# T1 — 2026 rules seed report

Research date: November 13, 2026 (Asia/Shanghai). Scope: US `/ai-privacy` and `/employment` under dev-spec §8.

This is a selected, source-linked seed inventory of important 2026 changes, not an exhaustive inventory of every federal, state, and local rule. Dates distinguish legal effectiveness, operative compliance duties, benefit commencement, and reporting deadlines. Thresholds below identify the main coverage test; source-specific exclusions still apply. The research did not populate the production database or start Phase 1.

## `/ai-privacy`

| Rule | Effective date / 2026 milestone | Who it covers / factual change | Primary source |
|---|---|---|---|
| Indiana Consumer Data Protection Act, IC 24-15 | **January 1, 2026** | Persons doing business in Indiana or targeting residents, processing **100,000+ consumers** annually, or **25,000+ AND >50%** gross revenue from personal-data sales. Entity/data exemptions apply; employment/commercial contexts are excluded from the consumer definition. | [Indiana AG guide and applicability FAQ](https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf) |
| Kentucky Consumer Data Protection Act, KRS 367.3611–.3629 | **January 1, 2026** | Persons doing business in Kentucky or targeting residents, processing **100,000+ consumers**, or **25,000+ AND >50%** gross revenue from sales. Government, financial/HIPAA entities, nonprofits, higher education, and other exemptions apply. | [Kentucky AG effective-date overview](https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx), [KRS applicability](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648) |
| Rhode Island Data Transparency and Privacy Protection Act | **January 1, 2026** | Main controller duties: for-profit businesses targeting/doing business in Rhode Island, **35,000+ customers** excluding payment-only processing, or **10,000+ AND >20%** gross revenue from sales. Separate §3 commercial website/service disclosures have **no numerical threshold** and concern collecting, storing **and selling** PII within the provision's scope. | [§4 coverage](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm), [§3 website notices](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm) |
| Oregon Consumer Privacy Act: universal opt-out mechanisms | **January 1, 2026** | Covered businesses/nonprofits must honor qualifying signals. General threshold: **100,000+ consumers** excluding payment-only processing, or **25,000+ AND ≥25%** annual gross revenue from sales. Current statute also covers relevant motor-vehicle manufacturers/affiliates irrespective of thresholds. | [Oregon DOJ](https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/), [ORS 646A.572/.578](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) |
| Oregon HB 2008 / 2025 chapter 251: children and precise-location restrictions | **January 1, 2026**, expressly stated in the enacted law | OCPA controllers: no targeted advertising or consequential profiling where they know/willfully disregard that a consumer is under 16; no selling those minors' data; no selling data locating a person/device within **1,750 feet**, subject to specified exclusions. | [Enacted chapter 251](https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0251.pdf), [current ORS 646A.578](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) |
| Maryland Online Data Privacy Act: application milestone | Legal effective date **October 1, 2025**; enacted transition text uses **April 1, 2026** for prospective processing application | Persons doing business in Maryland or targeting residents; **35,000+ consumers** excluding payment-only processing, or **10,000+ AND >20%** gross revenue from sales. Strict minimization/sensitive-data limitations; state-specific exemptions apply. This is a 2026 application milestone, not a newly effective 2026 law. | [HB 567 / chapter 454, especially §§2–4](https://mgaleg.maryland.gov/2024rs/chapters_noln/ch_454_hb0567e.pdf) |
| Maryland HB 711 / 2026 chapter 874: MODPA and geolocation amendments | **July 1, 2026** | MODPA controllers for business-facing provisions. Extends precise geolocation to a person/device/vehicle within 1,750 feet; restricts certain personal-data sales to government units for civil immigration enforcement. Other provisions concern government records/systems. | [Enacted chapter 874](https://mgaleg.maryland.gov/2026RS/Chapters_noln/CH_874_hb0711t.pdf) |
| California AB 2013: GenAI training-data transparency | **January 1, 2026 posting deadline**; thereafter before new/substantially modified releases | Developers designing, coding, producing, or substantially modifying GenAI systems/services publicly available to Californians, including free products; covers releases from January 1, 2022 onward. Limited security, aircraft, and federal national-security/military exclusions. | [Chaptered AB 2013](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013) |
| California SB 53: Transparency in Frontier Artificial Intelligence Act | **January 1, 2026** | Frontier-model developers: training compute **>10²⁶ operations**, including qualifying modifications. Expanded safety-framework/reporting duties apply to **large frontier developers**, with affiliates' combined prior-year gross revenue **>$500 million**. Other transparency, incident, and employee-protection provisions reach frontier developers more broadly. | [Chaptered SB 53](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53), [California AG](https://oag.ca.gov/sb53) |
| California SB 243: companion chatbots | **January 1, 2026**; annual suicide-prevention reporting begins **July 1, 2027** | Operators offering companion-chatbot platforms in California: adaptive human-like interaction sustaining a social relationship. Excludes operational/customer-service/productivity bots, certain games, and simple voice assistants. AI disclosures, self-harm protocols, and extra known-minor safeguards apply. | [Chaptered SB 243](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243) |
| California AI Transparency Act, SB 942 as amended by AB 853 | **August 2, 2026 operative date** | Covered GenAI providers with **>1 million monthly visitors/users**, publicly accessible in California: free detection tools and provenance/disclosure duties. Separate platform/hosting duties begin January 1, 2027; capture-device provisions begin January 1, 2028. | [Chaptered AB 853, revised operative dates](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853) |
| California CCPA risk-assessment regulations | Regulations effective **January 1, 2026**: assessment before initiating covered new processing. Existing continuing processing: **December 31, 2027** deadline. First summaries to CPPA: **April 1, 2028**. | CCPA-covered businesses conducting specified significant-risk processing under §7150(b). This does not cover all small businesses or make every ADMT/audit duty operative in 2026. | [CPPA finalization page](https://cppa.ca.gov/regulations/ccpa_updates.html), [approved §§7150–7157](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf) |
| California Delete Act: DROP | Consumer platform launched **January 1, 2026**; broker processing obligations begin **August 1, 2026**, at least once every 45 days | Registered data brokers, subject to exceptions; not every business processing personal data. | [California Privacy Protection Agency DROP](https://privacy.ca.gov/drop/) |
| Texas Responsible Artificial Intelligence Governance Act, HB 149 | **January 1, 2026**, §10 | Persons conducting/promoting business in Texas, producing products/services used by Texans, or developing/deploying AI in Texas. Restrictions differ by actor/use. Governmental-AI and healthcare disclosures are specific provisions, not a disclosure rule for every private AI interaction. | [Enrolled HB 149, §§551.002 and 10](https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm) |
| Federal COPPA rule amendments | Legal effective date **June 23, 2025**; general compliance deadline **April 22, 2026**, with specified §312.11 exceptions | Operators of child-directed online services, or operators with actual knowledge of collecting personal information from children under 13. Certain third-party disclosures require separate parental consent; amended retention/security and personal-information provisions also apply. | [Federal Register final rule](https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule), [FTC overview](https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa) |
| Federal 42 CFR Part 2 confidentiality amendments | **February 16, 2026 compliance deadline** for the 2024 final rule | Federally assisted substance-use-disorder programs and recipients subject to Part 2. Consent/redisclosure, notices, breach notification, and enforcement changes. Does not cover every business or health record. | [HHS fact sheet, updated January 30, 2026](https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html), [Federal Register final rule](https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records) |

**Cross-section record:** Illinois HB 3773 / PA 103-0804, January 1, 2026, appears in the employment table below. It receives both topic tags with one canonical rule record, rather than two independent records.

### Important deferred duties and date corrections

- **Colorado:** [SB 26-189](https://leg.colorado.gov/bills/sb26-189) became law and was signed **May 14, 2026**. It repeals/replaces the 2024 AI regime. Main ADMT/consequential-decision duties begin **January 1, 2027**; an August 2026 compliance deadline is outdated. The [signed act](https://leg.colorado.gov/bill_files/116489/download) is the primary text.
- **California ADMT:** the final regulations' ADMT requirements begin **January 1, 2027**. Cybersecurity audit reports start **April 1, 2028/2029/2030**, depending on the revenue tier. The January 2026 legal effective date does not make all these duties due in 2026. [Approved regulatory text](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf).
- **California SB 243:** annual reporting is a **2027** milestone. **AB 853:** platform/device duties are **2027/2028** milestones. They are distinct from the 2026 duties in the table.
- Maryland's **October 2025 effective date** and **April 2026 application milestone**, and COPPA's **2025 effective date** and **2026 compliance deadline**, must remain separate.

### Identified candidates held from the confirmed seed

| Candidate | Available evidence | Verification limit / treatment |
|---|---|---|
| Connecticut PA 25-113 / SB 1295 amendments | [Current CT AG guidance](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act) identifies expanded coverage: 35,000+ consumers excluding payment-only processing, or sensitive-data processing, or offering data for sale; also health-data-controller provisions. [Official enacted PDF](https://www.cga.ct.gov/2025/act/pa/pdf/2025PA-00113-R00SB-01295-PA.pdf). | Secondary coverage identifies **July 1, 2026**. The exact enacted section/date pairing was not independently extracted because the PDF request failed certificate verification. Enactment is established. This exact timing remains **unverified in this review** and is flagged in the operative-date field. |
| Connecticut PA 26-64 / SB 4 | CT AG guidance includes precise-geolocation sales restrictions and facial-recognition conditions. [Official enacted PDF](https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF). | Secondary coverage identifies relevant **October 1, 2026** changes. The public act is enacted. The source-access issue leaves its exact dates/phases unverified in their own fields. |
| New Jersey A5328 sensitive-data-sales amendment; Virginia precise-geolocation-sales amendment | Discovered through secondary coverage; the New Jersey text encountered was introduced bill text. | Enactment/status/final text were not established. No confirmed effective-date claim or production seed is made. |
| New York RAISE Act | [New York Senate S6953B official bill history](https://www.nysenate.gov/legislation/bills/2025/S6953/amendment/B) records signed chapter 699 on **December 19, 2025**. It is an enacted instrument, not a still-pending bill. | The page contains multiple bill versions; the current amended operative schedule and exact coverage were not independently validated. Retained as an enacted public record with **no confirmed operative date**; current coverage and the operative schedule are flagged per field. |

These limits are findings of the verification task. A law’s legal status is recorded separately from detail verification. Known enactment or in-force status is retained while unresolved substantive duties, thresholds or dates are marked Unverified in the affected fields. Candidates whose enactment is not established remain unresolved.

