| 2008-06-01 |
Biometric Information Privacy Act (BIPA), 740 ILCS 14 |
Written notice and release before collecting biometric identifiers, public retention schedule, destruction within 3 years, and no sale. |
Illinois (USA State) |
2008-06-01 |
none |
2008-06-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.6, references/rules/privacy.md |
| 2021-09-02 |
ICO Age Appropriate Design Code (Children’s Code) |
High privacy by default, data minimisation, geolocation off, profiling off by default, and a mandatory DPIA. |
United Kingdom (UK) |
2020-09-02 |
12 months |
2021-09-02 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.1, references/rules/privacy.md |
| 2022-03-15 |
Telecommunications Business Act |
Approved billing providers, 26% commission, com.apple.developer.storekit.external-purchase entitlement, South Korea-only binary, modal sheet, reporting. |
South Korea |
2022-03-15 |
none |
2022-03-15 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.5, references/rules/payments.md |
| 2024-03-07 |
EU Digital Markets Act (DMA) |
Alternative payments and out-of-app offers (StoreKit External Purchases or Offers Entitlement, ExternalPurchaseCustomLink disclosure sheet, In-App Purchase at equal prominence when offered, parental gates for minors, options kept 12 months, monthly transaction reporting). |
European Union (EU) |
2024-03-07 |
none |
2024-03-07 |
HIGH |
docs/EU-REGULATORY-2026.md section 2 |
| 2024-03-31 |
Mobile App Filing with the MIIT (ICP Extension) |
Mandatory Chinese MIIT app filing, local partner/entity, real-name, PIPL privacy, data localization, Banhao license for games. |
China |
2023-09-01 |
7 months |
2024-03-31 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.9, references/rules/metadata.md |
| 2024-06-25 |
FTC Health Breach Notification Rule, 16 CFR Part 318 |
2024 Final Rule compliance (unauthorized sharing of health/sensitive data with advertisers treated as breach, mandatory 60-day notice). |
United States (Federal) |
2024-06-25 |
none |
2024-06-25 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.6, references/guidelines/by-app-type/health-fitness-and-medical.md |
| 2024-12-13 |
General Product Safety Regulation (GPSR), Regulation (EU) 2023/988 |
Display manufacturer identity, electronic and postal contact details, and product safety warnings on the online interface for consumer products. |
European Union (EU) |
2023-06-12 |
18 months |
2024-12-13 |
HIGH |
docs/REGULATORY-GAP-REPORT-2026.md section 1, references/rules/safety.md |
| 2025-02-02 |
EU AI Act, Regulation (EU) 2024/1689 |
Article 4 AI Literacy. Providers and deployers must take measures to ensure a sufficient level of AI literacy, proportionate to context. A written policy, induction, and log are pragmatic evidence, not a stated legal mandate. |
European Union (EU) |
2024-08-01 |
6 months |
2025-02-02 |
HIGH |
docs/EU-REGULATORY-2026.md section 1.3, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2025-02-02 |
EU AI Act, Regulation (EU) 2024/1689 |
Article 5 Prohibited Practices (ban on subliminal manipulation, child exploitation, social scoring, biometric trait categorization, etc.). |
European Union (EU) |
2024-08-01 |
6 months |
2025-02-02 |
CRITICAL |
docs/EU-REGULATORY-2026.md section 1.4, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2025-02-17 |
EU Digital Services Act (DSA) |
Trader status declaration and verification (D-U-N-S, phone, email publish, 2FA verified) or app removal from EU storefront. |
European Union (EU) |
2024-02-17 |
12 months |
2025-02-17 |
CRITICAL |
docs/EU-REGULATORY-2026.md section 3, references/rules/metadata.md |
| 2025-03-19 |
Google Play Child Safety Standards Policy |
Publish CSAE standards on globally reachable web page, in-app feedback, CSAM response protocol, named child-safety contact. |
Google Play (Global) |
2025-03-19 |
none |
2025-03-19 |
CRITICAL |
docs/PLATFORM-MECHANICS-2026.md section 3.2, references/rules/android.md |
| 2025-05-28 |
Google Play Photo and Video Permissions Policy |
Broad-access READ_MEDIA_IMAGES/READ_MEDIA_VIDEO restricted to broad-access apps; others must use Android Photo Picker. |
Google Play (Global) |
2025-05-28 |
none |
2025-05-28 |
CRITICAL |
docs/PLATFORM-MECHANICS-2026.md section 2.9, references/rules/android.md |
| 2025-06-28 |
European Accessibility Act (EAA), Directive (EU) 2019/882 |
Harmonised standard EN 301 549 Chapter 11 / WCAG 2.1 AA mobile accessibility compliance and Annex V accessibility information published in the terms and conditions or an equivalent document (Article 13(2)). |
European Union (EU) |
