--- title: "Automated decision-making & biometrics — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/algorithmic-biometric-and-surveillance-governance/ source_html: /domains/algorithmic-biometric-and-surveillance-governance/index.html description: "Cross-jurisdiction comparison of Automated decision-making & biometrics across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: a8975fe0594232506fd08f8ca98980b523e68f3087d3eaf8ab920be992256a25 generator: "fe-fleet/md-twin@1.0" --- # Automated decision-making & biometrics — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 3 Confirmed 115 Probable 49 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Amber While the Malabo Convention itself does not address AI/algorithmic governance in the materials reviewed, the AU Executive Council endorsed a (non-binding) Continental AI Strategy in July 2024 that… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber Alabama's algorithmic/biometric governance activity in 2026 clusters around AI-specific bills: Senate Bill 129 (AI-generated content transparency, disclosures and metadata marking, enforcement from 1… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Red Alaska has no profiling-restriction statute, no ADM-transparency/explanation right, no AI-specific risk-assessment law, and no dedicated biometric-privacy statute (i.e., no Illinois-BIPA equivalent)… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber While PIPA has no dedicated statutory ADM-transparency or profiling-restriction provisions, the Alberta OIPC has been an active co-investigator in major biometric-privacy enforcement matters… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Red No Algeria-specific provisions on profiling restrictions, automated-decision-making transparency, AI-specific risk assessments, a distinct biometric-data regime, genetic-data regime, or codified… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No source located on profiling restrictions, ADM transparency, AI-specific risk assessments, biometric regime, genetic data regime, or state-surveillance carveouts for Antigua and Barbuda. No AI Act… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Amber AAIP's Resolución 4/2019 already provides mandatory guidelines covering video surveillance and automated data processing, and AAIP has stood up a dedicated Transparency and Protection of Personal… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber Arizona has no in-force profiling, ADM-transparency, or AI-risk-assessment statute. A biometric-data bill (SB 1238) proposing regulation of biometric handling by private entities with a private right… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Red Arkansas has no general profiling-restriction, biometric-data, or genetic-data statute. Sector-specific AI-transparency obligations exist in health insurance (HB1297); a broader AI/high-risk-system… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red No bloc-level profiling restriction, ADM transparency right, biometric regime, or genetic-data regime exists. AI was discussed as an agenda topic at the Spring 2026 Global CBPR Forum workshop (Peru… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber Australia has no direct analogue to GDPR Art 22 restricting solely-automated decisions, but the POLA Act 2024 introduces a new APP 1 automated-decision-making (ADM) transparency obligation commencing… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Amber GDPR Article 22 profiling/ADM restrictions apply directly in Austria. The EU AI Act layers additional risk-based obligations, with Member States (including Austria) required to designate national… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Amber The confirmed finding in this module is a state-surveillance carve-out: the Cyber Security Ordinance 2025 permits interception of, or access to, traffic data on a 'reason to believe' evidentiary… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Amber Belgium applies GDPR Article 22-style profiling/ADM protections at the EU baseline, with the Belgian DPA imposing a mandatory-DPIA requirement for public-space biometric identification. The Belgian… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced provisions on automated-decision-making transparency, AI-specific risk-assessment duties, biometric-data conditions, genetic-data rules, or state-surveillance carve-outs specific to Belize… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Amber Article 20 gives data subjects the right to request review of decisions made solely through automated processing; ANPD's Technical Note 12/2025 explores implementation as AI use grows. A dedicated… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber PIPA has no codified Art 22-style profiling-restriction or ADM-transparency right; automated decision-making was one of the OIPC's 12 PIPA-reform recommendations, not yet enacted. Biometric data… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Amber Biometric processing (facial recognition) has been addressed directly by CPDP guidance applying GDPR Article 9 to retail use cases. Law-enforcement/immigration processing (e.g., N.SIS) is carved out… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Amber The draft LPDP would classify biometric and genetic data as sensitive personal data, with the latter defined more broadly than under GDPR. Public authorities performing official duties are exempted… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Amber The draft law defines 'biometric data' and 'genetic data' as distinct categories, implying a nascent biometric/genetic-data regime, but confirmed profiling restrictions, ADM transparency rights… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber PIPEDA has no GDPR Art.22-style automated-decision-making right, but its s.5(3) 'no-go zone' doctrine prohibits profiling or categorizing individuals in ways leading to unfair, unethical or… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber PIPEDA contains no GDPR Art 22-equivalent automated-decision-making provision; the OPC's own reform submissions describe the current law as 'ill-suited to the AI environment.' The proposed Artificial… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Ley 21.719 introduces a right to oppose automated decision-making/profiling and a distinct biometric-data regime, and requires impact assessments for systematic monitoring of publicly accessible… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber PIPL Article 24 restricts algorithmic price-discrimination and mandates non-targeted or opt-out marketing options; individuals may demand explanations of and refute significant automated decisions.… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber Biometric data is expressly classified as sensitive under Decree 1377. A comprehensive Artificial Intelligence Bill was submitted to Congress in May 2025 to establish an ethical AI governance… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Amber The CPA grants a profiling opt-out for decisions with legal or similarly significant effects. Colorado's separate AI Act (SB 24-205), as substantially amended by 2026's SB 189, moves from a… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No profiling restriction, ADM-transparency rule, AI-risk-assessment regime, biometric-data rule, or state-surveillance carve-out was located for the Union of the Comoros. [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No statutory analogue to GDPR Art 22 (automated decision-making/profiling restrictions), AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No automated-decision-making transparency rule, AI-specific risk-assessment regime, biometric-processing condition, genetic-data regime, or state-surveillance carve-out is codified in Comorian law. [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Amber CTDPA requires opt-in consent for profiling presenting a foreseeable risk of substantial injury, and (as of the 2026 amendments) grants consumers rights to know when profiling produces… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Amber Law No. 8968 currently contains no Article-22-equivalent profiling restriction, ADM transparency right, AI-specific risk-assessment duty, or biometric/genetic-data regime that could be confirmed.… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Amber Croatia applies GDPR Article 22 (profiling/ADM) directly with no national derogation found. A national biometric-processing permission and a categorical genetic-data prohibition supplement the GDPR… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Red No Curaçao-specific profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-regime, genetic-data-regime, or state-surveillance-carveout text was located in this research pass. [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Amber Profiling and automated-decision-making transparency follow GDPR Art 22 directly. The national genetic/biometric derogation for life insurance interacts with the biometric and genetic data… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Amber GDPR Article 22 profiling/ADM restrictions apply directly. ÚOOÚ has flagged biometric data and CCTV as recurring supervisory priorities. Act No. 110/2019 Coll. establishes a distinct Title… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Amber Biometric and genetic data used to uniquely identify an individual are classified as sensitive data requiring consent. Minors under 18 receive opt-in-consent protection against profiling-adjacent… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber Datatilsynet has been proactive on AI governance ahead of binding EU AI Act obligations: it formed an internal cross-departmental AI task force, issued a healthcare-sector AI legal-basis assessment… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Amber The District has no enacted profiling-restriction, ADM-transparency, or AI-risk-assessment statute. The DC Attorney General introduced the Stop Discrimination by Algorithms Act (subsequently… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Red No profiling-restriction, automated-decision-making transparency right, AI-specific risk-assessment regime, dedicated biometric-data regime, genetic-data regime, or codified state-surveillance… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Green EUDPR Art 24 (automated individual decision-making including profiling) is the EUI-context analogue of GDPR Art 22. Since 2024 the EDPS additionally holds a sui generis role under the AI Act… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber Biometric and genetic data are enumerated PDPL sensitive categories requiring a PDPC license to process. Egypt's Ministry of Communications and Information Technology has an aspirational strategy to… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Amber Estonia applies GDPR Art 22 profiling/ADM rules directly, illustrated by AKI's 2022 injunction against a ride-hailing controller's rider-rating processing pending compliance measures. The EU AI Act's… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber Article 22 GDPR remains the core EEA safeguard against solely automated decision-making, interpreted by the CJEU in SCHUFA (2023). The EDPB and European Commission are jointly drafting guidelines on… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Amber Profiling/ADM transparency obligations under GDPR Article 22 are actively enforced (Taksi Helsinki loyalty-scheme case). Finland's national implementation of the EU AI Act entered into force on 1… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber FDBR provides an opt-out right against certain profiling and treats biometric and genetic data as 'sensitive data' requiring opt-in consent for sale plus a specific website disclosure. Florida has no… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Amber CNIL actively enforces the Article 9 GDPR biometric special-category regime (sanctioning scraped facial-recognition databases) and is shaping the France/EU interface between GDPR and the EU AI Act… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Red Georgia has not enacted a biometric-privacy statute analogous to Illinois' BIPA, no AI-specific risk-assessment or algorithmic-transparency legislation, and no profiling/ADM opt-out right.… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Amber Germany applies the GDPR Art 22 restriction on solely-automated decisions with legal/significant effect, actively tested via CJEU litigation on SCHUFA-style credit scoring where a controller's own… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Red No Article 22-style profiling/ADM-transparency regime, biometric-specific regime, or genetic-data regime was confirmed under the 2012 Act. The clearest forward-looking signal is the Emerging… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Red Algorithmic/biometric governance in Gibraltar is presumed to mirror GDPR Article 22 (automated decision-making) and Article 9 (biometric/genetic special categories) via the Gibraltar GDPR, but no… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Amber The HDPA's landmark €20 million fine against Clearview AI for unlawful biometric facial-recognition processing anchors this module. Genetic-data restrictions exist for insurance purposes. The HDPA… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber The Law provides a GDPR Art 22-equivalent right against solely-automated decisions affecting significant interests, and ODPA has issued non-binding AI guidance. Dedicated profiling, biometric… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Amber The Law confers a right not to be subject to decisions based solely on automated processing (section 24); this right is explicitly carved out of (i.e. preserved despite) the Schedule 8 trusts… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Amber Hawaii has recently signed several targeted AI-governance instruments — a chatbot/AI-companion disclosure law, an Artificial Intelligence Disclosure Act, and a deepfakes law — each within the past… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber Hong Kong has no binding AI-specific statute; the PCPD's June 2024 AI Model Personal Data Protection Framework and 2021 Ethical AI Guidance are non-binding best-practice instruments. PCPD conducts… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber GDPR Art 22 ADM rules and the EU-wide biometric special-category regime apply directly. Hungary enacted a national AI Law in November 2025, though its detailed risk-assessment provisions could not be… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Amber Article 22 GDPR profiling/ADM restrictions and genetic-data protections apply via Act No. 90/2018, evidenced concretely in the Landspítali genetic-research case; Persónuvernd has also co-signed a… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Amber Idaho has emerged as one of the more active states on AI-specific transparency legislation: HB 127 (2025, codified at Idaho Code §48-603h) requires disclosure when consumers are communicating with… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber This is Illinois' strongest module: BIPA provides a comprehensive biometric-data regime and GIPA a genetic-data regime, both litigated heavily. HB 3773 adds an employment-context profiling… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber DPDPA's algorithmic-governance content is limited: a children-specific profiling/behavioral-monitoring ban, and broad government/state exemptions (including for national security) that have drawn… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Amber The Act triggers DPIA obligations for risky profiling and treats genetic/uniquely-identifying biometric data as sensitive data requiring opt-in consent, subject to a riverboat-casino… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Red The ICDPA notably omits an Article 22-style right against solely automated decision-making, and Iowa has no dedicated AI-risk-assessment or biometric-specific statute at present. Sensitive-data… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber Ireland's DPC increasingly interfaces with the EU AI Act (Regulation (EU) 2024/1689) alongside its GDPR profiling/ADM remit; the Meta contract-legal-basis decision constrains profiling-based… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Amber Algorithmic/ADM and profiling protections are presumed inherited from the wholesale adoption of the GDPR (including Article 22), and a distinct law-enforcement/state-processing regime exists via the… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Amber The Garante has been designated national market-surveillance authority for high-risk AI systems in justice, law enforcement, immigration, border management and democratic processes under Italy's AI… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Amber IAPP reporting indicates a 2024-initiated study on the challenges of AI, 5G and the metaverse for Côte d'Ivoire's digital economy, aimed at promoting inclusive, ethical and responsible adoption of… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Amber The APPI currently contains no comprehensive automated-decision-making or profiling framework equivalent to GDPR Article 22; the European Parliament has explicitly flagged this gap. Reform is under… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Red No Jersey-specific automated-decision-making/Article-22-equivalent rule, AI Act interface, biometric-data-specific condition, genetic-data regime, or state-surveillance carve-out was located in this… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Kansas