## `/employment`

| Rule | Effective date / 2026 milestone | Who it covers / factual change | Primary source |
|---|---|---|---|
| Illinois HB 3773 / Public Act 103-0804, employment AI | **January 1, 2026**, §99 | Employers generally with **one or more Illinois employees for 20+ weeks** in the current/prior year. §2-102(L) prohibits AI uses producing protected-class discrimination and ZIP-code proxies; employee notice is required, with DHR rules addressing circumstances/timing/means. Cross-tag with `/ai-privacy`. | [Official enacted text, §§2-101(B), 2-102(L), and 99](https://www.ilga.gov/Legislation/publicacts/view/103-0804) |
| Connecticut paid sick leave expansion, PA 24-8 / CGS §§31-57r–s | January 1, 2026 | Employers with **11+ Connecticut employees**, subject to exclusions. Covered employees accrue one hour per 30 worked, up to 40 hours annually. The threshold falls to one employee in 2027. | [Current Connecticut statute](https://www.cga.ct.gov/current/pub/chap_557.htm#sec_31-57s) |
| Delaware Healthy Delaware Families Act / Delaware Paid Leave | January 1, 2026: benefits and claims begin; contributions began January 1, 2025 | Most employers with **10+ Delaware employees**: 10–24 provide parental coverage; 25+ provide the full program. General employee eligibility is one year and 1,250 hours with the employer. Exemptions include specified seasonal/federal employers. | [Delaware DOL](https://labor.delaware.gov/delaware-paid-leave/) |
| Minnesota Paid Leave, Chapter 268B | January 1, 2026: benefits begin | Employers with individuals in covered Minnesota employment; statutory exclusions and elective coverage apply. Workers must meet financial eligibility. Employees generally become eligible for job-reinstatement protection after 90 calendar days of employment. | [Enacting law and operative date](https://www.revisor.mn.gov/laws/2023/0/Session+Law/Chapter/59/), [coverage](https://www.revisor.mn.gov/statutes/cite/268B.01), [benefits](https://www.revisor.mn.gov/statutes/cite/268B.04), [job protection](https://www.revisor.mn.gov/statutes/cite/268B.09) |
| Maine Paid Family and Medical Leave | **May 1, 2026: statutory claims-processing start.** January 1, 2026 establishes the program; contributions began January 1, 2025. | Maine employers with employees at a Maine location, including state/local government; federal government excluded. General individual earnings threshold is six times the state average weekly wage during the base period; elective coverage is available. | [Claims date, §850-P](https://www.mainelegislature.org/legis/statutes/26/title26sec850-P.html), [definitions](https://www.mainelegislature.org/legis/statutes/26/title26sec850-A.html) |
| Washington HB 1213, PFML job-protection expansion | January 1, 2026 | Employers with **25+ employees**; employees employed **180 calendar days**, without the prior 1,250-hour requirement. Includes continued healthcare benefits for qualifying protected leave and notices. | [Legislative status/date](https://app.leg.wa.gov/billsummary?BillNumber=1213&Year=2025), [Employment Security Department](https://paidleave.wa.gov/job-protection/) |
| California SB 294, Workplace Know Your Rights Act | January 1, 2026: effective and contact duty; **February 1**: annual notice deadline; **March 30**: opportunity to designate emergency contact | All California employers. Workplace-rights notices and specified contact notification following a covered arrest/detention, including certain known offsite events. | [California Labor Commissioner](https://www.dir.ca.gov/dlse/Garment/New-Labor-Laws-in-California.html) |
| California SB 642, Equal Pay Act limitations/recovery | January 1, 2026 | Employers/employees subject to the California Equal Pay Act. Three years after the last cause of action to bring a claim; relief for up to six years of violations; compensation payments can constitute a cause of action. | [Labor Commissioner 2026 laws letter, pp. 1–2](https://www.dir.ca.gov/DLSE/LCO-Letter-to-Employers-New-Laws-2026.pdf) |
| California paid-sick-leave update, AB 406 alongside AB 2499 | January 1, 2026: AB 406 update | California paid-sick-leave covered employers/employees, subject to exceptions. The Labor Commissioner's combined AB 406/AB 2499 explanation covers jury duty, subpoena/court-order witness appearances, and specified crime-victim situations. It does not establish that every listed purpose first became available in 2026. | [Labor Commissioner letter, p. 2](https://www.dir.ca.gov/DLSE/LCO-Letter-to-Employers-New-Laws-2026.pdf) |
| California statewide minimum wage adjustment | January 1, 2026 | **$16.90/hour**, all employer sizes, for covered workers. Higher local and specified industry rates can apply. | [California DIR](https://www.dir.ca.gov/dlse/minimum_wage.htm) |
| Oregon SB 906, explanation of earnings/deductions | January 1, 2026 | **All employers**: notify new hires about earnings, deductions, payroll-code meanings, pay periods, and benefit contributions; review/update the information by January 1 annually. | [Oregon BOLI](https://www.oregon.gov/boli/workers/pages/paycheck-deductions.aspx) |
| Oregon SB 968, public-employer overpayment deductions | January 1, 2026 | **Public employers**, subject to statutory notice requirements. Narrower than the private SMB audience; suitable as a separately tagged row. | [Oregon BOLI](https://www.oregon.gov/boli/workers/pages/paycheck-deductions.aspx) |
| Maine LD 54 / Public Law 2025, chapter 771, pay transparency | **July 29, 2026** | Employers with **10+ employees**: pay ranges in postings; commission-only postings disclose that basis. All employers: incumbent range on request; position/pay-history retention through employment plus three years. | [Current §622-A](https://www.mainelegislature.org/legis/statutes/26/title26sec622-A.html), [enrolled chapter](https://legislature.maine.gov/ros/LawsOfMaine/breeze/Law/getDocById/?docId=124414), [official general effective date](https://legislature.maine.gov/ros/LOM/LOM132nd/otherDocuments.html) |
| Washington minimum wage adjustment | January 1, 2026 | **$17.13/hour** for most agricultural/nonagricultural workers; ages 14–15 may receive $14.56. Higher local rates can apply. | [Washington L&I announcement](https://lni.wa.gov/news-events/article/25-27) |
| Washington overtime-exemption salary adjustment | January 1, 2026 | All employer sizes: specified executive, administrative, professional, and computer exemptions require **$1,541.70/week / $80,168.40/year**, plus applicable duties tests. Computer hourly alternative: **$59.96/hour**. | [Washington L&I announcement](https://lni.wa.gov/news-events/article/25-27) |
| Washington noncompete earnings-threshold adjustment | January 1, 2026 | Earnings thresholds: employees **$126,858.83**; independent contractors **$317,147.09**. Exceeding a threshold alone does not establish enforceability. | [Washington L&I announcement](https://lni.wa.gov/news-events/article/25-27) |
| Massachusetts pay-transparency reporting milestone | **February 1, 2026: EEO-4 reporting begins** for the applicable even-year cycle; pay-range duties began October 29, 2025 | Reporting: employers with **100+ employees whose primary place of work is Massachusetts**, already subject to the applicable federal EEO reporting. The separate job-posting/pay-range rule generally covers employers with 25+ Massachusetts employees; that duty began in 2025. | [Massachusetts Attorney General](https://www.mass.gov/info-details/pay-transparency-in-massachusetts) |

### Employment date and verification notes

- Maine chapter 771 was approved April 24, 2026. Its enrolled text contains no special effective-date clause; the Revisor identifies July 29, 2026 as the session's general effective date. Approval date and operative date are different fields.
- Maine §850-P permits a one-time suspension of claims payments of up to three months based on actuarial findings. The row above records the statutory schedule; it does not certify the absence of a separate suspension order.
- Minnesota §268B.14 permits premium-rate adjustments before 2026. This report deliberately does not publish the original 0.7% statutory figure as the operative 2026 premium without an agency rate determination.
- Washington HB 1308 personnel-records access took effect **July 27, 2025**, so it is not counted as newly effective in 2026. [Bill history](https://app.leg.wa.gov/billsummary?BillNumber=1308&Year=2025).
- The [US DOL state wage table](https://www.dol.gov/agencies/whd/minimum-wage/state) was updated November 5, 2026. A source's update date is not a state's wage effective date. This seed does not replace a full state/local wage inventory.

## Paid matrix expansion — 2026-11-13

This addendum is part of T1 and is the factual authority for the expanded paid edition and shared items table. The original 33 main entries, Colorado correction and five held candidates remain reconciled. The normalized records below add 42 distinct instruments (31 verified, 11 unresolved). Separate amendment instruments count once; individual obligations, additional dates and duplicate views do not add records. The New York RAISE record above now has primary enactment evidence and keeps its unresolved operative schedule as a field qualification. T1 establishes no verified still-pending AI bill to label as enacted or in force; the original AI candidate is included with its hold rather than inventing a pending status.

The comprehensive-state inventory accounts for 20 states: CA, CO, CT, DE, FL, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA. Indiana, Kentucky, Rhode Island, Maryland and Oregon are already represented in the original inventory (Oregon by its OCPA universal-opt-out milestone); their existing records are enriched, not duplicated. Florida’s $1 billion/sector conditions are explicit. The other 15 base laws appear below, alongside one distinct Delaware amendment, targeted privacy/AI instruments and federal rules. This selected inventory is not a claim to exhaust every targeted state law.

Legal status reflects the law itself, separately from detail verification. CO SB 21-190, CT PA 22-15 and the other enacted comprehensive base frameworks are in force. Unverified thresholds, scope, duties, penalties or exact date fields do not downgrade those laws to Pending. A confirmed enacted instrument with an unresolved operative schedule remains Enacted with the date field marked Unverified. Missing facts remain Unverified; they never mean No. Legal-effective, operative/compliance and enforcement dates are separate. Source retrieval/version limits are carried in each record. Some historic federal rules have later amendments; those limits are explicit rather than silently treating an original publication as complete current coverage.

Research detail and retained evidence: [comprehensive-state addendum](research/matrix-privacy-addendum.md), [targeted privacy/AI addendum](research/matrix-targeted-addendum.md), and [federal addendum](research/matrix-federal-addendum.md). The following embedded payload is canonical; those companion files are review aids. Enrichments only restate facts already supported by the original T1 rows and their linked primary sources.

### Legal-status and field-verification correction — 2026-11-13

The product owner’s correction distinguishes the actual legal status of a law from whether each detail was independently confirmed in this review. The normalized records retain the prior aggregate research-verification result for traceability, add separate `legal_status` and `legal_status_verification`, and qualify individual detail keys through `field_verification`. The ten comprehensive frameworks whose primary retrieval failed remain enacted and in force; their dates, thresholds and summarized duties remain Unverified where the earlier review did not establish them. The original FTC GLBA rule likewise remains in force while its current jurisdiction and duty scope require reconciliation. This correction does not certify any previously unresolved detail or turn an unknown operative schedule into a confirmed date.

