Deadline calendar
Deadlines — the next 90 days.
Verified effective dates and compliance milestones from the AI & Privacy research inventory. Different phases of a law remain separate calendar events.
Last verified Nov 13, 2026
2027-01
January 2027
California AI Transparency Act, SB 942 as amended by AB 853 — Separate platform/hosting duties begin.Separate platform/hosting duties begin. Primary sourceCalifornia
Colorado AI Act replacement — consequential-decision duties — Main ADMT/consequential-decision duties begin.Main ADMT/consequential-decision duties begin. Primary sourceColorado
Delaware 2027 privacy coverage and automated-decision amendments — Verified operative date: 2027-01-01. Verified operative date: 2027-01-01. Primary sourceDelaware
Later tracked milestones
California SB 243: companion chatbots — Annual suicide-prevention reporting begins.Annual suicide-prevention reporting begins. Primary sourceCalifornia
Stop Harms from Addictive Social Media — 2027-07-01; applies to accounts created before, on or after that date2027-07-01; applies to accounts created before, on or after that date Primary sourceMinnesota
California CCPA risk-assessment regulations — Existing continuing processing assessment deadline.Existing continuing processing assessment deadline. Primary sourceCalifornia
California AI Transparency Act, SB 942 as amended by AB 853 — Capture-device provisions begin.Capture-device provisions begin. Primary sourceCalifornia
California CCPA risk-assessment regulations — First summaries to CPPA.First summaries to CPPA. Primary sourceCalifornia
Earlier verified milestones (51)
FTC GLBA Privacy Rule — original final rule — Legal effective date: 2000-11-13; principal compliance date: 2001-07-01.Legal effective date: 2000-11-13; principal compliance date: 2001-07-01. Primary sourceFederal
HIPAA Security Rule — original final security standards — Legal effective date: 2003-04-21. General covered-entity compliance: 2005-04-21; small-health-plan compliance: 2006-04-21.Legal effective date: 2003-04-21. General covered-entity compliance: 2005-04-21; small-health-plan compliance: 2006-04-21. Primary sourceFederal
FTC Disposal Rule — consumer-report information and records — Legal effective date: 2005-06-01; principal compliance date: 2005-06-01.Legal effective date: 2005-06-01; principal compliance date: 2005-06-01. Primary sourceFederal
Biometric Information Privacy Act (BIPA) — 2008-10-03; current §20 amendment effective 2024-08-022008-10-03; current §20 amendment effective 2024-08-02 Primary sourceIllinois
Commercial biometric identifier enrollment restrictions — 2017-07-232017-07-23 Primary sourceWashington
Vermont data broker registration and security — 2019-01-012019-01-01 Primary sourceVermont
Artificial Intelligence Video Interview Act — 2020-01-012020-01-01 Primary sourceIllinois
Connected-device reasonable security — 2020-01-012020-01-01 Primary sourceOregon
SHIELD Act private-information security safeguards — General breach amendments2019-10-23; §4 safeguards2020-03-21General breach amendments2019-10-23; §4 safeguards2020-03-21 Primary sourceNew York
Government facial recognition services safeguards — 2021-07-012021-07-01 Primary sourceWashington
California Consumer Privacy Act, as amended by CPRA — Verified operative date: 2023-01-01. Verified operative date: 2023-01-01. Primary sourceCalifornia
Automated employment decision tool bias audits and notices — Legal effective date2023-01-01; DCWP enforcement2023-07-05Legal effective date2023-01-01; DCWP enforcement2023-07-05 Primary sourceNew York
FTC Safeguards Rule — 2021 security-program amendments — Legal effective date: 2022-01-10; principal compliance date: 2023-06-09.Legal effective date: 2022-01-10; principal compliance date: 2023-06-09. Primary sourceFederal
Consumer health data consent, confidentiality and geofencing — 2023-07-012023-07-01 Primary sourceConnecticut
Texas data broker registration and security — Act effective2023-09-01; covered processing from2023-12-01; initial registration timing subject to implementing rulesAct effective2023-09-01; covered processing from2023-12-01; initial registration timing subject to implementing rules Primary sourceTexas
Oregon data broker registration — 2024-01-012024-01-01 Primary sourceOregon
Nevada consumer health data privacy law — 2024-03-312024-03-31 Primary sourceNevada
My Health My Data Act — Principal §§.020–.070 duties: 2024-03-31; small businesses: 2024-06-30Principal §§.020–.070 duties: 2024-03-31; small businesses: 2024-06-30 Primary sourceWashington
Florida Digital Bill of Rights — Verified operative date: 2024-07-01. Verified operative date: 2024-07-01. Primary sourceFlorida
ELVIS Act voice and likeness protections — 2024-07-012024-07-01 Primary sourceTennessee
Texas Data Privacy and Security Act — Verified operative date: 2024-07-01. Verified operative date: 2024-07-01. Primary sourceTexas