2022-06-28 |
36 months |
2025-06-28 |
HIGH |
docs/EU-REGULATORY-2026.md section 4, references/rules/design.md |
| 2025-07-25 |
UK Online Safety Act 2023 |
Highly Effective Age Assurance methods (facial age estimation, open banking, credit-card checks) to protect children from harmful content. |
United Kingdom (UK) |
2025-07-25 |
none |
2025-07-25 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.1, references/rules/safety.md |
| 2025-08-02 |
EU AI Act, Regulation (EU) 2024/1689 |
GPAI-model obligations, governance, and penalties (Articles 99 and 100). |
European Union (EU) |
2024-08-01 |
12 months |
2025-08-02 |
HIGH |
docs/EU-REGULATORY-2026.md section 1.1, section 1.6 |
| 2025-08-31 |
Google Play Target API Requirement |
New apps and updates must target API level 35 (Android 15) or higher, and existing target API 34+. |
Google Play (Global) |
2025-08-31 |
none |
2025-08-31 |
CRITICAL |
docs/PLATFORM-MECHANICS-2026.md section 2.5, references/rules/android.md |
| 2025-09-12 |
EU Data Act, Regulation (EU) 2023/2854 |
Core data access-by-design obligations when apps interact with connected products and wearables. |
European Union (EU) |
2024-01-11 |
20 months |
2025-09-12 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5 |
| 2025-12-10 |
Online Safety Amendment (Social Media Minimum Age) Act 2024 |
Stop under-16s holding accounts on social media via robust age assurance; ringfence and destroy age data. |
Australia |
2024-12-10 |
12 months |
2025-12-10 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.2, references/rules/safety.md |
| 2026-01-01 |
Texas SB 2420 (App Store Accountability Act) |
Age assurance and verifiable parental consent for minors on downloads, purchases, and major updates, delete age data, request age category. Statutory effective date 1 January 2026. Preliminary injunctions of 23 December 2025 were stayed by the Fifth Circuit on 4 June 2026 and the Supreme Court declined to vacate the stay on 6 July 2026, so the law is in force while the merits appeal is pending. |
Texas (USA State) |
2026-01-01 |
none |
2026-06-04 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 1, section 2.2, references/rules/privacy.md |
| 2026-01-01 |
California CPRA (CPPA 2026 Regulations) |
Honoring Global Privacy Control (GPC), privacy policy/notice at collection, opt-out of sale/sharing/profiling, and sensitive personal info limits. |
California (USA State) |
2026-01-01 |
automated decision-making from 2027-04-01; cybersecurity audits from 2028-04-01 |
2026-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.4, references/rules/privacy.md |
| 2026-01-31 |
Apple App Store Review Guidelines (Guideline 2.3.6) |
Every app must answer the updated age-rating questionnaire (13+, 16+, 18+ tiers, UGC/ Livestream indicators) or be blocked from updates. |
Apple App Store (Global) |
2025-07-24 |
6 months |
2026-01-31 |
CRITICAL |
docs/EU-REGULATORY-2026.md section 6, references/rules/metadata.md |
| 2026-02-24 |
Apple App Store Region Age Requirements |
Blocks users in Brazil, Australia, and Singapore from downloading apps rated 18-plus unless age confirmed through reasonable methods. |
Apple App Store (Brazil, Australia, Singapore) |
2026-02-24 |
none |
2026-02-24 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 1, references/rules/privacy.md |
| 2026-02-25 |
FTC Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology under the COPPA Rule (25 February 2026) |
A general-audience or mixed-audience app may collect age data for age verification without COPPA enforcement risk only if it uses the data solely for age determination, minimises retention, vets third parties, notices parents and children, and secures the data. In force until final COPPA rule amendments are published or the statement is withdrawn. |
United States (Federal) |
2026-02-25 |
none |
2026-02-25 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.1, references/guidelines/by-app-type/kids-category-and-families.md |
| 2026-03-17 |
Digital ECA (Law 15,211/2025) |
Accepted age verification (document check, facial estimation, CPF check); self-declaration check-box is prohibited. |
Brazil |
2025-09-17 |
6 months |
2026-03-17 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.3, references/rules/privacy.md |
| 2026-03-18 |
Decreto n. 12.880 of 18 March 2026, Articles 21 and 25, regulating the Digital ECA |
App stores and operating systems supply a free age signal, request age at account creation, verify it by an ANPD-approved method, allow contestation, seek guardian authorisation, and show the age rating before download. Stores must block gambling and lottery apps and any app lacking an age-verification solution. |