### Matrix expansion normalized records

```json
{
  "schema_version": 1,
  "items": [
    {
      "id": "ca-ccpa-consolidated",
      "ref": "CA CIV 1798.100–199.100",
      "title": "California Consumer Privacy Act, as amended by CPRA",
      "state": "California",
      "state_code": "CA",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2023-01-01",
      "enforcement_date": null,
      "applies_to": "For-profit businesses doing business in California that satisfy the statutory revenue, consumer-volume, or sale/share-revenue tests; exclusions apply. The current inflation-adjusted revenue threshold is not established by this row.",
      "penalty": "Agency/AG enforcement and a limited data-breach private action; dollar penalty figures not verified in this review.",
      "obligations": [
        "Provide required collection and privacy notices.",
        "Honor applicable access, deletion and correction rights.",
        "Honor sale/sharing opt-outs and applicable sensitive-data limits."
      ],
      "sources": [
        {
          "url": "https://oag.ca.gov/privacy/ccpa",
          "label": "California AG CCPA guide",
          "pinpoint": "Overview; General FAQs 5–11; consumer rights and notices"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The verified January 1, 2023 date is the operative CPRA amendment date, not a claim that CCPA first commenced in 2023. CPRA is consolidated in this row and is not counted as a second law. Inflation-adjusted revenue and penalty amounts are not independently verified."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Verified operative date: 2023-01-01. ",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: current inflation-adjusted penalty dollar amounts are not established by this review."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: the current inflation-adjusted revenue threshold is not established by this review."
        }
      }
    },
    {
      "id": "co-colorado-privacy-act",
      "ref": "CO SB 21-190",
      "title": "Colorado Privacy Act",
      "state": "Colorado",
      "state_code": "CO",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2023-07-01",
      "enforcement_date": null,
      "applies_to": "Controllers conducting business in Colorado or targeting Colorado residents that satisfy the statute’s consumer-volume or data-sale conditions; entity and data exemptions apply.",
      "penalty": "Attorney General/district attorney enforcement; penalty amount not verified.",
      "obligations": [
        "Provide a privacy notice and process consumer-rights requests.",
        "Provide applicable targeted-advertising, sale and profiling opt-outs.",
        "Obtain required sensitive-data consent and conduct required assessments."
      ],
      "sources": [
        {
          "url": "https://leg.colorado.gov/bills/sb21-190",
          "label": "Colorado legislature, SB 21-190",
          "pinpoint": "Enacted act; C.R.S. 6-1-1304–1309; effective-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official bill page returned HTTP 406 and AG page returned HTTP 403. Historical July 1, 2023 commencement and summarized duties remain unverified in this review.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2023-07-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "ct-consumer-data-privacy-base",
      "ref": "CT PA 22-15",
      "title": "Connecticut Data Privacy Act, base law",
      "state": "Connecticut",
      "state_code": "CT",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2023-07-01",
      "enforcement_date": null,
      "applies_to": "Persons conducting business in Connecticut or targeting residents meeting the statutory consumer-processing or data-sale thresholds; current amendments may alter the historical base thresholds.",
      "penalty": "Attorney General enforcement; penalty amount not verified.",
      "obligations": [
        "Provide a privacy notice and respond to applicable rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Apply sensitive-data consent and required data-protection assessments."
      ],
      "sources": [
        {
          "url": "https://www.cga.ct.gov/2022/ACT/PA/PDF/2022PA-00015-R00SB-00006-PA.PDF",
          "label": "Connecticut enacted PA 22-15",
          "pinpoint": "Sections 1–11; effective-date clauses"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official act request timed out and AG host failed DNS resolution. This is the distinct 2022 base act, not either separately held 2025/2026 amendment. Historical base date/duties require primary confirmation.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2023-07-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "de-personal-data-privacy-act",
      "ref": "DE 84 DEL LAWS C197",
      "title": "Delaware Personal Data Privacy Act, base law",
      "state": "Delaware",
      "state_code": "DE",
      "jurisdiction_type": "state",
      "legal_effective_date": "2025-01-01",
      "operative_date": "2025-01-01",
      "enforcement_date": null,
      "applies_to": "Through December 31, 2026, persons conducting business in Delaware or targeting residents that in the preceding year processed at least 35,000 consumers excluding payment-only data, or at least 10,000 consumers AND derived over 20% of gross revenue from data sales; statutory exemptions apply.",
      "penalty": "Delaware DOJ enforcement under 6 Del. C. §12D-111; no private right is created by this chapter.",
      "obligations": [
        "Provide required notices and respond to authenticated consumer-rights requests.",
        "Provide sale/targeted-advertising opt-outs, including qualifying opt-out signals from January 1, 2026.",
        "Obtain required sensitive-data consent and conduct applicable data-protection assessments."
      ],
      "sources": [
        {
          "url": "https://delcode.delaware.gov/title6/c012d/index.html",
          "label": "Delaware Code Chapter 12D",
          "pinpoint": "§§12D-103, 12D-104, 12D-106, 12D-108 and 12D-111 versions effective until January 1, 2027"
        },
        {
          "url": "https://legis.delaware.gov/SessionLaws?volume=84&chapter=197",
          "label": "Enacted 84 Del. Laws chapter 197",
          "pinpoint": "Section 3; approved September 11, 2023"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Verified operative date: 2025-01-01. ",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "fl-digital-bill-of-rights",
      "ref": "FL CH2023-201",
      "title": "Florida Digital Bill of Rights",
      "state": "Florida",
      "state_code": "FL",
      "jurisdiction_type": "state",
      "legal_effective_date": "2024-07-01",
      "operative_date": "2024-07-01",
      "enforcement_date": null,
      "applies_to": "Main controller duties apply to for-profit controllers with over $1 billion global gross annual revenue AND at least one specified online-advertising, smart-speaker/virtual-assistant, or large app-store condition. General applicability and exemptions remain in §§501.703–.704; separate sensitive-data-sale provisions can have wider reach.",
      "penalty": "Department of Legal Affairs enforcement under §501.72; dollar amount not independently summarized.",
      "obligations": [
        "Provide required privacy notices and respond to authenticated consumer requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Conduct required risk assessments and comply with applicable sensitive-data-consent duties."
      ],
      "sources": [
        {
          "url": "https://laws.flrules.org/2023/201",
          "label": "Florida enacted chapter 2023-201",
          "pinpoint": "§§501.702(9), .703–.705, .71–.713 and .72; act §27"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "This row describes the main controller framework, not a claim that all Florida businesses exceed its $1 billion threshold. The original enacted act was read; later amendment effects outside this row are not exhaustively audited."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Verified operative date: 2024-07-01. ",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    },
    {
      "id": "ia-consumer-data-protection",
      "ref": "IA CODE715D",
      "title": "Iowa Consumer Data Protection Act",
      "state": "Iowa",
      "state_code": "IA",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2025-01-01",
      "enforcement_date": null,
      "applies_to": "Persons conducting business in Iowa or targeting residents that satisfy the statute’s consumer-volume or data-sale conditions; entity and data exemptions apply.",
      "penalty": "Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide a privacy notice and process applicable access, deletion and portability requests.",
        "Provide applicable personal-data-sale opt-outs.",
        "Provide notice and an opportunity to opt out of sensitive-data processing."
      ],
      "sources": [
        {
          "url": "https://www.legis.iowa.gov/docs/code/715D.pdf",
          "label": "Iowa Code chapter 715D",
          "pinpoint": "§§715D.2–715D.8; SF 262 commencement clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official current and dated code-PDF requests returned HTTP 500. Historical January 1, 2025 commencement and duties are review fields.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2025-01-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "mn-consumer-data-privacy",
      "ref": "MN STAT325M.10–.21",
      "title": "Minnesota Consumer Data Privacy Act",
      "state": "Minnesota",
      "state_code": "MN",
      "jurisdiction_type": "state",
      "legal_effective_date": "2025-07-31",
      "operative_date": "2025-07-31",
      "enforcement_date": null,
      "applies_to": "Legal entities doing business in Minnesota or targeting its residents that process at least 100,000 consumers excluding payment-only data, or at least 25,000 consumers AND derive over 25% of gross revenue from data sales. Small-business and institutional exceptions apply; covered higher-education institutions have a separate July 31, 2029 transition.",
      "penalty": "Minnesota AG enforcement; up to $7,500 per violation under §325M.20; no private action under the chapter.",
      "obligations": [
        "Provide required privacy notices and respond to consumer-rights requests.",
        "Provide applicable opt-outs and required information/review rights for consequential profiling.",
        "Maintain applicable data inventory, security safeguards and data-protection assessments."
      ],
      "sources": [
        {
          "url": "https://www.revisor.mn.gov/statutes/cite/325M/full",
          "label": "Minnesota Revisor, Chapter 325M",
          "pinpoint": "§§325M.10–325M.21, especially .12, .14, .16, .18 and .20"
        },
        {
          "url": "https://www.revisor.mn.gov/laws/2024/0/Session+Law/Chapter/121/#laws.5.14.0",
          "label": "Minnesota Laws 2024 chapter 121, article 5",
          "pinpoint": "Section 14: effective July 31, 2025; specified postsecondary institutions July 31, 2029"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Current Chapter 325M substantive text and Laws 2024 chapter 121 article 5 section 14 were retrieved and read. The institution-specific July 31, 2029 transition remains separate from general commencement."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Verified operative date: 2025-07-31. Postsecondary institutions regulated by the Office of Higher Education have a July 31, 2029 transition.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "mt-consumer-data-privacy",
      "ref": "MT SB384 / MCA30-14-28",
      "title": "Montana Consumer Data Privacy Act",
      "state": "Montana",
      "state_code": "MT",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2024-10-01",
      "enforcement_date": null,
      "applies_to": "Controllers conducting business in Montana or targeting residents that meet the applicable current consumer-volume or data-sale threshold; the 2025 amendment can change the original threshold.",
      "penalty": "Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide required privacy notices and process rights requests.",
        "Provide applicable sale, targeted-advertising and profiling opt-outs.",
        "Obtain required sensitive-data consent and conduct required assessments."
      ],
      "sources": [
        {
          "url": "https://archive.legmt.gov/bills/2023/billpdf/SB0384.pdf",
          "label": "Montana enacted SB 384",
          "pinpoint": "Base act; operative-date clause and controller duties"
        },
        {
          "url": "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html",
          "label": "Montana Code, Title 30 chapter 14 part 28",
          "pinpoint": "Current consolidated act"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official code/archive requests timed out and replacement host failed DNS resolution. The current amended thresholds are not asserted. Historical October 1, 2024 date and duties remain review fields.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2024-10-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "ne-data-privacy-act",
      "ref": "NE RS87-1101–1130",
      "title": "Nebraska Data Privacy Act",
      "state": "Nebraska",
      "state_code": "NE",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2025-01-01",
      "enforcement_date": null,
      "applies_to": "Persons conducting business in Nebraska or producing goods/services consumed by residents and processing/selling personal data, generally excluding SBA-defined small businesses subject to a separate sensitive-data-sale restriction; statutory exemptions apply.",
      "penalty": "Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide a privacy notice and process applicable rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Apply sensitive-data consent and required assessments; small businesses have a separate consent rule for sensitive-data sales."
      ],
      "sources": [
        {
          "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103",
          "label": "Nebraska Legislature, applicability",
          "pinpoint": "§87-1103; chapter duties and LB 1074 operative-date clause"
        },
        {
          "url": "https://nebraskalegislature.gov/FloorDocs/108/PDF/Slip/LB1074.pdf",
          "label": "Nebraska enacted LB 1074",
          "pinpoint": "Data Privacy Act and operative-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Both official legislature host variants failed DNS resolution. Historical January 1, 2025 date and statutory details require primary confirmation.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2025-01-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "nh-personal-data-privacy",
