personal information from California residents, California disclosures and privacy rights are often a major part of your compliance setup.

Colorado: CPA

Colorado’s main privacy law is the Colorado Privacy Act (CPA).

It gives Colorado consumers rights over their personal data and places obligations on certain businesses that process that data.

Connecticut: CTDPA

Connecticut’s main privacy law is the Connecticut Data Privacy Act (CTDPA).

It gives Connecticut residents rights over personal data and sets rules for businesses that control or process it.

Virginia: VCDPA

Virginia’s main privacy law is the Virginia Consumer Data Protection Act (VCDPA).

It was one of the first broad state privacy laws passed after California and remains one of the standard laws businesses compare against.

Other US state privacy laws

Depending on your audience, you may also want to mention newer or additional state laws. A useful example is the Texas Data Privacy and Security Act.

If your business serves users across the US, it can make sense to include a broader section on evolving state privacy laws rather than naming only one or two states.

Canada: Quebec Law 25

If you have users, customers, or business activity connected to Quebec, the key law to know is commonly called Law 25. The official legal text is the Act respecting the protection of personal information in the private sector.

The relevant regulator is the Commission d’accès à l’information du Québec (CAI).

Brazil: LGPD

Brazil’s main privacy law is the Lei Geral de Proteção de Dados (LGPD).

The relevant authority is Brazil’s national data protection authority, ANPD.

China: PIPL

If you process personal information connected to people in China, the relevant law is the Personal Information Protection Law (PIPL).

This is China’s main national personal information protection law and is often discussed together with China’s wider data and cybersecurity rules.

Simple takeaway

For many websites in 2026, the core list to know is:

• EU/EEA: GDPR + ePrivacy
• UK: UK GDPR + PECR
• California: CPRA / CCPA
• Colorado: CPA
• Connecticut: CTDPA
• Virginia: VCDPA
• Other state laws depending on your US audience
• Canada: Quebec Law 25
• Brazil: LGPD
• China: PIPL

The right laws to mention on your website depend on where your users are, what personal data you collect, and whether you use cookies, analytics, profiling, advertising, or marketing communications.