Brazil |
2026-03-18 |
none |
2026-03-18 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.3, references/rules/privacy.md |
| 2026-04-01 |
IMDA Code of Practice for Online Safety for App Distribution Services |
App-store age assurance (screen and stop users under 18 from downloading age-inappropriate apps), age-assurance data destroyed. This is the age-assurance bite date. The Code of Practice for Online Safety for App Distribution Services itself commenced 31 March 2025. |
Singapore |
2026-04-01 |
none |
2026-04-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.7, references/rules/privacy.md |
| 2026-04-22 |
Children’s Online Privacy Protection Act (COPPA), 16 CFR Part 312 |
Amended COPPA Rule compliance (biometric identifiers added to PII, separate opt-in consent for third-party disclosure/targeted-ads, written retention policy, written info-security program). The section 312.11 carve-outs are earlier dates (90 days and six months after the 22 April 2025 publication) and bind FTC-approved COPPA Safe Harbor programs only, not app developers. |
United States (Federal) |
2025-06-23 |
10 months |
2026-04-22 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.1, references/guidelines/by-app-type/kids-category-and-families.md |
| 2026-04-28 |
Apple App Store Submission Requirements |
From 28 April 2026 apps uploaded to App Store Connect must be built with the iOS 26 and iPadOS 26 SDK or later (and the matching watchOS 26, tvOS 26, visionOS 26 SDKs). Apple states the requirement in SDK terms, not Xcode terms, and macOS is not in Apple’s list. Age assurance features additionally require the iOS 26.2 SDK with Xcode 26.2 (17C52) or later. |
Apple App Store (Global) |
2026-02-03 |
2 months |
2026-04-28 |
CRITICAL |
docs/EU-REGULATORY-2026.md section 6, docs/PLATFORM-MECHANICS-2026.md section 1.6 |
| 2026-04-29 |
ICO final Guidance on Storage and Access Technologies (29 April 2026), PECR regulation 6 with the DUAA Schedule A1 exemptions and the uplifted PECR penalty (17.5 million pounds or 4 percent of turnover) |
Re-audit every SDK, tracking pixel, and device-fingerprinting call against the guidance, not only cookies. A consent breach now carries the UK GDPR scale fine. |
United Kingdom (UK) |
2026-04-29 |
none |
2026-04-29 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.1, references/rules/privacy.md |
| 2026-05-19 |
TAKE IT DOWN Act, Pub. L. 119-12 |
Covered platforms run a clear and conspicuous non-consensual intimate imagery notice-and-removal process and remove reported content, with known identical copies, within 48 hours. FTC enforcement began 19 May 2026. |
United States (Federal) |
2026-05-19 |
none |
2026-05-19 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.6, references/rules/safety.md |
| 2026-06-18 |
App Store regional age rating changes. Australia 15+ removed, Vietnam Decree 147 Article 38 region-specific rating (Apple Developer news yrrb45pw) |
From 18 June 2026 the 15+ rating is no longer available in Australia (affected apps move to 16+), and apps available in Vietnam require a region-specific age rating aligned with Decree 147 Article 38. Review your App Store Connect age rating per storefront. |
Apple App Store (Australia, Vietnam) |
2026-05-21 |
until 18 June 2026 |
2026-06-18 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md sections 3.2 and 3.10 |
| 2026-06-19 |
Distance Marketing of Financial Services, Directive (EU) 2023/2673 |
Prominent, easily accessible ‘withdrawal button’ or ‘withdrawal function’ on the online interface (including apps) to withdraw from contracts. |
European Union (EU) |
2023-11-28 |
30 months |
2026-06-19 |
HIGH |
docs/EU-REGULATORY-2026.md section 5, references/rules/payments.md |
| 2026-06-19 |
Data (Use and Access) Act 2025 section 103 and Schedule 10, commenced by SI 2026/82 regulation 3 |
Operate a data-protection complaints process. Acknowledge a data subject complaint within 30 days and respond without undue delay. |
United Kingdom (UK) |
2026-06-19 |
none |
2026-06-19 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 3.1, references/rules/privacy.md |
| 2026-06-29 |
Online Safety (Relief and Accountability) Act 2025, partial commencement |
Act on notice from the Online Safety Commission as a platform to address the five priority harms. Further harm categories follow progressively with no published date. |
Singapore |
2026-06-29 |
none |
2026-06-29 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.7 |
| 2026-07-06 |