      "ref": "NH RSA507-H",
      "title": "New Hampshire personal-data privacy law",
      "state": "New Hampshire",
      "state_code": "NH",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2025-01-01",
      "enforcement_date": null,
      "applies_to": "Persons doing business in New Hampshire or targeting residents that satisfy the statute’s consumer-processing or data-sale conditions; exemptions apply.",
      "penalty": "Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide required privacy notices and process rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Apply sensitive-data consent and required data-protection assessments."
      ],
      "sources": [
        {
          "url": "https://gc.nh.gov/rsa/html/XXXI/507-H/507-H-mrg.htm",
          "label": "New Hampshire RSA chapter 507-H",
          "pinpoint": "Applicability, consumer rights, controller duties and enforcement"
        },
        {
          "url": "https://www.gencourt.state.nh.us/legislation/2024/SB0255.html",
          "label": "New Hampshire enacted SB 255",
          "pinpoint": "Base act and effective-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Current-code request returned HTTP 403; enacted-text host was unavailable. Historical January 1, 2025 date and duties remain review fields.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2025-01-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "nj-data-privacy-act",
      "ref": "NJ PL2023-C266",
      "title": "New Jersey Data Privacy Act",
      "state": "New Jersey",
      "state_code": "NJ",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2025-01-15",
      "enforcement_date": null,
      "applies_to": "Controllers doing business in New Jersey or targeting its residents that meet the statute’s consumer-processing or data-sale conditions; exemptions apply.",
      "penalty": "Attorney General/Division of Consumer Affairs enforcement; amount not verified.",
      "obligations": [
        "Provide required privacy notices and process rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Obtain required sensitive-data consent and perform required assessments."
      ],
      "sources": [
        {
          "url": "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF",
          "label": "New Jersey enacted P.L.2023 chapter 266",
          "pinpoint": "Sections 1–16, including effective-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official enacted-PDF request timed out. The Division page returned only a 212-byte shell, not usable guidance. Historical January 15, 2025 date and duties remain review fields. This is separate from the held A5328 candidate.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2025-01-15. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "tn-information-protection-act",
      "ref": "TN PC408 / TCA47-18-32",
      "title": "Tennessee Information Protection Act",
      "state": "Tennessee",
      "state_code": "TN",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2025-07-01",
      "enforcement_date": null,
      "applies_to": "Persons conducting business in Tennessee or targeting residents that meet the revenue AND consumer-volume/data-sale tests; exemptions apply.",
      "penalty": "Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide required privacy notices and process rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Obtain required sensitive-data consent and document required assessments."
      ],
      "sources": [
        {
          "url": "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf",
          "label": "Tennessee enacted Public Chapter 408",
          "pinpoint": "§47-18-3202–3208; effective-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official Secretary of State act request returned HTTP 403 and AG host failed DNS resolution. Historical July 1, 2025 date and duties remain review fields.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2025-07-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "tx-data-privacy-security-act",
      "ref": "TX HB4 / B&C541",
      "title": "Texas Data Privacy and Security Act",
      "state": "Texas",
      "state_code": "TX",
      "jurisdiction_type": "state",
      "legal_effective_date": "2024-07-01",
      "operative_date": "2024-07-01",
      "enforcement_date": null,
      "applies_to": "Persons conducting business in Texas or producing products/services consumed by residents, processing or selling personal data, and not SBA-defined small businesses. Small businesses separately need prior consent for sensitive-data sales; entity/data exemptions apply.",
      "penalty": "Texas AG enforcement; up to $7,500 per violation following the statutory notice/cure process; no private right under chapter.",
      "obligations": [
        "Provide required notices and process authenticated rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Obtain required sensitive-data consent and conduct required data-protection assessments."
      ],
      "sources": [
        {
          "url": "https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm",
          "label": "Texas enrolled HB 4",
          "pinpoint": "§§541.002, .051–.055, .101–.107, .151–.155; act §8"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Main duties commenced July 1, 2024; §541.055(e) agent-designation/technology provision commenced January 1, 2025, as stated in act §8."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Verified operative date: 2024-07-01. ",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "ut-consumer-privacy-act",
      "ref": "UT CODE13-61",
      "title": "Utah Consumer Privacy Act",
      "state": "Utah",
      "state_code": "UT",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2023-12-31",
      "enforcement_date": null,
      "applies_to": "Controllers/processors conducting business in Utah or targeting residents that meet the revenue AND consumer-volume/data-sale tests; entity/data exemptions apply.",
      "penalty": "Utah Division of Consumer Protection investigation and Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide required privacy notices and process applicable rights requests.",
        "Offer personal-data-sale and targeted-advertising opt-outs.",
        "Provide the statutory sensitive-data notice and opt-out opportunity."
      ],
      "sources": [
        {
          "url": "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html",
          "label": "Utah Code Title 13 chapter 61",
          "pinpoint": "Applicability, rights, controller duties and enforcement"
        },
        {
          "url": "https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf",
          "label": "Utah enacted SB 227",
          "pinpoint": "Base act and effective-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official code and enacted-act host failed DNS resolution. Historical December 31, 2023 commencement and duties remain review fields.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2023-12-31. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "va-consumer-data-protection",
      "ref": "VA CODE59.1-575–585",
      "title": "Virginia Consumer Data Protection Act",
      "state": "Virginia",
      "state_code": "VA",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2023-01-01",
      "enforcement_date": null,
      "applies_to": "Persons doing business in Virginia or targeting residents that satisfy the consumer-volume or data-sale conditions; entity/data exemptions apply.",
      "penalty": "Attorney General enforcement; amount not verified.",
      "obligations": [
        "Provide required privacy notices and respond to authenticated rights requests.",
        "Offer applicable sale, targeted-advertising and profiling opt-outs.",
        "Obtain required sensitive-data consent and conduct required assessments."
      ],
      "sources": [
        {
          "url": "https://law.lis.virginia.gov/vacodepopularnames/consumer-data-protection-act/",
          "label": "Virginia Code, Consumer Data Protection Act",
          "pinpoint": "§§59.1-576–584; enactment effective-date clause"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Official consolidated-code host failed DNS resolution. Historical January 1, 2023 date and duties remain review fields.",
        "Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field."
      ],
      "status": "effective",
      "category": "comprehensive-privacy",
      "date_text": "Reported base-law operative date: 2023-01-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "unverified",
          "note": "The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_processing_count": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "sale_revenue_percent": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "revenue_threshold": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "small_business": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail."
        }
      }
    },
    {
      "id": "de-2027-privacy-amendments",
      "ref": "DE 85 DEL LAWS C463",
      "title": "Delaware 2027 privacy coverage and automated-decision amendments",
      "state": "Delaware",
      "state_code": "DE",
      "jurisdiction_type": "state",
      "legal_effective_date": "2027-01-01",
      "operative_date": "2027-01-01",
      "enforcement_date": null,
      "applies_to": "From January 1, 2027, Delaware-targeting persons processing at least 10,000 consumers excluding payment-only processing, or at least 5,000 AND deriving over 20% of gross revenue from sales, plus covered third parties acquiring data from a controller. Exemptions apply.",
      "penalty": "Delaware DOJ enforcement under amended §12D-111; amount not independently summarized.",
      "obligations": [
        "Apply the revised controller/third-party coverage tests.",
        "Provide covered adverse-action notices, data access/correction and technically feasible human review, subject to statutory exceptions.",
        "Apply amended notice, controller-duty and assessment provisions."
      ],
      "sources": [
        {
          "url": "https://delcode.delaware.gov/title6/c012d/index.html",
          "label": "Delaware current code with future versions",
          "pinpoint": "§§12D-102–111 versions expressly labeled Effective Jan. 1, 2027; 85 Del. Laws c463 history"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The current official code explicitly labels the future provisions effective January 1, 2027. The linked session-law endpoint returned an empty chapter shell, so the approval date and bill number are not asserted. This is one distinct amendment instrument, not additional rows for individual duties."
      ],
      "status": "enacted",
      "category": "privacy-amendment",
      "date_text": "Verified operative date: 2027-01-01. ",
      "public": true,
      "legal_status": "enacted",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    },
    {
      "id": "il-biometric-information-privacy-act",
      "ref": "740 ILCS 14",
      "title": "Biometric Information Privacy Act (BIPA)",
      "state": "Illinois",
      "state_code": "IL",
      "jurisdiction_type": "state",
      "legal_effective_date": "2008-10-03",
      "operative_date": "2008-10-03",
      "enforcement_date": null,
      "applies_to": "Private entities collecting or possessing covered biometric identifiers or biometric information; statutory exclusions apply.",
      "penalty": "Private action: negligent violations $1,000 or actual damages, whichever is greater; intentional or reckless violations $5,000 or actual damages, whichever is greater; fees and other relief. Current §20 limits repeated same-method collection and same-recipient disclosure to a single violation per person.",
      "obligations": [
        "Publish and follow a retention/destruction policy: purpose satisfied or three years after the last interaction, whichever comes first.",
        "Before collection, give written notice of collection, purpose and retention term, and obtain a written release.",
        "Do not sell or profit from biometric information; apply the statutory disclosure and protective-storage restrictions."
      ],
      "sources": [
        {
          "url": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57",
          "label": "Illinois General Assembly, 740 ILCS 14",
          "pinpoint": "§§15,20; source notes P.A.95-994 and P.A.103-769"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "P.A.103-769 amended the damages/single-violation provisions effective 2024-08-02; do not multiply a repeat scan into a separate liquidated-damages claim automatically."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2008-10-03; current §20 amendment effective 2024-08-02",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "il-ai-video-interview-act",
      "ref": "820 ILCS 42",
      "title": "Artificial Intelligence Video Interview Act",
      "state": "Illinois",
      "state_code": "IL",
      "jurisdiction_type": "state",
      "legal_effective_date": "2020-01-01",
      "operative_date": "2020-01-01",
      "enforcement_date": null,
      "applies_to": "Employers asking applicants to record video interviews and using AI analysis of those interviews for positions based in Illinois.",
      "penalty": "The cited act does not specify a fixed monetary penalty.",
      "obligations": [
        "Before the interview, notify the applicant of AI use, explain how it works and the general characteristics evaluated, and obtain consent.",
        "Share videos only with people whose expertise or technology is necessary to evaluate the applicant.",
        "On applicant request, delete interviews within 30 days and instruct recipients to delete their copies and backups."
      ],
      "sources": [
        {
          "url": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68",
          "label": "Illinois General Assembly, 820 ILCS 42",
          "pinpoint": "§§5,10,15 and effective-date source notes"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Demographic reporting requirements in §20 apply when the employer relies solely on AI to determine who receives an in-person interview; that later provision is not represented as a separate law."
      ],
      "status": "effective",
      "category": "ai",
      "date_text": "2020-01-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "wa-biometric-identifiers-commercial",
      "ref": "RCW 19.375; HB 1493 (2017)",
      "title": "Commercial biometric identifier enrollment restrictions",
      "state": "Washington",
      "state_code": "WA",