has no profiling-restriction statute, no ADM-transparency law, no AI-specific risk-assessment mandate, and no dedicated biometric-privacy statute. Industry analysis confirms that, among US… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Red No confirmed profiling restriction, ADM-transparency right, AI-specific risk-assessment obligation, biometric-data regime, genetic-data regime, or state-surveillance carve-out specific to… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Amber The KCDPA's profiling opt-out functions as Kentucky's closest analogue to a GDPR Article 22-style ADM safeguard, reinforced by a DPIA trigger for disparate-impact profiling risk. Separately, Senate… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber Kenya lacks a dedicated AI-specific statute, but the General Regulations mandate DPIAs for biometric-data processing and for automated decision-making with legal or significant effect using profiling… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red No profiling restriction, automated-decision-making transparency right, AI-specific risk-assessment regime, biometric-data regime, or genetic-data regime was identified for Laos. A state-surveillance… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Green This is the most developed bloc-level module. The 2026 RIPD Standards materially expand ADM/profiling rights, mandate AI/biometric/neurotech impact assessments, extend the data-quality principle to… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Amber GDPR Article 9(4) permits Latvia to add further conditions on genetic, biometric and health data, but no confirmed Latvia-specific biometric, genetic, ADM-transparency or AI-risk-assessment overlay… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Amber Profiling and ADM transparency follow GDPR Article 22 directly, reinforced by DSS DPIA guidance flagging profiling/automated decision-making (including for marketing purposes) as high-risk… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Amber Lithuania's DPIA 'blacklist' treats biometric- and genetic-data processing as DPIA triggers (partially revised after EDPB opinion). VDAI has fined a biometric-data controller and issued a public… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber The LDPA treats biometric and genetic data as sensitive categories requiring consent and mandates data-protection assessments for profiling that presents a foreseeable risk of harm: The Model AI Governance Framework's 11 guiding principles include transparency… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Amber GDPR Art. 22 profiling/ADM restrictions apply directly in Slovakia. A data subject has the right not to be subject to a decision based solely on automated processing… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Amber ZVOP-2 contains a dedicated national biometric-data regime and separately addresses public-area video surveillance. The Slovenian Information Commissioner has also co-signed a February 2026… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Red POPIA treats biometric data as a category of special personal information subject to Section 26 prohibition/Section 27(1) exceptions, but a dedicated Article 22-style profiling/ADM transparency… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber H.3431 restricts behavioral profiling of minors via surveillance data and mandates default opt-outs from personalized recommendation systems; this is currently subject to a First Amendment challenge… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Amber South Dakota has not enacted a biometric-privacy statute, AI-specific risk-assessment law, or automated-decision-making transparency requirement applicable to private-sector processing. The 2026… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Amber The PIPC has taken an increasingly assertive posture on algorithmic accountability: its January 2025 Kakao Pay/Alipay decision fined the companies KRW 8.3 billion and ordered destruction of an… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Amber Spain was the first EU Member State to create a dedicated AI supervisory authority, the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), operationalising EU AI Act oversight… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber The PDPA's extraterritorial-scope trigger expressly captures profiling used to make decisions about data subjects' behaviour in Sri Lanka, and the October 2025 amendment reportedly clarified… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Amber Profiling is governed via GDPR as applied by IMY. IMY's 2026 priorities and June 2026 report on AI controller/processor roles reflect active (but largely non-binding, guidance-stage) engagement with… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Amber The revFADP does not replicate a general GDPR Article 21-style objection right but does impose information duties on controllers regarding automated individual decision-making (Art 21 revFADP… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber Taiwan lacks a direct GDPR Art 22 profiling/ADM-transparency analogue under the PDPA. Momentum is instead building through a separate instrument — the AI Basic Law, effective January 14, 2026 — which… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Red No qualifying source was located covering profiling restrictions, automated-decision-making transparency, AI-specific risk-assessment obligations, a distinct biometric-data regime, genetic-data… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber TIPA defines 'biometric data' as a distinct, likely sensitive-data category subject to opt-in consent. Automated-decision-making transparency rights, AI-specific risk-assessment obligations… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Amber TRAIGA (effective Jan 1, 2026) prohibits AI systems designed to manipulate