Your privacy rights depend on where you live and where the company processing your data is located. The gap between the strongest and weakest regulations is enormous.
European Union: GDPR
The General Data Protection Regulation (2018) is the strongest mainstream privacy law:
- Scope: Applies to any company processing EU residents' data, regardless of where the company is based
- Key rights: Access, correction, deletion, data portability, and the right to object to processing
- Consent: Must be explicit, informed, and freely given. Pre-checked boxes are not valid
- Penalties: Up to 4% of global annual revenue or 20 million euros, whichever is higher
United States: A Patchwork
The US has no single federal privacy law. Instead, regulations vary by state and sector:
- CCPA/CPRA (California): Right to know what data is collected, right to delete, right to opt out of sale
- HIPAA: Protects health information specifically
- COPPA: Protects children's data online
- State-level laws: Virginia, Colorado, Connecticut, and others have passed their own privacy laws
The result is a fragmented landscape where your rights depend on your state and the type of data involved.
Brazil: LGPD
Brazil's Lei Geral de Protecao de Dados (2020) closely mirrors GDPR:
- Applies to any processing of data collected in Brazil
- Requires a legal basis for processing
- Grants rights to access, correction, and deletion
- Enforced by the ANPD (National Data Protection Authority)
Other Notable Regulations
- Canada (PIPEDA): Consent-based framework with upcoming modernization
- Australia (Privacy Act): 13 Australian Privacy Principles governing data handling
- Japan (APPI): Recognized as adequate by the EU, enabling smooth data transfers
- India (DPDP Act 2023): India's first comprehensive data protection law
What This Means in Practice
Regardless of where you live, the safest assumption is that your data is not fully protected. Laws are only as strong as their enforcement, and enforcement varies widely. The most reliable protection is not giving away real data in the first place.