      "jurisdiction_type": "state",
      "legal_effective_date": "2017-07-23",
      "operative_date": "2017-07-23",
      "enforcement_date": null,
      "applies_to": "Non-government persons enrolling biometric identifiers in a database for the chapter’s narrow commercial purpose, including third-party marketing unrelated to the initial transaction; security and law-enforcement uses are excluded.",
      "penalty": "Attorney-General-only enforcement under the Consumer Protection Act; no fixed dollar amount is stated in RCW 19.375.",
      "obligations": [
        "Before commercial enrollment, provide notice and consent or a mechanism to prevent subsequent use for a commercial purpose.",
        "Restrict disclosures and materially inconsistent uses under RCW 19.375.020.",
        "Use reasonable care to secure identifiers and retain them no longer than reasonably necessary under the statute."
      ],
      "sources": [
        {
          "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.375&full=true",
          "label": "Washington Legislature, RCW 19.375",
          "pinpoint": "Definitions; §§19.375.020–.030"
        },
        {
          "url": "https://app.leg.wa.gov/billsummary?BillNumber=1493&Year=2017",
          "label": "Washington Legislature, HB1493 history",
          "pinpoint": "Effective date: 7/23/2017"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The statute allows alternatives to affirmative consent; it is not a universal biometric opt-in statute."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2017-07-23",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "wa-my-health-my-data",
      "ref": "RCW 19.373; HB 1155 (2023)",
      "title": "My Health My Data Act",
      "state": "Washington",
      "state_code": "WA",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2024-03-31",
      "enforcement_date": null,
      "applies_to": "Regulated entities doing business in Washington or targeting Washington consumers and determining consumer-health-data processing; includes small businesses on their later date. Consumers include Washington residents and people whose health data is collected in Washington; employment context is excluded.",
      "penalty": "Consumer Protection Act public and private remedies under RCW 19.373.090; no single fixed cap is stated in the cited chapter.",
      "obligations": [
        "Publish a consumer health data privacy policy with the required categories, purposes and sharing disclosures.",
        "Obtain collection/sharing consent unless the processing is necessary to provide a consumer-requested product or service.",
        "Obtain separate valid authorization before a health-data sale and honor the chapter’s access/deletion rights."
      ],
      "sources": [
        {
          "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true",
          "label": "Washington Legislature, RCW19.373",
          "pinpoint": "§§.010–.070,.090 and effective-date notes"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The principal privacy duties in §§.020–.070 apply 2024-03-31 generally and 2024-06-30 to small businesses. The geofence provision has a different earlier commencement; this row does not label the entire act as first effective in March 2024."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "Principal §§.020–.070 duties: 2024-03-31; small businesses: 2024-06-30",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "wa-government-facial-recognition",
      "ref": "RCW 43.386; SB 6280 (2020)",
      "title": "Government facial recognition services safeguards",
      "state": "Washington",
      "state_code": "WA",
      "jurisdiction_type": "state",
      "legal_effective_date": "2021-07-01",
      "operative_date": "2021-07-01",
      "enforcement_date": null,
      "applies_to": "Washington state and local government agencies using facial recognition services; existing contracts transition on renewal or extension as provided by the chapter.",
      "penalty": "The cited chapter does not specify a fixed civil dollar penalty.",
      "obligations": [
        "Before covered deployment, file a notice of intent and develop the required accountability report and public process.",
        "Provide meaningful human review of facial-recognition results used in consequential decisions.",
        "Meet the chapter’s testing, training and reporting safeguards."
      ],
      "sources": [
        {
          "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=43.386&full=true",
          "label": "Washington Legislature, RCW43.386",
          "pinpoint": "§§.020–.070,.080,.901"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "This is a public-sector deployment law, not a general private-employer or SMB facial-recognition obligation."
      ],
      "status": "effective",
      "category": "ai",
      "date_text": "2021-07-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "nv-consumer-health-data",
      "ref": "SB 370 (2023); NRS 603A.400–.550",
      "title": "Nevada consumer health data privacy law",
      "state": "Nevada",
      "state_code": "NV",
      "jurisdiction_type": "state",
      "legal_effective_date": "2024-03-31",
      "operative_date": "2024-03-31",
      "enforcement_date": null,
      "applies_to": "Regulated entities conducting business in Nevada or targeting Nevada products/services and determining health-data processing; consumers reside in Nevada or have health data collected there in connection with a requested product or service. Statutory exclusions apply.",
      "penalty": "Violations are deceptive trade practices. NRS603A.550 does not create a private right of action and preserves rights under other laws; remedies depend on the applicable enforcement provisions.",
      "obligations": [
        "Publish the required consumer health data privacy policy.",
        "Obtain collection/sharing consent except where necessary for the consumer-requested product or service.",
        "Obtain a separate valid authorization for a sale of consumer health data."
      ],
      "sources": [
        {
          "url": "https://www.leg.state.nv.us/NRS/NRS-603A.html",
          "label": "Nevada Legislature, NRS603A",
          "pinpoint": "§§603A.400–.550"
        },
        {
          "url": "https://www.leg.state.nv.us/Session/82nd2023/Bills/SB/SB370_EN.pdf",
          "label": "Nevada Legislature, enrolled SB370",
          "pinpoint": "§36 effective date; substantive privacy provisions"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2024-03-31",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "nv-online-sale-opt-out",
      "ref": "SB220 (2019); NRS603A.300–.360",
      "title": "Nevada online personal-information sale opt-out",
      "state": "Nevada",
      "state_code": "NV",
      "jurisdiction_type": "state",
      "legal_effective_date": "2019-10-01",
      "operative_date": "2019-10-01",
      "enforcement_date": null,
      "applies_to": "Covered commercial online operators collecting Nevada consumers’ information and purposefully doing business in or targeting Nevada; the current chapter also covers data brokers under later amendments. Statutory financial, health and other exclusions apply.",
      "penalty": "Attorney General may seek an injunction or civil penalty up to $5,000 per violation under NRS603A.360; the chapter does not establish a private right of action.",
      "obligations": [
        "Provide the chapter’s required online privacy notice.",
        "Maintain a designated request address and honor verified requests not to sell covered information.",
        "Respond to verified opt-out requests within 60 days; a reasonably necessary extension may add up to 30 days with notice."
      ],
      "sources": [
        {
          "url": "https://www.leg.state.nv.us/Session/80th2019/Bills/SB/SB220_EN.pdf",
          "label": "Nevada Legislature, enrolled SB220",
          "pinpoint": "§2 sale opt-out; no special effective-date provision"
        },
        {
          "url": "https://www.leg.state.nv.us/NRS/NRS-218D.html",
          "label": "Nevada Legislature, NRS218D.330",
          "pinpoint": "Default October1 commencement for a law without a special date"
        },
        {
          "url": "https://www.leg.state.nv.us/NRS/NRS-603A.html",
          "label": "Nevada Legislature, current NRS603A",
          "pinpoint": "§§.300–.360; current data-broker expansion"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "2019-10-01 is the SB220 opt-out commencement, not the date the later data-broker expansion first applied."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2019-10-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "co-biometric-privacy-2024",
      "ref": "HB24-1130",
      "title": "Privacy of Biometric Identifiers and Data",
      "state": "Colorado",
      "state_code": "CO",
      "jurisdiction_type": "state",
      "legal_effective_date": "2025-07-01",
      "operative_date": "2025-07-01",
      "enforcement_date": null,
      "applies_to": "Persons controlling or processing one or more biometric identifiers, subject to the act’s exceptions; includes specified restrictions on employers obtaining employee biometric consent.",
      "penalty": "Colorado Privacy Act framework; the enacted legislative summary authorizes AG rulemaking but does not establish a verified numeric penalty in this research record.",
      "obligations": [
        "Adopt the required written retention, deletion and security-incident-response policy; make it public except where exempt.",
        "Meet the act’s disclosure and consent requirements before collecting a biometric identifier.",
        "Observe limits on the reasons an employer may obtain consent to collect an employee’s biometric identifiers."
      ],
      "sources": [
        {
          "url": "https://leg.colorado.gov/bills/hb24-1130",
          "label": "Colorado General Assembly, HB24-1130 enacted summary",
          "pinpoint": "Enacted summary; approved2024-05-31; effective2025-07-01"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Distinct 2024 biometric amendment, not another row for the original comprehensive Colorado Privacy Act. The official enacted summary is the retrieved evidence; do not infer a numeric penalty or an unqualified exemption from general thresholds."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2025-07-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "nyc-automated-employment-decision-tools",
      "ref": "NYC Local Law144 (2021); Admin.Code20-870–874",
      "title": "Automated employment decision tool bias audits and notices",
      "state": "New York",
      "state_code": "NY",
      "jurisdiction_type": "local",
      "legal_effective_date": "2023-01-01",
      "operative_date": "2023-01-01",
      "enforcement_date": "2023-07-05",
      "applies_to": "Employers and employment agencies using covered AEDTs for hiring/promotion screening in New York City; notices apply to covered candidates and employees residing in the city. Official DCWP guidance includes specified NYC-office-linked remote roles.",
      "penalty": "Up to $500 for the first violation and additional violations that day; $500–$1,500 for each subsequent violation. Each unlawful-use day and each required-notice failure can be a separate violation.",
      "obligations": [
        "Obtain an independent bias audit no more than one year before covered tool use.",
        "Publish the required summary of audit results and the tool’s distribution date before use.",
        "Provide required AEDT and qualification/characteristic notices at least ten business days before use."
      ],
      "sources": [
        {
          "url": "https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=4344524&GUID=B051915D-A9AC-451E-81F8-6596032FA3F9",
          "label": "New York City Council, Local Law144 final text",
          "pinpoint": "§§20-871–.874; §2 effective date"
        },
        {
          "url": "https://www.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page",
          "label": "NYC DCWP, AEDT FAQ",
          "pinpoint": "FAQ1 effective/enforcement dates; FAQ4 NYC scope"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [],
      "status": "effective",
      "category": "ai",
      "date_text": "Legal effective date2023-01-01; DCWP enforcement2023-07-05",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "verified",
          "note": "The separately identified enforcement date is established by the cited source."
        }
      }
    },
    {
      "id": "ny-shield-data-security",
      "ref": "SHIELD Act; GBL899-aa/899-bb; S5575B (2019)",
      "title": "SHIELD Act private-information security safeguards",
      "state": "New York",
      "state_code": "NY",
      "jurisdiction_type": "state",
      "legal_effective_date": "2019-10-23",
      "operative_date": "2020-03-21",
      "enforcement_date": null,
      "applies_to": "Persons or businesses owning or licensing computerized data containing New York residents’ private information; size-appropriate safeguards and statutory deemed-compliance provisions apply.",
      "penalty": "Official AG guidance: up to $5,000 per violation for inadequate safeguards; notification failures up to $20 per failed instance, capped at $250,000; injunctive relief and restitution also available.",
      "obligations": [
        "Maintain reasonable administrative safeguards including responsible staff, risk assessment, training and service-provider controls.",
        "Maintain reasonable technical safeguards covering network/software risks, attack detection, response and testing.",
        "Maintain reasonable physical safeguards and securely dispose of private information when no longer needed for business purposes."
      ],
      "sources": [
        {
          "url": "https://ag.ny.gov/resources/organizations/data-breach-reporting/shield-act",
          "label": "New York Attorney General, SHIELD Act guidance",
          "pinpoint": "Signature2019-07-25; coverage, safeguards and penalties"
        },
        {
          "url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S05575&term=2019&Summary=Y&Text=Y",
          "label": "New York Assembly, S5575B final text",
          "pinpoint": "§4 addsGBL899-bb; §6 commencement90days generally and240days for§4"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The 90-day and 240-day clauses, counted from the AG-confirmed signature date, give2019-10-23 for the general breach amendments and2020-03-21 for safeguards. This row focuses on safeguards and does not present its later date as the start of every SHIELD provision."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "General breach amendments2019-10-23; §4 safeguards2020-03-21",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "vt-data-broker-registration-security",