Apple Developer Program License Agreement Attachment 12, Brazil alternative distribution under the CADE decision (Apple Developer news dhwadr2x and umq9wxmm) |
By 6 July 2026 all Apple Developer Program members had to accept the updated ADPLA. From iOS 26.5 developers may distribute on alternative marketplaces, operate marketplaces, and process payments for digital goods outside Apple In-App Purchase in Brazil. Unaccepted agreements block new submissions. |
Apple App Store (Brazil) |
2026-06-18 |
until 6 July 2026 |
2026-07-06 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.3 |
| 2026-07-15 |
Interim Measures for AI Anthropomorphic Interactive Services, CAC Order No. 21 |
Identify minor users, switch them into minors mode automatically, obtain guardian consent under 14, and never offer virtual companion or virtual kin services to a minor. Any chat, companion, or roleplay app shipping in China is in scope. |
China |
2026-07-15 |
none |
2026-07-15 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.9, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2026-07-22 |
Play Catalog Access Program (Play Console Help answers 17117200 and 15582165) |
From 22 July 2026 registered third-party US Android app stores can access the Play catalog and list your app by default. Opt out in Play Console under Settings, Catalog Settings, if you do not want distribution through third-party stores. |
Google Play (United States) |
2026-07-22 |
none |
2026-07-22 |
HIGH |
docs/GOOGLE-PLAY.md 2026 policy rounds |
| 2026-08-02 |
EU AI Act, Regulation (EU) 2024/1689 |
Article 50 Transparency Obligations (AI-interaction disclosure, synthetic content marking, and deepfake disclosure). |
European Union (EU) |
2024-08-01 |
24 months |
2026-08-02 |
CRITICAL |
docs/EU-REGULATORY-2026.md section 1.2, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2026-08-03 |
Google Play chargeback cost responsibility update (Play Console Help answer 17068375) |
For orders placed after 3 August 2026 the developer bears the purchase price less the service fee plus the financial institution’s chargeback fee. Google Play covers only its service fee. Handle PendingRefundReviewNotification and call the Review Refund API within 24 hours to contest illegitimate disputes. |
Google Play (Global) |
2026-08-03 |
none |
2026-08-03 |
HIGH |
docs/GOOGLE-PLAY.md Payments rows, references/rules/payments.md |
| 2026-08-18 |
e-Evidence Package, Regulation (EU) 2023/1543 |
Cross-border law enforcement direct electronic evidence access (10 days response timeline, and a critical 8-hour emergency timeline). |
European Union (EU) |
2023-08-18 |
36 months |
2026-08-18 |
HIGH |
docs/EU-REGULATORY-2026.md section 5, references/rules/privacy.md |
| 2026-08-26 |
Age-Restricted Content, Families, and Child Safety Standards policy expansion to anonymous and random chat apps (Play Console Help answers 17036597, 17122218, 14747720) |
Apps whose core function is random or anonymous chat with strangers must use Play Console tools to block minors, may not target children under Families, and are in scope of the Child Safety Standards policy (published CSAE standards, in-app reporting, CSAM removal, child-safety contact). |
Google Play (Global) |
2026-08-26 |
none |
2026-08-26 |
CRITICAL |
docs/GOOGLE-PLAY.md 2026 policy rounds, references/rules/safety.md |
| 2026-08-31 |
Google Play Billing Policy |
All new apps and updates must use Play Billing Library version 8 or later from 31 August 2026, with an extension available to 1 November 2026. This is a publishing gate, already-published v7 binaries keep transacting until the 2027 all-apps deadline. |
Google Play (Global) |
2026-05-01 |
3 months |
2026-08-31 |
CRITICAL |
docs/PLATFORM-MECHANICS-2026.md section 2.4, references/rules/payments.md |
| 2026-08-31 |
Google Play Target API Requirement |
New apps and updates must target API level 36 (Android 16) or higher from 31 August 2026, with a Play Console extension request available to 1 November 2026. Wear OS and Android Automotive OS apps must target API 35 or higher, Android TV and Android XR apps API 34 or higher. Existing apps must target API 35 or higher to stay available to new users on newer devices. |
Google Play (Global) |
2026-08-31 |
none |
2026-08-31 |
HIGH |
docs/PLATFORM-MECHANICS-2026.md section 2.5, references/rules/android.md |
| 2026-09-01 |
App Store Connect social media capability declaration (Apple Developer news 0d2gpmml and tlur8uvi) |