FTC Health Breach Notification Rule — 2024 amendments — Legal effective date: 2024-07-29; principal compliance date: 2024-07-29.Legal effective date: 2024-07-29; principal compliance date: 2024-07-29. Primary sourceFederal
Delaware Personal Data Privacy Act, base law — Verified operative date: 2025-01-01. Verified operative date: 2025-01-01. Primary sourceDelaware
DOJ Data Security Program — countries-of-concern data transactions — Legal effective / principal operative date: 2025-04-08. Sections 202.1001–1002 and 202.1103–1104 apply to the relevant transactions from 2025-10-06.Legal effective / principal operative date: 2025-04-08. Sections 202.1001–1002 and 202.1103–1104 apply to the relevant transactions from 2025-10-06. Primary sourceFederal
Federal COPPA rule amendments — legal effectiveLegal effective date June 23, 2025; general compliance deadline April 22, 2026, with specified §312.11 exceptions Primary sourceFederal
Privacy of Biometric Identifiers and Data — 2025-07-012025-07-01 Primary sourceColorado
Minnesota Consumer Data Privacy Act — Verified operative date: 2025-07-31. Postsecondary institutions regulated by the Office of Higher Education have a July 31, 2029 transition.Verified operative date: 2025-07-31. Postsecondary institutions regulated by the Office of Higher Education have a July 31, 2029 transition. Primary sourceMinnesota
Maryland Online Data Privacy Act: application milestone — legal effectiveLegal effective date October 1, 2025; enacted transition text uses April 1, 2026 for prospective processing application Primary sourceMaryland
SEC Regulation S-P — incident response and customer-notification amendments — Legal effective date: 2024-08-02. Larger covered institutions: compliance 2025-12-03; smaller covered institutions: compliance 2026-06-03.Legal effective date: 2024-08-02. Larger covered institutions: compliance 2025-12-03; smaller covered institutions: compliance 2026-06-03. Primary sourceFederal
California AB 2013: GenAI training-data transparency — Training-data transparency posting deadline.Training-data transparency posting deadline. Primary sourceCalifornia
California CCPA risk-assessment regulations — Assessment before initiating covered new processing.Assessment before initiating covered new processing. Primary sourceCalifornia
California Delete Act: DROP — Consumer platform launch.Consumer platform launch. Primary sourceCalifornia
California SB 243: companion chatbots — effectiveJanuary 1, 2026; annual suicide-prevention reporting begins July 1, 2027 Primary sourceCalifornia
California SB 53: Transparency in Frontier Artificial Intelligence Act — effectiveJanuary 1, 2026 Primary sourceCalifornia
Illinois HB 3773 / Public Act 103-0804, employment AI — effectiveJanuary 1, 2026, §99 Primary sourceIllinois
Indiana Consumer Data Protection Act, IC 24-15 — effectiveJanuary 1, 2026 Primary sourceIndiana
Kentucky Consumer Data Protection Act, KRS 367.3611–.3629 — effectiveJanuary 1, 2026 Primary sourceKentucky
Oregon HB 2008 / 2025 chapter 251: children and precise-location restrictions — effectiveJanuary 1, 2026, expressly stated in the enacted law Primary sourceOregon
Oregon Consumer Privacy Act: universal opt-out mechanisms — effectiveJanuary 1, 2026 Primary sourceOregon
Rhode Island Data Transparency and Privacy Protection Act — effectiveJanuary 1, 2026 Primary sourceRhode Island
Texas Responsible Artificial Intelligence Governance Act, HB 149 — effectiveJanuary 1, 2026, §10 Primary sourceTexas
Federal 42 CFR Part 2 confidentiality amendments — Compliance deadline for the 2024 final rule.Compliance deadline for the 2024 final rule. Primary sourceFederal
Maryland Online Data Privacy Act: application milestone — applicationLegal effective date October 1, 2025; enacted transition text uses April 1, 2026 for prospective processing application Primary sourceMaryland
Federal COPPA rule amendments — General compliance deadline, subject to the specified §312.11 exceptions.General compliance deadline, subject to the specified §312.11 exceptions. Primary sourceFederal
Colorado AI Act replacement — consequential-decision duties — Signed into law.Signed into law. Primary sourceColorado
Maryland HB 711 / 2026 chapter 874: MODPA and geolocation amendments — effectiveJuly 1, 2026 Primary sourceMaryland
Social media mental health warning label — 2026-07-012026-07-01 Primary sourceMinnesota
California Delete Act: DROP — Broker processing obligations begin, at least once every 45 days.Broker processing obligations begin, at least once every 45 days. Primary sourceCalifornia
California AI Transparency Act, SB 942 as amended by AB 853 — Covered provider duties become operative.Covered provider duties become operative. Primary sourceCalifornia
Calendar scope. Only verified milestone dates enter these feeds. Unresolved dates remain on their rule pages as monitor items. A legal effective date, an operative compliance date, and an enforcement date are distinct events. Read the methodology.