      "ref": "9VSA2446–2447; Act171 (2018)",
      "title": "Vermont data broker registration and security",
      "state": "Vermont",
      "state_code": "VT",
      "jurisdiction_type": "state",
      "legal_effective_date": "2019-01-01",
      "operative_date": "2019-01-01",
      "enforcement_date": null,
      "applies_to": "Businesses knowingly collecting and selling or licensing brokered personal information of consumers with whom they lack a direct relationship, subject to statutory exclusions.",
      "penalty": "Through2026, registration failure: $50 per day, capped at $10,000 per year, plus unpaid fees and other lawful relief; AG may seek collection and injunctions. Future2027 provisions have different penalties.",
      "obligations": [
        "Under the version in effect through2026, register by January31 following a qualifying year, pay the $100 fee and submit required practice/minor/breach disclosures.",
        "Maintain the written comprehensive information-security program required by§2447.",
        "Apply appropriate access controls, employee training, encryption and service-provider safeguards required by§2447."
      ],
      "sources": [
        {
          "url": "https://legislature.vermont.gov/statutes/section/09/062/02430",
          "label": "Vermont Legislature, 9VSA2430",
          "pinpoint": "Data-broker and brokered-information definitions"
        },
        {
          "url": "https://legislature.vermont.gov/statutes/section/09/062/02446",
          "label": "Vermont Legislature, 9VSA2446",
          "pinpoint": "Version effective until2027-01-01; effective2019-01-01 history; penalties"
        },
        {
          "url": "https://legislature.vermont.gov/statutes/section/09/062/02447",
          "label": "Vermont Legislature, 9VSA2447",
          "pinpoint": "Written security-program requirements"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Current online code also contains a future version effective2027-01-01 with30-day/July1 registration, $900 fee and bond requirements. Those future requirements are not represented as in force in2026 or counted as another row."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2019-01-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "or-data-broker-registration",
      "ref": "HB2052 (2023); ORS646A.593",
      "title": "Oregon data broker registration",
      "state": "Oregon",
      "state_code": "OR",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2024-01-01",
      "enforcement_date": null,
      "applies_to": "Businesses collecting and selling or licensing brokered personal data of Oregon residents, subject to the act’s direct-relationship, FCRA, GLBA and other exclusions.",
      "penalty": "Civil penalty up to $500 per violation or continuing-violation day, capped at $10,000 per calendar year under ORS646A.593.",
      "obligations": [
        "Register with the Department of Consumer and Business Services before engaging in covered data-broker business.",
        "Pay the registration fee and renew the registration each calendar year.",
        "Submit the required contact information and disclosures about consumer opt-out practices."
      ],
      "sources": [
        {
          "url": "https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2023orLaw0395.pdf",
          "label": "Oregon Legislature,2023ch395 enrolled HB2052",
          "pinpoint": "Registration provisions; operative2024-01-01 clause"
        },
        {
          "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html",
          "label": "Oregon Legislature, ORS646A",
          "pinpoint": "§646A.593"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The act has an emergency clause, but the business registration provisions become operative2024-01-01; no unsupported signature date is assigned as the legal-effective date."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2024-01-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "or-connected-device-security",
      "ref": "HB2395 (2019); ORS646A.813",
      "title": "Connected-device reasonable security",
      "state": "Oregon",
      "state_code": "OR",
      "jurisdiction_type": "state",
      "legal_effective_date": "2020-01-01",
      "operative_date": "2020-01-01",
      "enforcement_date": null,
      "applies_to": "Manufacturers of connected devices sold or offered for sale in Oregon, subject to the statutory definitions and exclusions.",
      "penalty": "Enforced as an unlawful trade practice; no fixed numeric civil penalty is specified in the retrieved device-security provision.",
      "obligations": [
        "Equip a covered device with reasonable security appropriate to its nature, function and collected or transmitted information.",
        "Protect the device and its stored information against unauthorized access, destruction, use, modification or disclosure.",
        "Where authentication outside a local-area network is possible, use a unique preprogrammed password or require the user to create a new means of authentication before first access."
      ],
      "sources": [
        {
          "url": "https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2019orLaw0193.pdf",
          "label": "Oregon Legislature,2019ch193 enrolled HB2395",
          "pinpoint": "Connected-device duties and2020-01-01 effective clause"
        },
        {
          "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html",
          "label": "Oregon Legislature, ORS646A",
          "pinpoint": "§646A.813"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2020-01-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "ut-generative-ai-consumer-disclosures",
      "ref": "SB226 (2025); UtahCode13-75-101–106",
      "title": "Generative AI consumer and regulated-service disclosures",
      "state": "Utah",
      "state_code": "UT",
      "jurisdiction_type": "state",
      "legal_effective_date": "2025-05-07",
      "operative_date": "2025-05-07",
      "enforcement_date": null,
      "applies_to": "Persons using or providing generative AI in covered consumer transactions; individuals in regulated occupations have additional duties for high-risk AI interactions.",
      "penalty": "Division administrative fine or court fine up to $2,500 per violation; violating an administrative or court order may incur up to $5,000 per violation, plus available relief and costs.",
      "obligations": [
        "In a covered consumer interaction, disclose that the person is interacting with generative AI when the consumer unambiguously asks.",
        "For regulated services involving high-risk AI interaction, prominently disclose AI use verbally at the start of a verbal interaction and in writing before a written interaction.",
        "Comply with regulated-occupation requirements and do not treat generative-AI use as a defense to consumer-protection liability."
      ],
      "sources": [
        {
          "url": "https://le.utah.gov/~2025/bills/sbillenr/SB0226.pdf",
          "label": "Utah Legislature, enrolled SB226",
          "pinpoint": "§§13-75-102–.106; §8 repeal; §9 effective date"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Use the2025 replacement in Title13Chapter75. The original2024 SB149/Chapter72 disclosure provision was repealed; it is not a second current law or a source for the old broader regulated-service disclosure formulation."
      ],
      "status": "effective",
      "category": "ai",
      "date_text": "2025-05-07",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "tx-data-broker-registration-security",
      "ref": "SB2105 (2023); Business&CommerceCodeCh509",
      "title": "Texas data broker registration and security",
      "state": "Texas",
      "state_code": "TX",
      "jurisdiction_type": "state",
      "legal_effective_date": "2023-09-01",
      "operative_date": "2023-12-01",
      "enforcement_date": null,
      "applies_to": "Covered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more than50% of revenue from processing/transferring such data or derive revenue from doing so for more than50,000 Texas individuals; statutory data/entity exemptions apply.",
      "penalty": "Notice/registration violations: at least $100 per day plus unpaid fees, with a $10,000 cap for the same broker in12months; security-program violations are deceptive trade practices.",
      "obligations": [
        "Register with the secretary of state to conduct covered business, pay the statutory $300 fee and renew on the registration anniversary.",
        "Post the required conspicuous data-broker notice on a maintained website or mobile app.",
        "Maintain a written comprehensive information-security program with administrative, technical and physical safeguards."
      ],
      "sources": [
        {
          "url": "https://capitol.texas.gov/tlodocs/88R/billtext/html/SB02105F.htm",
          "label": "Texas Legislature, enrolled SB2105",
          "pinpoint": "§§509.001–.009; Act§§2–4"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Act legal-effective date2023-09-01; Chapter509 applies to processing from2023-12-01. Section2 required registration rules by2023-12-01 with adequate compliance time. This row does not invent a first registration deadline from the processing date."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "Act effective2023-09-01; covered processing from2023-12-01; initial registration timing subject to implementing rules",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "tn-elvis-ai-voice-likeness",
      "ref": "PublicChapter588 (2024); HB2091/SB2096",
      "title": "ELVIS Act voice and likeness protections",
      "state": "Tennessee",
      "state_code": "TN",
      "jurisdiction_type": "state",
      "legal_effective_date": "2024-07-01",
      "operative_date": "2024-07-01",
      "enforcement_date": null,
      "applies_to": "Persons undertaking covered unauthorized name, photograph, voice or likeness uses, including specified dissemination and tools/services primarily intended to produce unauthorized representations; statutory speech, fair-use and other exceptions apply.",
      "penalty": "Civil action, injunctions and damages/remedies under the act; no fixed dollar penalty is asserted from the retrieved final legislative summary.",
      "obligations": [
        "Obtain authorization for covered commercial uses of another person’s protected name, photograph, voice or likeness.",
        "Avoid covered knowing unauthorized publication, distribution or transmission of another person’s voice or likeness.",
        "Authorization requirements and statutory exceptions apply to covered technology or services primarily intended to produce unauthorized protected representations."
      ],
      "sources": [
        {
          "url": "https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=SB2096&GA=113",
          "label": "Tennessee General Assembly, SB2096/HB2091 history and amended summary",
          "pinpoint": "Companion becamePublicChapter588; signed2024-03-21; effective2024-07-01; adoptedHouseAmendment1"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The retrieved official history and summary include the adopted House amendment and final enactment. The introduced SB2096 PDF is not used as if it were final enacted text."
      ],
      "status": "effective",
      "category": "ai",
      "date_text": "2024-07-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "ct-consumer-health-privacy-2023",
      "ref": "PublicAct23-56 §2",
      "title": "Consumer health data consent, confidentiality and geofencing",
      "state": "Connecticut",
      "state_code": "CT",
      "jurisdiction_type": "state",
      "legal_effective_date": "2023-07-01",
      "operative_date": "2023-07-01",
      "enforcement_date": null,
      "applies_to": "Persons doing business in Connecticut or targeting products/services to residents when processing covered consumer health data, without the general CTDPA volume thresholds; §2 entity and data exemptions apply.",
      "penalty": "AG enforcement under the Connecticut privacy/consumer-protection framework; no fixed dollar cap is asserted from the cited health amendment.",
      "obligations": [
        "Permit employee or contractor access to consumer health data only under a contractual or statutory confidentiality duty and use compliant processor arrangements.",
        "Do not sell or offer to sell consumer health data without first obtaining consumer consent.",
        "Do not use a geofence within1,750feet of a mental-health or reproductive/sexual-health facility for the prohibited health-data identification, tracking, collection or notification purposes."
      ],
      "sources": [
        {
          "url": "https://www.cga.ct.gov/2023/ACT/PA/PDF/2023PA-00056-R00SB-00003-PA.PDF",
          "label": "Connecticut General Assembly, PublicAct23-56",
          "pinpoint": "§2 effective2023-07-01, duties and scope; §§3,5–6 exemptions/enforcement"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Distinct2023 consumer-health amendment, not a second row for the original2022 comprehensive CTDPA or its2025/2026 amendments. The enacted §2 distance is1,750feet, not2,000feet."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2023-07-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "mn-social-media-mental-health-label",
      "ref": "1Sp2025ch3 art19§§13–14; Minn.Stat.325M.335",
      "title": "Social media mental health warning label",
      "state": "Minnesota",
      "state_code": "MN",
      "jurisdiction_type": "state",
      "legal_effective_date": null,
      "operative_date": "2026-07-01",
      "enforcement_date": null,
      "applies_to": "Covered social media platforms under Minn.Stat.325M.31–.32: doing business in or targeting Minnesota and having more than10,000 monthly active Minnesota account holders; statutory platform exclusions apply.",
      "penalty": "Minnesota AG may investigate and bring an action under§325M.34; no fixed monetary amount is stated in these sections.",
      "obligations": [
        "Show the required conspicuous mental-health warning each time a user accesses the covered platform.",
        "Keep the warning visible until the user exits or acknowledges the risk and chooses to proceed; do not permit blanket disabling or obscure it in terms.",
        "Follow commissioner-developed label guidelines and provide access to mental-health resources, including a national crisis hotline such as988."
