Data Protection Monitor · Cross-Jurisdiction Domain Hub
Automated decision-making & biometrics
Jurisdiction Readings (167 markets)
3 Confirmed
115 Probable
49 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Amber | While the Malabo Convention itself does not address AI/algorithmic governance in the materials reviewed, the AU Executive Council endorsed a (non-binding) Continental AI Strategy in July 2024 that… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Amber | Alabama's algorithmic/biometric governance activity in 2026 clusters around AI-specific bills: Senate Bill 129 (AI-generated content transparency, disclosures and metadata marking, enforcement from 1… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Red | Alaska has no profiling-restriction statute, no ADM-transparency/explanation right, no AI-specific risk-assessment law, and no dedicated biometric-privacy statute (i.e., no Illinois-BIPA equivalent)… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | While PIPA has no dedicated statutory ADM-transparency or profiling-restriction provisions, the Alberta OIPC has been an active co-investigator in major biometric-privacy enforcement matters… | Profile →Brief |
| Algeria (DZ) | Africa | Red | No Algeria-specific provisions on profiling restrictions, automated-decision-making transparency, AI-specific risk assessments, a distinct biometric-data regime, genetic-data regime, or codified… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No source located on profiling restrictions, ADM transparency, AI-specific risk assessments, biometric regime, genetic data regime, or state-surveillance carveouts for Antigua and Barbuda. No AI Act… | Profile →Brief |
| Argentina (AR) | Americas | Amber | AAIP's Resolución 4/2019 already provides mandatory guidelines covering video surveillance and automated data processing, and AAIP has stood up a dedicated Transparency and Protection of Personal… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | Arizona has no in-force profiling, ADM-transparency, or AI-risk-assessment statute. A biometric-data bill (SB 1238) proposing regulation of biometric handling by private entities with a private right… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Red | Arkansas has no general profiling-restriction, biometric-data, or genetic-data statute. Sector-specific AI-transparency obligations exist in health insurance (HB1297); a broader AI/high-risk-system… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Red | No bloc-level profiling restriction, ADM transparency right, biometric regime, or genetic-data regime exists. AI was discussed as an agenda topic at the Spring 2026 Global CBPR Forum workshop (Peru… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Amber | Australia has no direct analogue to GDPR Art 22 restricting solely-automated decisions, but the POLA Act 2024 introduces a new APP 1 automated-decision-making (ADM) transparency obligation commencing… | Profile →Brief |
| Austria (AT) | Europe | Amber | GDPR Article 22 profiling/ADM restrictions apply directly in Austria. The EU AI Act layers additional risk-based obligations, with Member States (including Austria) required to designate national… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Amber | The confirmed finding in this module is a state-surveillance carve-out: the Cyber Security Ordinance 2025 permits interception of, or access to, traffic data on a 'reason to believe' evidentiary… | Profile →Brief |
| Belgium (BE) | Europe | Amber | Belgium applies GDPR Article 22-style profiling/ADM protections at the EU baseline, with the Belgian DPA imposing a mandatory-DPIA requirement for public-space biometric identification. The Belgian… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced provisions on automated-decision-making transparency, AI-specific risk-assessment duties, biometric-data conditions, genetic-data rules, or state-surveillance carve-outs specific to Belize… | Profile →Brief |
| Brazil (BR) | Americas | Amber | Article 20 gives data subjects the right to request review of decisions made solely through automated processing; ANPD's Technical Note 12/2025 explores implementation as AI use grows. A dedicated… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | PIPA has no codified Art 22-style profiling-restriction or ADM-transparency right; automated decision-making was one of the OIPC's 12 PIPA-reform recommendations, not yet enacted. Biometric data… | Profile →Brief |
| Bulgaria (BG) | Europe | Amber | Biometric processing (facial recognition) has been addressed directly by CPDP guidance applying GDPR Article 9 to retail use cases. Law-enforcement/immigration processing (e.g., N.SIS) is carved out… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Amber | The draft LPDP would classify biometric and genetic data as sensitive personal data, with the latter defined more broadly than under GDPR. Public authorities performing official duties are exempted… | Profile →Brief |
