Privacy Regulation Timeline

2018-05-25

European Union
Regulation

GDPR became applicable

The General Data Protection Regulation became applicable across the EU and established rights including access, erasure, and objection, subject to its scope and exceptions.

2020-01-01

California
Statute

CCPA consumer rights took effect

California’s Consumer Privacy Act rights and obligations took effect, including consumer rights to know, delete, and opt out of sale in defined circumstances.

2024-01-09

United States
Enforcement

FTC order on sensitive location data

The FTC announced an order prohibiting X-Mode Social and Outlogic from selling or sharing sensitive location data and requiring specified deletion and privacy-program measures.

2024-02-22

United States
Proposed order

FTC proposed order on browsing-data sales

The FTC announced a proposed consent order against Avast related to selling browsing data for advertising, including monetary relief, deletion requirements, and prospective restrictions described in the agency release; the release said the proposal was subject to public comment and a later final decision.

2026-01-01

California
Statute

California Delete Act statutory provisions took effect

The California Delete Act provisions reflected in the effective statutory text established duties and implementation requirements for the state’s data-broker deletion platform.

2026-01-01

California
Public platform

California DROP opened to consumers

CalPrivacy describes the Delete Request and Opt-Out Platform as the state mechanism for California residents to submit a deletion request to active data brokers within the current mechanism scope.

2026-02-09

United States
Guidance / enforcement

FTC reminded data brokers about PADFAA obligations

The FTC published a reminder describing obligations it said data brokers must follow under the Protecting Americans’ Data from Foreign Adversaries Act of 2024.

2026-05-08

California
Enforcement / settlement

California GM/OnStar privacy settlement announced

California’s Attorney General announced a $12.75 million settlement with General Motors and OnStar over allegations involving the sale and retention of driving and location data; the announced settlement was subject to court approval and included a five-year restriction on sales to consumer reporting agencies.

2026-06-26

United States
Enforcement / order

FTC Kochava stipulated order entered

The FTC case timeline lists a stipulated order in the Kochava action restricting sensitive-location-data sales, sharing, and disclosure under specified consent and direct-service conditions; the underlying complaint allegations remain allegations and the order terms control.