      ],
      "sources": [
        {
          "url": "https://www.revisor.mn.gov/statutes/cite/325M/full",
          "label": "Minnesota Revisor of Statutes, Chapter325M",
          "pinpoint": "§§325M.31–.32,.335,.34; history1Sp2025ch3art19§§13–14"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The statutory user-facing commencement is2026-07-01; the2026-03-01 date is the commissioner’s guideline-development deadline, not a second business obligation or a second row. Current codified text was retrieved and read."
      ],
      "status": "effective",
      "category": "targeted-privacy",
      "date_text": "2026-07-01",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "unverified",
          "note": "No distinct legal-effective date was established; do not substitute the operative/compliance date."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "mn-addictive-social-media-2026",
      "ref": "2026ch111§2; Minn.Stat.325M.40",
      "title": "Stop Harms from Addictive Social Media",
      "state": "Minnesota",
      "state_code": "MN",
      "jurisdiction_type": "state",
      "legal_effective_date": "2027-07-01",
      "operative_date": "2027-07-01",
      "enforcement_date": null,
      "applies_to": "Covered social media platforms with10,000 or more account holders or at least$1billion worldwide revenues in any of the preceding3years; duties concern covered Minnesota account holders and children age15or younger, subject to definitions and exclusions.",
      "penalty": "Private child/parent action: actual damages or$10,000 statutory damages, whichever greater, for reckless/knowing violations; possible punitive damages for a consistent pattern, other relief and fees. Knowing/reckless violations also permit AG deceptive-trade-practice enforcement; reasonable-efforts defense applies.",
      "obligations": [
        "Estimate age on the statutory usage/time schedule; obtain verifiable parental consent to create or continue a child account and retain consent records.",
        "Default child accounts to the most private settings and provide the required parental time-monitoring and limit controls.",
        "Do not show addictive interface features or targeted paid commercial advertising to child accounts; meet account-termination deadlines."
      ],
      "sources": [
        {
          "url": "https://www.revisor.mn.gov/statutes/cite/325M/full",
          "label": "Minnesota Revisor of Statutes, Chapter325M",
          "pinpoint": "§325M.40subds1–10;2026ch111§2 history and2027-07-01 effective-date note"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Enacted with future commencement2027-07-01, applying to accounts created before/on/after that date. It must render as enacted/upcoming in2026, never in force. This is a distinct2026 instrument, not a milestone row for the2025 warning-label law."
      ],
      "status": "enacted",
      "category": "targeted-privacy",
      "date_text": "2027-07-01; applies to accounts created before, on or after that date",
      "public": true,
      "legal_status": "enacted",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "us-ftc-health-breach-2024",
      "ref": "16 CFR 318; 89 FR 47028",
      "title": "FTC Health Breach Notification Rule — 2024 amendments",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2024-07-29",
      "operative_date": "2024-07-29",
      "enforcement_date": null,
      "applies_to": "Foreign and domestic vendors of personal health records, PHR-related entities and third-party service providers maintaining information of U.S. citizens or residents. Excludes HIPAA-covered entities and other entities to the extent they act as a HIPAA business associate; coverage is not limited by FTC Act jurisdictional tests.",
      "penalty": "FTC enforcement under the applicable statutory framework; no current adjusted civil-penalty dollar amount independently verified.",
      "obligations": [
        "Assess unauthorized acquisition or disclosure of unsecured PHR-identifiable health information as a potential breach, including unauthorized access unless rebutted with reliable evidence.",
        "Notify affected individuals, the FTC and qualifying media under the rule; third-party service providers notify the PHR vendor or related entity.",
        "Follow the amended timing, content and delivery requirements and retain evidence supporting compliance and any delay."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule",
          "label": "FTC final rule, 89 FR 47028",
          "pinpoint": "DATES; 16 CFR 318.1–318.7"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "This row is the distinct 2024 final amendment to the existing HBNR, not a claim that the underlying HBNR began in 2024. The amended text, including scope, was directly read. FTC notice for breaches involving at least 500 individuals is contemporaneous with required individual notice; the obsolete ten-business-day rule is not represented."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective date: 2024-07-29; principal compliance date: 2024-07-29.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    },
    {
      "id": "us-sec-regulation-sp-2024",
      "ref": "17 CFR 248.30; 89 FR 47688",
      "title": "SEC Regulation S-P — incident response and customer-notification amendments",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2024-08-02",
      "operative_date": "2025-12-03",
      "enforcement_date": null,
      "applies_to": "Covered brokers and dealers, investment companies, SEC-registered investment advisers and transfer agents registered with the SEC or another appropriate regulatory agency. Funding portals follow the applicable requirements through Regulation Crowdfunding. Larger and smaller covered institutions have different compliance periods.",
      "penalty": "SEC enforcement under applicable securities statutes; no universal or current adjusted dollar cap independently verified.",
      "obligations": [
        "Adopt and maintain written incident-response policies to detect, respond to and recover from unauthorized access to or use of customer information.",
        "Provide the required customer notices as soon as reasonably practicable and generally within 30 days, subject to the rule’s investigation exceptions and authorized delay provisions.",
        "Oversee service providers, safeguard and dispose of covered information, and maintain the required written records."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information",
          "label": "SEC final rule, 89 FR 47688",
          "pinpoint": "DATES; section II.F; final 17 CFR 248.30; funding-portal discussion"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Legal effective date is August 2, 2024. Section II.F phases compliance 18 months after June 3, 2024 publication for larger covered institutions (December 3, 2025) and 24 months for smaller covered institutions (June 3, 2026). The operative-date field carries the first cohort; the later cohort is explicit here. This does not cover every financial business."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective date: 2024-08-02. Larger covered institutions: compliance 2025-12-03; smaller covered institutions: compliance 2026-06-03.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    },
    {
      "id": "us-doj-data-security-2025",
      "ref": "28 CFR 202; 90 FR 1636",
      "title": "DOJ Data Security Program — countries-of-concern data transactions",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2025-04-08",
      "operative_date": "2025-04-08",
      "enforcement_date": null,
      "applies_to": "U.S. persons engaging in defined covered data transactions involving bulk U.S. sensitive personal data or U.S. government-related data and countries of concern or covered persons. Transaction categories, data thresholds, exemptions and licensing rules control; this is not a general ban on all cross-border data flows.",
      "penalty": "Civil and, for willful violations, criminal enforcement under IEEPA and 28 CFR 202 subpart M; current adjusted dollar amounts not independently verified.",
      "obligations": [
        "Identify covered counterparties, covered data and transactions; avoid prohibited data-brokerage and other prohibited transactions unless authorized.",
        "Conduct restricted transactions only when authorized and compliant with the applicable security requirements.",
        "Perform applicable due diligence, audits, recordkeeping and reporting, including the phased-in obligations."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern",
          "label": "DOJ final rule, 90 FR 1636",
          "pinpoint": "DATES; preamble effective-date discussion; 28 CFR 202.101, 202.216, subparts C–E, J–M"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The final rule and codified section 202.216 identify April 8, 2025 as the legal effective date. Due diligence and audit requirements in sections 202.1001–1002 and specified reporting requirements in sections 202.1103–1104 apply to relevant transactions (or rejected proposed transactions) on or after October 6, 2025. No claim is made that every reporting provision started in October."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective / principal operative date: 2025-04-08. Sections 202.1001–1002 and 202.1103–1104 apply to the relevant transactions from 2025-10-06.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    },
    {
      "id": "us-ftc-safeguards-2021",
      "ref": "16 CFR 314; 86 FR 70272",
      "title": "FTC Safeguards Rule — 2021 security-program amendments",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2022-01-10",
      "operative_date": "2023-06-09",
      "enforcement_date": null,
      "applies_to": "Financial institutions within FTC Safeguards Rule jurisdiction that handle covered customer information, including applicable non-bank financial institutions and finders. Institutions maintaining customer information concerning fewer than 5,000 consumers have specified exceptions, not a complete exemption.",
      "penalty": "FTC enforcement under the applicable statutory framework; no general private damages right or current dollar penalty amount asserted.",
      "obligations": [
        "Designate a qualified individual and maintain a written information-security program based on risk assessment.",
        "Implement applicable access controls, encryption or approved compensating controls, multifactor authentication or approved equivalents, testing and secure disposal.",
        "Oversee service providers and implement applicable incident-response, reporting and board-governance controls, respecting the limited small-institution exceptions."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2021/12/09/2021-25736/standards-for-safeguarding-customer-information",
          "label": "FTC final rule, 86 FR 70272",
          "pinpoint": "DATES; 16 CFR 314.1–314.5"
        },
        {
          "url": "https://www.federalregister.gov/documents/2022/11/23/2022-25201/standards-for-safeguarding-customer-information",
          "label": "FTC compliance extension, 87 FR 71509",
          "pinpoint": "DATES; amended 16 CFR 314.5"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Some provisions became effective January 10, 2022. The separately sourced extension moved the specified provisions originally due December 9, 2022 to June 9, 2023. The extension is supporting evidence for this row and is not counted as a separate instrument. This row covers the 2021 security-program amendment, not later breach-reporting amendments."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective date: 2022-01-10; principal compliance date: 2023-06-09.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        }
      }
    },
    {
      "id": "us-ftc-glba-privacy-base",
      "ref": "16 CFR 313; 65 FR 33646",
      "title": "FTC GLBA Privacy Rule — original final rule",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2000-11-13",
      "operative_date": "2001-07-01",
      "enforcement_date": null,
      "applies_to": "Historical original rule for financial institutions under FTC privacy-rule jurisdiction. Present jurisdiction following the CFPB transfer, including the retained motor-vehicle-dealer scope and later exceptions, has not been independently reconciled in this review.",
      "penalty": "Agency enforcement under GLBA and applicable FTC authority; no current universal dollar penalty independently verified.",
      "obligations": [
        "Provide the applicable privacy notices describing policies and practices for nonpublic personal information.",
        "Satisfy applicable notice and opt-out conditions before disclosures to nonaffiliated third parties, subject to statutory and regulatory exceptions.",
        "Observe applicable redisclosure and reuse limits for information received from another financial institution."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2000/05/24/00-12755/privacy-of-consumer-financial-information",
          "label": "FTC original final rule, 65 FR 33646",
          "pinpoint": "EFFECTIVE DATE; 16 CFR 313.1, 313.4–313.15"
        }
      ],
      "verification_status": "needs_review",
      "verification_notes": [
        "Original effective date November 13, 2000 and full-compliance date July 1, 2001 are directly verified from the original final rule. Current FTC versus CFPB jurisdiction and later annual-notice exceptions remain unresolved. The rule is enacted and in force; flag current jurisdiction and duty details per field without downgrading legal status."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective date: 2000-11-13; principal compliance date: 2001-07-01.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "Original full-compliance date July 1, 2001 is directly established by the original final rule."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "covered_roles": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "sectors": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "territorial_nexus": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "obligation_1": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "obligation_2": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "obligation_3": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        },
        "privacy_notice": {
          "status": "unverified",
          "note": "Unverified: current FTC/CFPB jurisdiction and later annual-notice exceptions have not been reconciled against the original final rule."
        }
      }
    },
    {
      "id": "us-hipaa-security-base",
      "ref": "45 CFR 164 subpart C; 68 FR 8334",