| Cameroon (CM) | Africa | Amber | The draft law defines 'biometric data' and 'genetic data' as distinct categories, implying a nascent biometric/genetic-data regime, but confirmed profiling restrictions, ADM transparency rights… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | PIPEDA has no GDPR Art.22-style automated-decision-making right, but its s.5(3) 'no-go zone' doctrine prohibits profiling or categorizing individuals in ways leading to unfair, unethical or… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Amber | PIPEDA contains no GDPR Art 22-equivalent automated-decision-making provision; the OPC's own reform submissions describe the current law as 'ill-suited to the AI environment.' The proposed Artificial… | Profile →Brief |
| Chile (CL) | Americas | Amber | Ley 21.719 introduces a right to oppose automated decision-making/profiling and a distinct biometric-data regime, and requires impact assessments for systematic monitoring of publicly accessible… | Profile →Brief |
| China (CN) | Asia-Pacific | Amber | PIPL Article 24 restricts algorithmic price-discrimination and mandates non-targeted or opt-out marketing options; individuals may demand explanations of and refute significant automated decisions.… | Profile →Brief |
| Colombia (CO) | Americas | Amber | Biometric data is expressly classified as sensitive under Decree 1377. A comprehensive Artificial Intelligence Bill was submitted to Congress in May 2025 to establish an ethical AI governance… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Amber | The CPA grants a profiling opt-out for decisions with legal or similarly significant effects. Colorado's separate AI Act (SB 24-205), as substantially amended by 2026's SB 189, moves from a… | Profile →Brief |
| Comoros (KM) | Africa | Red | No profiling restriction, ADM-transparency rule, AI-risk-assessment regime, biometric-data rule, or state-surveillance carve-out was located for the Union of the Comoros. | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No statutory analogue to GDPR Art 22 (automated decision-making/profiling restrictions), AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No automated-decision-making transparency rule, AI-specific risk-assessment regime, biometric-processing condition, genetic-data regime, or state-surveillance carve-out is codified in Comorian law. | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Amber | CTDPA requires opt-in consent for profiling presenting a foreseeable risk of substantial injury, and (as of the 2026 amendments) grants consumers rights to know when profiling produces… | Profile →Brief |
| Costa Rica (CR) | Americas | Amber | Law No. 8968 currently contains no Article-22-equivalent profiling restriction, ADM transparency right, AI-specific risk-assessment duty, or biometric/genetic-data regime that could be confirmed.… | Profile →Brief |
| Croatia (HR) | Europe | Amber | Croatia applies GDPR Article 22 (profiling/ADM) directly with no national derogation found. A national biometric-processing permission and a categorical genetic-data prohibition supplement the GDPR… | Profile →Brief |
| Curaçao (CW) | Caribbean | Red | No Curaçao-specific profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-regime, genetic-data-regime, or state-surveillance-carveout text was located in this research pass. | Profile →Brief |
| Cyprus (CY) | Europe | Amber | Profiling and automated-decision-making transparency follow GDPR Art 22 directly. The national genetic/biometric derogation for life insurance interacts with the biometric and genetic data… | Profile →Brief |
| Czech Republic (CZ) | Europe | Amber | GDPR Article 22 profiling/ADM restrictions apply directly. ÚOOÚ has flagged biometric data and CCTV as recurring supervisory priorities. Act No. 110/2019 Coll. establishes a distinct Title… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Amber | Biometric and genetic data used to uniquely identify an individual are classified as sensitive data requiring consent. Minors under 18 receive opt-in-consent protection against profiling-adjacent… | Profile →Brief |
| Denmark (DK) | Europe | Amber | Datatilsynet has been proactive on AI governance ahead of binding EU AI Act obligations: it formed an internal cross-departmental AI task force, issued a healthcare-sector AI legal-basis assessment… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Amber | The District has no enacted profiling-restriction, ADM-transparency, or AI-risk-assessment statute. The DC Attorney General introduced the Stop Discrimination by Algorithms Act (subsequently… | Profile →Brief |
| Dominican Republic (DO) | Americas | Red | No profiling-restriction, automated-decision-making transparency right, AI-specific risk-assessment regime, dedicated biometric-data regime, genetic-data regime, or codified state-surveillance… | Profile →Brief |
| Ecuador (EC) | Americas | Green | EUDPR Art 24 (automated individual decision-making including profiling) is the EUI-context analogue of GDPR Art 22. Since 2024 the EDPS additionally holds a sui generis role under the AI Act… | Profile →Brief |
| Egypt (EG) | Africa | Amber | Biometric and genetic data are enumerated PDPL sensitive categories requiring a PDPC license to process. Egypt's Ministry of Communications and Information Technology has an aspirational strategy to… | Profile →Brief |