human behavior, make discriminatory decisions, or produce child-exploitative deepfakes, and imposes state-agency… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Amber The PDPA carries a state-security carve-out but no dedicated algorithmic/biometric/genetic sub-regime: the PDPA excludes public authorities that maintain state security — including… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red No automated-decision-making transparency rule, AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance carve-out was located for Trinidad and… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red No Tunisia-specific profiling/ADM-transparency regime, AI-risk-assessment requirement, or dedicated biometric/genetic-data regime was confirmed from accessible sources. On state-surveillance… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Amber KVKK issued dedicated guidance on biometric data processing (September 2021), grounding biometric processing in Articles 4 and 6 principles (necessity, proportionality, minimal retention… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Red No Art 22-equivalent profiling/ADM restriction, ADM transparency right, AI-specific risk-assessment regime, dedicated biometric-data regime, or genetic-data regime was surfaced. The one identified… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Red Ukraine's Ministry of Digital Transformation has issued non-binding AI guidance and is aligning policy with the Council of Europe Framework Convention on AI, but no binding AI-risk-assessment statute… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber UAE AI governance is conducted primarily through national strategy, ethical guidelines and sector initiatives rather than dedicated cross-sectoral AI legislation, though the DIFC has an in-force… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber The DUAA introduces new UK GDPR Articles 22A-22D governing solely-automated significant decisions, relaxing some prior restrictions while retaining a right to human intervention for significant… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber Algorithmic/biometric governance is emerging fastest at the state level: California's ADMT regulations became applicable 1 January 2026, Illinois's BIPA remains the most litigated biometric statute… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber The CPPA's 2025 ADMT/risk-assessment/cybersecurity-audit regulations represent California's primary vehicle for algorithmic governance, providing consumers pre-use notice, opt-out, and access rights… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Amber New York's algorithmic/biometric governance is concentrated at the New York City level (Local Law 144 automated employment decision tool bias audits; the Biometric Identifier Information Law) rather… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Amber The LPD carves databases serving public-security, defence or state-security purposes out of its general scope, which functions as a state-surveillance carve-out subject to any specific regulating… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The UCPA provides no right to opt out of profiling and no ADM-transparency/explanation right analogous to GDPR Art. 22. Utah's separate Artificial Intelligence Policy Act (2024) clarifies that… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red No Vanuatu-specific automated-decision-making, AI-risk-assessment, biometric, genetic-data, or state-surveillance-carveout provisions were located. The general Act may contain a profiling/ADM… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red There is no ADM-transparency right, AI-specific risk-assessment regime, or codified biometric/genetic-data regime. Extensive state biometric data collection is documented in practice, most notably… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber S.71 grants a profiling opt-out and an AI/LLM-training disclosure obligation (2028); a prior AI Advisory Council proposal (H.121, 2024) was vetoed by the Governor and did not become law. Biometric… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber Vietnam's first standalone AI Law (adopted December 2025, effective 1 March 2026) introduces an EU-AI-Act-like risk-based classification and conformity-assessment framework, superseding the AI… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber The VCDPA grants an opt-out right against solely-automated profiling with legal or similarly significant effects and requires a data protection assessment for high-risk profiling, but lacks a GDPR… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber Washington's Biometric Privacy Protection Act (RCW 19.375, 2017) was one of only three state biometric statutes for years and is cited by the FTC as an early state biometric-privacy model. MHMDA… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Red West Virginia has no enacted profiling-restriction, ADM-transparency, AI-risk-assessment, biometric-privacy, or genetic-data statute. A Biometric Information Privacy Act bill was introduced in… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Red Wisconsin has no state-specific profiling-restriction, ADM-transparency, AI-risk-assessment, freestanding biometric-privacy, genetic-data, or surveillance-carve-out statute. Biometric data receives… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Red Wyoming has no cross-sectoral AI governance statute, profiling restriction, or ADM transparency right. Biometric data is included within the breach-notification statute's definition of protected… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Amber The clearest verified item in this module is that the Act (as enacted from the 2020 Bill) provides exemptions from personal-data-processing rules for purposes including maintenance of public order… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)