Laws and Regulations

CCPA and CPRA The CCPA is California's consumer privacy law, and the CPRA is the 2020 ballot measure that expanded it. It gives California residents, including business contacts, rights over their personal information and limits how businesses and their vendors can sell or share it. CCPA Service Provider Under the CCPA, a service provider is a vendor that processes personal information on your behalf under a written contract that bars it from selling, sharing or reusing that data. With that contract in place, handing data to the vendor is not a sale. CIPA Pixel Lawsuits CIPA pixel lawsuits are claims under the California Invasion of Privacy Act and similar wiretap laws that say tracking pixels and other website tools let third parties collect visitor activity without consent. In 2026 California ended private suits for one type of claim, but wiretapping claims remain. Colorado AI Act The Colorado AI Act (SB 24-205) is Colorado's 2024 law on high-risk AI. SB 26-189, passed in May 2026 before its duties began, repeals and replaces it on January 1, 2027 with a narrower automated decision-making law. A federal court order currently bars enforcement of both. ePrivacy Directive The ePrivacy Directive (2002/58/EC) is the EU law behind cookie banners. It requires consent before a website or app stores or reads information on a user's device, unless that is strictly necessary, and it sets the consent rules for marketing emails. EU AI Act The EU AI Act is the European Union law that sorts AI systems by risk and sets duties for the companies that build them (providers) and use them (deployers). Its obligations apply in stages, and the 2026 AI Omnibus pushed the high-risk deadlines to December 2027 and August 2028. FTC Click-to-Cancel Rule (Vacated) The FTC Click-to-Cancel Rule was a 2024 federal rule that would have made subscriptions, including business ones, as easy to cancel as to start. A federal appeals court vacated it in July 2025, and as of October 2026 the FTC is gathering comments on a possible new rule. GDPR for US SaaS Companies The GDPR is the EU law on personal data. It can apply to a US SaaS company with no EU office if it offers services to people in the EU or tracks their behavior there, and it sets rules for every vendor that handles that data for you. HIPAA and SaaS Vendors HIPAA is the US federal law that protects health information held by health plans, health care providers and their vendors. A SaaS vendor that handles that information for them is a business associate and must sign a business associate agreement (BAA). Quebec Law 25 Quebec Law 25 is the 2021 law that overhauled private-sector privacy rules in the Canadian province of Quebec, adding GDPR-like duties such as privacy impact assessments, breach reporting and a privacy officer, phased in from 2022 to 2024. State Automatic Renewal Laws State automatic renewal laws set rules for contracts and subscriptions that renew on their own, such as clear disclosure, consent and reminders. Many protect consumers only; a few reach business contracts, so do not assume one protects your company when a vendor renews. State Data Breach Notification Laws State data breach notification laws require businesses to tell people when their personal information is exposed in a security breach. If the breach happens at one of your vendors, the duty to notify your customers or employees can still land on you. UK GDPR The UK GDPR is the United Kingdom's version of the GDPR, kept in UK law after Brexit and amended since, with its own regulator, its own fines and its own tools for sending personal data abroad. US State Privacy Laws US state privacy laws are the comprehensive consumer privacy laws passed state by state, starting with California. As of October 2026, about 20 are in force and four more take effect in 2027 and 2028, each with its own thresholds, opt-outs and rules for vendors.