| Estonia (EE) | Europe | Amber | Estonia applies GDPR Art 22 profiling/ADM rules directly, illustrated by AKI's 2022 injunction against a ride-hailing controller's rider-rating processing pending compliance measures. The EU AI Act's… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | Article 22 GDPR remains the core EEA safeguard against solely automated decision-making, interpreted by the CJEU in SCHUFA (2023). The EDPB and European Commission are jointly drafting guidelines on… | Profile →Brief |
| Finland (FI) | Europe | Amber | Profiling/ADM transparency obligations under GDPR Article 22 are actively enforced (Taksi Helsinki loyalty-scheme case). Finland's national implementation of the EU AI Act entered into force on 1… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | FDBR provides an opt-out right against certain profiling and treats biometric and genetic data as 'sensitive data' requiring opt-in consent for sale plus a specific website disclosure. Florida has no… | Profile →Brief |
| France (FR) | Europe | Amber | CNIL actively enforces the Article 9 GDPR biometric special-category regime (sanctioning scraped facial-recognition databases) and is shaping the France/EU interface between GDPR and the EU AI Act… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Red | Georgia has not enacted a biometric-privacy statute analogous to Illinois' BIPA, no AI-specific risk-assessment or algorithmic-transparency legislation, and no profiling/ADM opt-out right.… | Profile →Brief |
| Germany (DE) | Europe | Amber | Germany applies the GDPR Art 22 restriction on solely-automated decisions with legal/significant effect, actively tested via CJEU litigation on SCHUFA-style credit scoring where a controller's own… | Profile →Brief |
| Ghana (GH) | Africa | Red | No Article 22-style profiling/ADM-transparency regime, biometric-specific regime, or genetic-data regime was confirmed under the 2012 Act. The clearest forward-looking signal is the Emerging… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Red | Algorithmic/biometric governance in Gibraltar is presumed to mirror GDPR Article 22 (automated decision-making) and Article 9 (biometric/genetic special categories) via the Gibraltar GDPR, but no… | Profile →Brief |
| Greece (GR) | Europe | Amber | The HDPA's landmark €20 million fine against Clearview AI for unlawful biometric facial-recognition processing anchors this module. Genetic-data restrictions exist for insurance purposes. The HDPA… | Profile →Brief |
| Guernsey (GG) | Europe | Amber | The Law provides a GDPR Art 22-equivalent right against solely-automated decisions affecting significant interests, and ODPA has issued non-binding AI guidance. Dedicated profiling, biometric… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Amber | The Law confers a right not to be subject to decisions based solely on automated processing (section 24); this right is explicitly carved out of (i.e. preserved despite) the Schedule 8 trusts… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Amber | Hawaii has recently signed several targeted AI-governance instruments — a chatbot/AI-companion disclosure law, an Artificial Intelligence Disclosure Act, and a deepfakes law — each within the past… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Amber | Hong Kong has no binding AI-specific statute; the PCPD's June 2024 AI Model Personal Data Protection Framework and 2021 Ethical AI Guidance are non-binding best-practice instruments. PCPD conducts… | Profile →Brief |
| Hungary (HU) | Europe | Amber | GDPR Art 22 ADM rules and the EU-wide biometric special-category regime apply directly. Hungary enacted a national AI Law in November 2025, though its detailed risk-assessment provisions could not be… | Profile →Brief |
| Iceland (IS) | Europe | Amber | Article 22 GDPR profiling/ADM restrictions and genetic-data protections apply via Act No. 90/2018, evidenced concretely in the Landspítali genetic-research case; Persónuvernd has also co-signed a… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Amber | Idaho has emerged as one of the more active states on AI-specific transparency legislation: HB 127 (2025, codified at Idaho Code §48-603h) requires disclosure when consumers are communicating with… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | This is Illinois' strongest module: BIPA provides a comprehensive biometric-data regime and GIPA a genetic-data regime, both litigated heavily. HB 3773 adds an employment-context profiling… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | DPDPA's algorithmic-governance content is limited: a children-specific profiling/behavioral-monitoring ban, and broad government/state exemptions (including for national security) that have drawn… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Amber | The Act triggers DPIA obligations for risky profiling and treats genetic/uniquely-identifying biometric data as sensitive data requiring opt-in consent, subject to a riverboat-casino… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Red | The ICDPA notably omits an Article 22-style right against solely automated decision-making, and Iowa has no dedicated AI-risk-assessment or biometric-specific statute at present. Sensitive-data… | Profile →Brief |