      "title": "HIPAA Security Rule — original final security standards",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2003-04-21",
      "operative_date": "2005-04-21",
      "enforcement_date": null,
      "applies_to": "For this original-rule record: HIPAA-covered health plans, health care clearinghouses and health care providers that conduct covered electronic transactions, protecting electronic PHI. Small health plans had an additional year. Later direct business-associate duties are not attributed to this 2003 instrument.",
      "penalty": "HHS enforcement under HIPAA’s applicable civil and criminal statutory framework; no current adjusted dollar amounts independently verified.",
      "obligations": [
        "Implement required administrative, physical and technical safeguards to protect electronic PHI.",
        "Perform risk analysis and risk management and apply reasonable and appropriate safeguards, including evaluating addressable implementation specifications.",
        "Maintain required security policies, procedures, documentation and business-associate contractual assurances under the original rule."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2003/02/20/03-3877/health-insurance-reform-security-standards",
          "label": "HHS original final rule, 68 FR 8334",
          "pinpoint": "DATES; 45 CFR 164.302–164.318; original scope and business-associate provisions"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "Legal effective date April 21, 2003; covered entities other than small health plans had to comply by April 21, 2005; small plans by April 21, 2006. This distinct foundational instrument is not an assertion that later amendments and direct business-associate liability are fully summarized here."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective date: 2003-04-21. General covered-entity compliance: 2005-04-21; small-health-plan compliance: 2006-04-21.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    },
    {
      "id": "us-ftc-disposal-rule",
      "ref": "16 CFR 682; 69 FR 68690",
      "title": "FTC Disposal Rule — consumer-report information and records",
      "state": null,
      "state_code": null,
      "jurisdiction_type": "federal",
      "legal_effective_date": "2005-06-01",
      "operative_date": "2005-06-01",
      "enforcement_date": null,
      "applies_to": "Persons within FTC jurisdiction that maintain or otherwise possess consumer information derived from consumer reports for a business purpose; can include users of consumer reports and service providers. This is not a universal disposal rule for every type of personal information.",
      "penalty": "FTC and other applicable FCRA enforcement; no universal or current adjusted dollar amount independently verified.",
      "obligations": [
        "Take reasonable measures to prevent unauthorized access to or use of covered consumer information in connection with its disposal.",
        "Implement and monitor appropriate paper-destruction and electronic-media erasure or destruction practices; the rule’s examples are illustrative rather than exclusive safe harbors.",
        "Where using a disposal contractor, perform appropriate due diligence and monitor contractual compliance; preserve retention duties imposed by other law."
      ],
      "sources": [
        {
          "url": "https://www.federalregister.gov/documents/2004/11/24/04-25937/disposal-of-consumer-report-information-and-records",
          "label": "FTC final rule, 69 FR 68690",
          "pinpoint": "DATES; 16 CFR 682.1–682.5, especially 682.3 examples and 682.4"
        }
      ],
      "verification_status": "verified",
      "verification_notes": [
        "The June 1, 2005 legal effective date is explicit. Section 682.4 neither creates a new retention period nor alters other legal retention or destruction duties. No fixed vendor-audit method is presented as compulsory: the examples are illustrative."
      ],
      "status": "effective",
      "category": "federal-privacy",
      "date_text": "Legal effective date: 2005-06-01; principal compliance date: 2005-06-01.",
      "public": true,
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Actual legal status is separate from verification of thresholds, dates and other detail fields."
        },
        "operative_date": {
          "status": "verified",
          "note": "The operative/cohort date and its qualifications are established by the cited primary source."
        },
        "legal_effective_date": {
          "status": "verified",
          "note": "The legal effective date is established by the cited primary text."
        },
        "enforcement_date": {
          "status": "unverified",
          "note": "No distinct enforcement-start date was established."
        },
        "penalty_amount": {
          "status": "unverified",
          "note": "Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description."
        }
      }
    }
  ],
  "enrichments": [
    {
      "id": "in-consumer-data-protection",
      "category": "comprehensive-privacy"
    },
    {
      "id": "ky-consumer-data-protection",
      "category": "comprehensive-privacy"
    },
    {
      "id": "ri-data-transparency-privacy",
      "category": "comprehensive-privacy",
      "obligations": [
        "Covered commercial websites/services collecting, storing and selling personally identifiable information provide the separate §3 disclosures; the main controller thresholds differ."
      ]
    },
    {
      "id": "or-universal-opt-out",
      "category": "comprehensive-privacy",
      "obligations": [
        "Covered controllers honor qualifying universal opt-out signals from January 1, 2026."
      ]
    },
    {
      "id": "md-online-data-privacy",
      "category": "comprehensive-privacy",
      "obligations": [
        "Apply the strict data-minimization requirements within MODPA scope.",
        "Apply MODPA sensitive-data limitations, subject to state-specific exemptions."
      ]
    },
    {
      "id": "or-hb2008-children-location",
      "category": "privacy-amendment",
      "obligations": [
        "No targeted advertising or consequential profiling when the controller knows or willfully disregards that the consumer is under 16.",
        "Do not sell those minors’ personal data.",
        "Do not sell data locating a person/device within 1,750 feet, subject to the statutory exclusions."
      ]
    },
    {
      "id": "md-hb711-geolocation",
      "category": "privacy-amendment",
      "obligations": [
        "Apply the expanded precise-geolocation definition for a person/device/vehicle within 1,750 feet.",
        "Observe covered personal-data-sale restrictions involving government units and civil immigration enforcement."
      ]
    },
    {
      "id": "ca-ab2013-training-data",
      "category": "ai",
      "obligations": [
        "Post required GenAI training-data transparency information by January 1, 2026 and before subsequent new or substantially modified releases."
      ]
    },
    {
      "id": "ca-sb53-frontier-ai",
      "category": "ai",
      "obligations": [
        "Large frontier developers meet the applicable safety-framework and reporting duties.",
        "Covered frontier developers meet the applicable transparency, incident and employee-protection provisions."
      ]
    },
    {
      "id": "ca-sb243-companion-chatbots",
      "category": "ai",
      "obligations": [
        "Provide the required AI disclosures within the companion-chatbot scope.",
        "Maintain the required self-harm protocols and known-minor safeguards.",
        "Annual suicide-prevention reporting begins July 1, 2027."
      ]
    },
    {
      "id": "ca-ai-transparency-ab853",
      "category": "ai",
      "obligations": [
        "Covered providers supply free detection tools.",
        "Meet the applicable provenance and disclosure duties; platform/hosting and capture-device duties have later milestones."
      ]
    },
    {
      "id": "ca-ccpa-risk-assessments",
      "category": "privacy-amendment",
      "obligations": [
        "Assess covered new significant-risk processing before initiating it from January 1, 2026.",
        "Assess existing continuing covered processing by December 31, 2027.",
        "Submit first required assessment summaries to CPPA by April 1, 2028."
      ]
    },
    {
      "id": "ca-drop-delete-act",
      "category": "targeted-privacy",
      "obligations": [
        "Registered data brokers process DROP deletion requests from August 1, 2026, at least once every 45 days, subject to exceptions."
      ]
    },
    {
      "id": "tx-hb149-responsible-ai",
      "category": "ai",
      "obligations": [
        "Apply the actor- and use-specific AI restrictions in the enacted act.",
        "Provide governmental-AI and healthcare disclosures where the specific provisions apply."
      ]
    },
    {
      "id": "il-hb3773-employment-ai",
      "category": "ai",
      "obligations": [
        "Do not use AI in ways producing protected-class discrimination in covered employment decisions.",
        "Do not use ZIP codes as protected-class proxies.",
        "Provide employee notice under the statutory requirement and applicable DHR rules."
      ]
    },
    {
      "id": "co-sb26189-ai-consequential-decisions",
      "category": "ai"
    },
    {
      "id": "ny-raise-act-candidate",
      "category": "ai",
      "legal_status": "enacted",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "Official New York Senate history records signed chapter 699 on December 19, 2025; enactment is established."
        },
        "operative_date": {
          "status": "unverified",
          "note": "Unverified: the current amended operative schedule was not independently validated."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: current amended coverage was not independently validated."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: current amended duties were not independently validated."
        }
      }
    },
    {
      "id": "ct-pa25113-privacy-amendments",
      "category": "privacy-amendment",
      "legal_status": "enacted",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "The identified public act is enacted; uncertainty over the exact section/date pairing does not make it a pending bill."
        },
        "operative_date": {
          "status": "unverified",
          "note": "Unverified: exact enacted section/date pairing and phase schedule were not independently extracted."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: guidance-derived amended scope needs reconciliation with the exact enacted provisions."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: amended threshold logic and its operative version need primary-text confirmation."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: exact amended consumer threshold and operative version need primary-text confirmation."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: exact amended duties and their phases need primary-text confirmation."
        }
      }
    },
    {
      "id": "ct-pa2664-privacy-amendments",
      "category": "privacy-amendment",
      "legal_status": "enacted",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "The identified public act is enacted; uncertainty over the exact section/date pairing does not make it a pending bill."
        },
        "operative_date": {
          "status": "unverified",
          "note": "Unverified: exact enacted section/date pairing and phase schedule were not independently extracted."
        },
        "applies_to": {
          "status": "unverified",
          "note": "Unverified: guidance-derived amended scope needs reconciliation with the exact enacted provisions."
        },
        "threshold_logic": {
          "status": "unverified",
          "note": "Unverified: amended threshold logic and its operative version need primary-text confirmation."
        },
        "consumer_count": {
          "status": "unverified",
          "note": "Unverified: exact amended consumer threshold and operative version need primary-text confirmation."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: exact amended duties and their phases need primary-text confirmation."
        }
      }
    },
    {
      "id": "federal-coppa-amendments",
      "category": "federal-privacy",
      "obligations": [
        "Obtain separate parental consent for covered third-party disclosures where the amended rule requires it.",
        "Apply the amended retention, security and personal-information provisions, subject to the specified §312.11 exceptions."
      ]
    },
    {
      "id": "federal-part2-confidentiality",
      "category": "federal-privacy",
      "obligations": [
        "Apply the amended Part 2 consent and redisclosure requirements within the rule’s scope.",
        "Apply the amended patient notices and breach-notification requirements."
      ]
    },
    {
      "id": "ca-ab406-paid-sick-leave",
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "The AB 406 update took effect January 1, 2026; uncertainty over attribution of listed permitted uses does not alter that status."
        },
        "operative_date": {
          "status": "verified",
          "note": "The AB 406 update date is established in the original T1 row."
        },
        "obligation_attribution": {
          "status": "unverified",
          "note": "Unverified: the combined AB 406/AB 2499 explanation does not establish that every listed permitted use first became available in 2026."
        },
        "obligations": {
          "status": "unverified",
          "note": "Unverified: attribution of the combined list of permitted uses to this particular amendment requires reconciliation."
        }
      }
    },
    {
      "id": "me-paid-family-medical-leave",
      "legal_status": "effective",
      "legal_status_verification": "verified",
      "field_verification": {
        "legal_status": {
          "status": "verified",
          "note": "The Maine PFML statutory program is enacted and in force; the separate rollout/suspension question does not make the law pending."
        },
        "operative_date": {
          "status": "verified",
          "note": "The statutory May 1, 2026 claims-processing schedule is established, subject to the expressly stated suspension provision."
        },
        "benefit_rollout": {
          "status": "unverified",
          "note": "Unverified: actual rollout and absence of a separate actuarial suspension order were not independently established."
        }
      }
    }
  ]
}
```