| Ireland (IE) | Europe | Amber | Ireland's DPC increasingly interfaces with the EU AI Act (Regulation (EU) 2024/1689) alongside its GDPR profiling/ADM remit; the Meta contract-legal-basis decision constrains profiling-based… | Profile →Brief |
| Isle of Man (IM) | Europe | Amber | Algorithmic/ADM and profiling protections are presumed inherited from the wholesale adoption of the GDPR (including Article 22), and a distinct law-enforcement/state-processing regime exists via the… | Profile →Brief |
| Italy (IT) | Europe | Amber | The Garante has been designated national market-surveillance authority for high-risk AI systems in justice, law enforcement, immigration, border management and democratic processes under Italy's AI… | Profile →Brief |
| Ivory Coast (CI) | Africa | Amber | IAPP reporting indicates a 2024-initiated study on the challenges of AI, 5G and the metaverse for Côte d'Ivoire's digital economy, aimed at promoting inclusive, ethical and responsible adoption of… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Amber | The APPI currently contains no comprehensive automated-decision-making or profiling framework equivalent to GDPR Article 22; the European Parliament has explicitly flagged this gap. Reform is under… | Profile →Brief |
| Jersey (JE) | Europe | Red | No Jersey-specific automated-decision-making/Article-22-equivalent rule, AI Act interface, biometric-data-specific condition, genetic-data regime, or state-surveillance carve-out was located in this… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Red | Kansas has no profiling-restriction statute, no ADM-transparency law, no AI-specific risk-assessment mandate, and no dedicated biometric-privacy statute. Industry analysis confirms that, among US… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Red | No confirmed profiling restriction, ADM-transparency right, AI-specific risk-assessment obligation, biometric-data regime, genetic-data regime, or state-surveillance carve-out specific to… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Amber | The KCDPA's profiling opt-out functions as Kentucky's closest analogue to a GDPR Article 22-style ADM safeguard, reinforced by a DPIA trigger for disparate-impact profiling risk. Separately, Senate… | Profile →Brief |
| Kenya (KE) | Africa | Amber | Kenya lacks a dedicated AI-specific statute, but the General Regulations mandate DPIAs for biometric-data processing and for automated decision-making with legal or significant effect using profiling… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | No profiling restriction, automated-decision-making transparency right, AI-specific risk-assessment regime, biometric-data regime, or genetic-data regime was identified for Laos. A state-surveillance… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Green | This is the most developed bloc-level module. The 2026 RIPD Standards materially expand ADM/profiling rights, mandate AI/biometric/neurotech impact assessments, extend the data-quality principle to… | Profile →Brief |
| Latvia (LV) | Europe | Amber | GDPR Article 9(4) permits Latvia to add further conditions on genetic, biometric and health data, but no confirmed Latvia-specific biometric, genetic, ADM-transparency or AI-risk-assessment overlay… | Profile →Brief |
| Liechtenstein (LI) | Europe | Amber | Profiling and ADM transparency follow GDPR Article 22 directly, reinforced by DSS DPIA guidance flagging profiling/automated decision-making (including for marketing purposes) as high-risk… | Profile →Brief |
| Lithuania (LT) | Europe | Amber | Lithuania's DPIA 'blacklist' treats biometric- and genetic-data processing as DPIA triggers (partially revised after EDPB opinion). VDAI has fined a biometric-data controller and issued a public… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | The LDPA treats biometric and genetic data as sensitive categories requiring consent and mandates data-protection assessments for profiling that presents a foreseeable risk of harm: <cite… | Profile →Brief |
| Luxembourg (LU) | Europe | Amber | GDPR Article 22 ADM restrictions apply directly as EU law. Luxembourg's draft AI Act implementing bill (No. 8476, introduced 23 December 2024) would designate the CNPD as market-surveillance… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Amber | Maine has enacted one of the strongest state-level facial-recognition restrictions in the US (LD 1585), but this applies only to government use, not private/commercial biometric processing. No… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Amber | The Amendment Act's classification of biometric data as sensitive personal data is the principal confirmed finding in this module. No profiling-restriction, ADM-transparency, AI-specific… | Profile →Brief |
| Malta (MT) | Europe | Green | Profiling and automated-decision-making transparency are governed by GDPR Article 22 with direct effect. The IDPC has been designated under the EU AI Act as both a Fundamental Rights Authority (FRA)… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | No profiling restriction, ADM-transparency right, AI-specific risk-assessment duty, biometric-processing condition, genetic-data rule, or codified state-surveillance carve-out exists in RMI law.… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | MODPA treats biometric and genetic data as sensitive data subject to strict-necessity and sale-ban rules, but contains no GDPR Art.22-style profiling-restriction or… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Amber | Massachusetts does not have a general profiling, ADM-transparency, or AI-risk-assessment statute. Its most concrete algorithmic/biometric governance step is a state-level restriction on… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Mexico has no dedicated AI law; a Senate-based National AI Alliance (ANIA) is developing a regulatory proposal spanning cybersecurity, privacy, and AI ethics, but this remains pre-legislative as of… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | Michigan has no state biometric-privacy statute (unlike Illinois BIPA), no genetic-data-specific statute, and no enacted ADM-transparency or AI-risk-assessment law. Pending bills exist on automated… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Amber | The AGO has characterized the MCDPA as one of the nation's strongest statutes against harmful profiling and automated decision-making, granting consumers a right to question and obtain the… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Red | Mississippi has no Article 22-style profiling restriction, ADM transparency/explanation right, AI-specific risk-assessment statute, freestanding biometric-privacy law, or genetic-data-specific… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Amber | Missouri's only concrete governance instrument in this module is House Bill 1584's biometric-data consent/retention-policy regime, effective 28 August 2024. There is no profiling-restriction or… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | Consumers may opt out of profiling under the MTCDPA. Sensitive-data protections extend to genetic and biometric data processed for unique identification, requiring consent. Separately, the Montana… | Profile →Brief |
| Morocco (MA) | Africa | Red | The Morocco-EU gap analysis found that Law 09-08 does not include biometric data within its special-category definitions, and CNDP has issued recommendations on genomic/genetic data despite no… | Profile →Brief |
| Mozambique (MZ) | Africa | Red | Mozambique's Penal Code (Law 24/2019, Article 252) criminalises unauthorised interference with privacy including interception of communications, image capture, and sharing of private information… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | No profiling restriction, ADM-transparency right, AI-specific risk-assessment regime, biometric-data regime, or genetic-data regime was identified. State-surveillance carve-outs are, however… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | The NDPA provides an opt-out right for profiling in furtherance of solely automated decisions producing legal or similarly significant effects (WPA-model, not a full GDPR Art 22-style explanation… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-specific, genetic-data, or state-surveillance-carveout regime was located for Nepal, including in the context of national ID… | Profile →Brief |
| Netherlands (NL) | Europe | Amber | Profiling and automated-decision-making are governed by GDPR Article 22, with EDPB opinion clarifying GDPR principles' application to AI model development/deployment. The EU AI Act (Regulation (EU)… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | Nevada has no general Article-22-style profiling/ADM transparency regime. SB 370 contains a narrow profiling exemption tied to non-health personal data, and a 2025 bill (SB 199) proposed AI-company… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Amber | Canada's principal vehicle for statutory AI/ADM/biometric governance, the Artificial Intelligence and Data Act (AIDA) and the CPPA's proposed ADM-contest right, were both part of Bill C-27, which… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Amber | The NHDPA provides an Article-22-style opt-out (rather than a full ADM-transparency/explanation right) for profiling in furtherance of solely automated decisions producing legal or similarly… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Amber | The NJDPL treats genetic and biometric data as sensitive data requiring consent and a data protection assessment, and grants consumers an opt-out right over profiling that produces legal or similarly… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Red | New Mexico has no general profiling-restriction, ADM-transparency, or AI-risk-assessment statute. Biometric data is captured incidentally within the Data Breach Notification Act's PII definition, and… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Amber | New Zealand has no standalone AI statute; the OPC has instead issued guidance (June and October 2023) applying the 13 IPPs to AI systems, recommending PIAs, senior-leadership approval, transparency… | Profile →Brief |
| Nigeria (NG) | Africa | Amber | The NDPA addresses automated decision-making under Section 37 (Part VI), giving data subjects protections analogous to GDPR Art 22. Biometric and genetic data likely fall within the Section 30… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Red | North Carolina has no state profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-specific, or genetic-data-specific statute. At the federal level, no comprehensive biometric privacy… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Red | No ND statute addresses profiling restrictions, automated-decision-making transparency, AI-specific risk assessments, a biometric-data regime, or a genetic-data regime. State-surveillance carve-outs… | Profile →Brief |
| Norway (NO) | Europe | Amber | Norway applies GDPR's profiling/objection framework (Art 21, treated as unconditional in the Meta decision) and Art 9 special-category rules to biometric data. Nordic DPAs (including Datatilsynet)… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Red | Ohio has no state-specific biometric-privacy statute; among US states, only Illinois, Washington and Texas have enacted biometric-specific privacy legislation, and Ohio is not among them.… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Red | No Oklahoma-specific biometric-privacy statute (analogous to Illinois BIPA), genetic-data statute, AI-risk-assessment law, or ADM-transparency regime was identified in this research pass.… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Red | Canada currently has no comprehensive federal AI statute in force: the Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died when Parliament was prorogued on January 6, 2025, and has… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Amber | OCPA classifies biometric and genetic data as sensitive data requiring consent-based heightened protection, grants consumers an opt-out right against profiling used for legally or similarly… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No enacted profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-regime, or genetic-data statute exists. PECA 2016 provides broad national-security/public-order grounds for the PTA… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No automated-decision-making transparency rule, AI-specific risk-assessment regime, biometric-processing condition, genetic-data regime, or state-surveillance carve-out framework could be located for… | Profile →Brief |
| Panama (PA) | Americas | Red | No Article-22-analogue profiling restriction, ADM transparency right, AI-specific risk-assessment requirement, biometric-data regime, genetic-data regime, or state-surveillance carve-out text… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Red | Pennsylvania has no enacted profiling-restriction, ADM-transparency, AI-risk-assessment, biometric, or genetic-data statute. Several bills are pending: SB 1090 (AI chatbot protections for minors… | Profile →Brief |
| Peru (PE) | Americas | Amber | Biometric identifiers are treated as sensitive data requiring express consent and heightened security measures; ANPD's most significant recent enforcement action (January 2026) fined three major… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | The IRR requires notification to the NPC where automated processing becomes the sole basis for decisions significantly affecting a data subject, and defines 'profiling' in terms tracking GDPR Art 22.… | Profile →Brief |
| Poland (PL) | Europe | Amber | Profiling and automated decision-making restrictions in Poland follow GDPR Article 22 directly. The dominant recent development is Poland's implementation of the EU AI Act: the Council of Ministers… | Profile →Brief |
| Portugal (PT) | Europe | Amber | Portugal has no PT-specific Art 22 ADM/profiling statute or ADM-transparency instrument confirmed in research; however, the CNPD has formed internal working groups (RLPD) covering biometrics, AI… | Profile →Brief |
| Qatar (QA) | Middle East | Amber | The QFC Data Protection Regulations 2021 grant data subjects a right not to be subject to automated individual decision-making, including profiling. Qatar has separately developed a National AI… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Amber | Law 25 defines profiling and imposes notice/deactivation duties, and requires notice-plus-contestation (not an outright prohibition, unlike GDPR Art. 22) for solely-automated decisions. Biometric… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | RIDTPPA provides an opt-out right for profiling in furtherance of solely automated decisions producing legal or similarly significant effects. Separately and significantly, the Rhode Island Attorney… | Profile →Brief |
| Romania (RO) | Europe | Amber | Profiling/ADM restrictions in Romania follow GDPR Article 22 directly. The EU AI Act (Regulation (EU) 2024/1689) applies uniformly in Romania as a directly-applicable EU regulation; its… | Profile →Brief |
| Russia (RU) | Europe | Red | Biometric-data governance is the most developed sub-area, with 2024 fines targeting unauthorised biometric-data disclosure and a Unified Biometric System framework for state and (in draft form)… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | Article 27 of the law addresses automated individual decision-making, providing the closest analogue to a GDPR Article 22-style profiling/ADM protection. No dedicated AI-specific risk-assessment… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | The PDPL provides a right to object to profiling (Implementing Regulation Art. 28), and SDAIA has separately advanced AI governance instruments (draft Responsible AI Policy, AI Ethics Principles… | Profile →Brief |
| Senegal (SN) | Africa | Red | Genetic data is expressly included within the statutory definition of personal data. The CDP has published guidance addressing processing of biometric data (title-confirmed, substantive content… | Profile →Brief |
| Serbia (RS) | Europe | Amber | The current 2018 LPDP does not comprehensively regulate genetic and biometric data, audio/video surveillance, or AI-based processing; a Special Working Group convened by the Commissioner in April… | Profile →Brief |
| Seychelles (SC) | Africa | Red | No Article-22-style automated-decision-making provision, AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance carve-out specific to Seychelles… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Amber | Singapore's AI governance is predominantly voluntary/soft-law rather than binding. <cite index="68-4,68-5,68-6">The Model AI Governance Framework's 11 guiding principles include transparency… | Profile →Brief |
| Slovakia (SK) | Europe | Amber | GDPR Art. 22 profiling/ADM restrictions apply directly in Slovakia. <cite index="10-23,10-26">A data subject has the right not to be subject to a decision based solely on automated processing… | Profile →Brief |
| Slovenia (SI) | Europe | Amber | ZVOP-2 contains a dedicated national biometric-data regime and separately addresses public-area video surveillance. The Slovenian Information Commissioner has also co-signed a February 2026… | Profile →Brief |
| South Africa (ZA) | Africa | Red | POPIA treats biometric data as a category of special personal information subject to Section 26 prohibition/Section 27(1) exceptions, but a dedicated Article 22-style profiling/ADM transparency… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | H.3431 restricts behavioral profiling of minors via surveillance data and mandates default opt-outs from personalized recommendation systems; this is currently subject to a First Amendment challenge… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Amber | South Dakota has not enacted a biometric-privacy statute, AI-specific risk-assessment law, or automated-decision-making transparency requirement applicable to private-sector processing. The 2026… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Amber | The PIPC has taken an increasingly assertive posture on algorithmic accountability: its January 2025 Kakao Pay/Alipay decision fined the companies KRW 8.3 billion and ordered destruction of an… | Profile →Brief |
| Spain (ES) | Europe | Amber | Spain was the first EU Member State to create a dedicated AI supervisory authority, the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), operationalising EU AI Act oversight… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | The PDPA's extraterritorial-scope trigger expressly captures profiling used to make decisions about data subjects' behaviour in Sri Lanka, and the October 2025 amendment reportedly clarified… | Profile →Brief |
| Sweden (SE) | Europe | Amber | Profiling is governed via GDPR as applied by IMY. IMY's 2026 priorities and June 2026 report on AI controller/processor roles reflect active (but largely non-binding, guidance-stage) engagement with… | Profile →Brief |
| Switzerland (CH) | Europe | Amber | The revFADP does not replicate a general GDPR Article 21-style objection right but does impose information duties on controllers regarding automated individual decision-making (Art 21 revFADP… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | Taiwan lacks a direct GDPR Art 22 profiling/ADM-transparency analogue under the PDPA. Momentum is instead building through a separate instrument — the AI Basic Law, effective January 14, 2026 — which… | Profile →Brief |
| Tanzania (TZ) | Africa | Red | No qualifying source was located covering profiling restrictions, automated-decision-making transparency, AI-specific risk-assessment obligations, a distinct biometric-data regime, genetic-data… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | TIPA defines 'biometric data' as a distinct, likely sensitive-data category subject to opt-in consent. Automated-decision-making transparency rights, AI-specific risk-assessment obligations… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Amber | TRAIGA (effective Jan 1, 2026) prohibits AI systems designed to manipulate human behavior, make discriminatory decisions, or produce child-exploitative deepfakes, and imposes state-agency… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Amber | The PDPA carries a state-security carve-out but no dedicated algorithmic/biometric/genetic sub-regime: <cite index="5-20">the PDPA excludes public authorities that maintain state security — including… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | No automated-decision-making transparency rule, AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance carve-out was located for Trinidad and… | Profile →Brief |
| Tunisia (TN) | Africa | Red | No Tunisia-specific profiling/ADM-transparency regime, AI-risk-assessment requirement, or dedicated biometric/genetic-data regime was confirmed from accessible sources. On state-surveillance… | Profile →Brief |
| Turkey (TR) | Europe | Amber | KVKK issued dedicated guidance on biometric data processing (September 2021), grounding biometric processing in Articles 4 and 6 principles (necessity, proportionality, minimal retention… | Profile →Brief |
| Uganda (UG) | Africa | Red | No Art 22-equivalent profiling/ADM restriction, ADM transparency right, AI-specific risk-assessment regime, dedicated biometric-data regime, or genetic-data regime was surfaced. The one identified… | Profile →Brief |
| Ukraine (UA) | Europe | Red | Ukraine's Ministry of Digital Transformation has issued non-binding AI guidance and is aligning policy with the Council of Europe Framework Convention on AI, but no binding AI-risk-assessment statute… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | UAE AI governance is conducted primarily through national strategy, ethical guidelines and sector initiatives rather than dedicated cross-sectoral AI legislation, though the DIFC has an in-force… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | The DUAA introduces new UK GDPR Articles 22A-22D governing solely-automated significant decisions, relaxing some prior restrictions while retaining a right to human intervention for significant… | Profile →Brief |
| United States (US) | Americas | Amber | Algorithmic/biometric governance is emerging fastest at the state level: California's ADMT regulations became applicable 1 January 2026, Illinois's BIPA remains the most litigated biometric statute… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | The CPPA's 2025 ADMT/risk-assessment/cybersecurity-audit regulations represent California's primary vehicle for algorithmic governance, providing consumers pre-use notice, opt-out, and access rights… | Profile →Brief |
| United States — New York (US-NY) | Americas | Amber | New York's algorithmic/biometric governance is concentrated at the New York City level (Local Law 144 automated employment decision tool bias audits; the Biometric Identifier Information Law) rather… | Profile →Brief |
| Uruguay (UY) | Americas | Amber | The LPD carves databases serving public-security, defence or state-security purposes out of its general scope, which functions as a state-surveillance carve-out subject to any specific regulating… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Amber | The UCPA provides no right to opt out of profiling and no ADM-transparency/explanation right analogous to GDPR Art. 22. Utah's separate Artificial Intelligence Policy Act (2024) clarifies that… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | No Vanuatu-specific automated-decision-making, AI-risk-assessment, biometric, genetic-data, or state-surveillance-carveout provisions were located. The general Act may contain a profiling/ADM… | Profile →Brief |
| Venezuela (VE) | Americas | Red | There is no ADM-transparency right, AI-specific risk-assessment regime, or codified biometric/genetic-data regime. Extensive state biometric data collection is documented in practice, most notably… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | S.71 grants a profiling opt-out and an AI/LLM-training disclosure obligation (2028); a prior AI Advisory Council proposal (H.121, 2024) was vetoed by the Governor and did not become law. Biometric… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | Vietnam's first standalone AI Law (adopted December 2025, effective 1 March 2026) introduces an EU-AI-Act-like risk-based classification and conformity-assessment framework, superseding the AI… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | The VCDPA grants an opt-out right against solely-automated profiling with legal or similarly significant effects and requires a data protection assessment for high-risk profiling, but lacks a GDPR… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | Washington's Biometric Privacy Protection Act (RCW 19.375, 2017) was one of only three state biometric statutes for years and is cited by the FTC as an early state biometric-privacy model. MHMDA… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Red | West Virginia has no enacted profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-privacy, or genetic-data statute. A Biometric Information Privacy Act bill was introduced in… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Red | Wisconsin has no state-specific profiling-restriction, ADM-transparency, AI-risk-assessment, freestanding biometric-privacy, genetic-data, or surveillance-carve-out statute. Biometric data receives… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Red | Wyoming has no cross-sectoral AI governance statute, profiling restriction, or ADM transparency right. Biometric data is included within the breach-notification statute's definition of protected… | Profile →Brief |
| Zambia (ZM) | Africa | Amber | The clearest verified item in this module is that the Act (as enacted from the 2020 Bill) provides exemptions from personal-data-processing rules for purposes including maintenance of public order… | Profile →Brief |