Apple states Starting September 2026 (no exact day published) you must indicate whether your app or game includes social media capabilities to submit a new version or update, or to notarize for alternative marketplaces. Declaring social media places the app in the Time Allowance category for Social Media with a minimum 13+ rating, and the Declared Age Range API is required to serve under-13 users. |
Apple App Store (Global) |
2026-09-01 |
none |
2026-09-01 |
CRITICAL |
docs/APPLE.md Section 2 and the 2026 changes list, references/rules/metadata.md |
| 2026-09-09 |
App Distribution Services Online Safety Code (Class 1C and Class 2 Material), Schedule 7 of the Consolidated Industry Codes, registered 9 September 2025 |
App stores apply age assurance and access controls before permitting the download or purchase of adult apps, six months after the Code commenced. The Head Terms working-towards grace period ends and the initial risk assessment is due the same day. Read from a Wayback capture of eSafety pages last updated 19 May 2026 because esafety.gov.au was unreachable, re-confirm on the live register. |
Australia |
2026-03-09 |
none |
2026-09-09 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.2, references/rules/safety.md |
| 2026-09-11 |
Cyber Resilience Act, Regulation (EU) 2024/2847 |
Active vulnerability reporting and security incident notification obligations. |
European Union (EU) |
2024-12-11 |
21 months |
2026-09-11 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5 |
| 2026-09-11 |
Personal Information Protection Act amendment, Act No. 21445 |
Name the CEO and representative as the final accountable parties, seat a board-approved chief privacy officer at qualifying scale, and absorb punitive surcharges plus widened breach notification. |
South Korea |
2026-09-11 |
none |
2026-09-11 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.5, references/rules/privacy.md |
| 2026-09-12 |
EU Data Act, Regulation (EU) 2023/2854 |
Access-by-design technical implementation for connected wearables and devices. This is the Article 3(1) access-by-design duty for connected products, not cloud switching. Switching charges fall to zero on 12 January 2027 under Article 29(1). |
European Union (EU) |
2024-01-11 |
32 months |
2026-09-12 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5 |
| 2026-09-30 |
Android Developer Verification Policy |
Sideloading leg. from 30 September 2026 apps installed on certified devices in Brazil, Indonesia, Singapore, and Thailand must be registered to a verified developer identity (Android Developer Console, USD 25 for full distribution, free limited-distribution accounts up to 20 devices, D-U-N-S for organizations). Global expansion is stated only as 2027 with no exact date published. The separate Play leg (register every Play package name in Play Console by 30 September 2026, global) is GOOGLE-PLAY-APP-PACKAGE-REGISTRATION. |
Android (Brazil, Indonesia, Singapore, Thailand) |
2026-03-15 |
6 months |
2026-09-30 |
CRITICAL |
docs/PLATFORM-MECHANICS-2026.md section 2.1, references/rules/android.md |
| 2026-09-30 |
Play Console requirements. organization registration for financial, health, VPN, and government apps (Play Console Help answers 10788890 and 17125096) |
Apps offering financial products (banking, loans, stock trading, investment funds, crypto wallets and exchanges), health apps (medical, human subjects research), apps approved to use the VpnService class, and government apps must be published from an organization account with a D-U-N-S number consistent with the Dun and Bradstreet profile. Non-compliant apps are removed. |
Google Play (Global) |
2026-07-15 |
until 30 September 2026 |
2026-09-30 |
CRITICAL |
docs/GOOGLE-PLAY.md 2026 policy rounds, references/rules/android.md |
| 2026-09-30 |
Android developer verification, Play leg. register every Play app package name in Play Console (Play Console Help answers 17125096 and 17134731) |
Register your app package names via Play Console to comply with Android developer verification. This leg is global and separate from the Brazil, Indonesia, Singapore, Thailand sideloading leg. Non-registration risks global removal from Google Play. |
Google Play (Global) |
2026-07-15 |
until 30 September 2026 |
2026-09-30 |
CRITICAL |
docs/GOOGLE-PLAY.md 2026 policy rounds, docs/PLATFORM-MECHANICS-2026.md section 2 |
| 2026-10-01 |
US alternative billing and external links program. transaction reporting and service fees (Play Console Help answer 16497028) |
Developers enrolled in the US alternative billing or external links program must report transactions and successful downloads and pay the relevant Play service fee starting 1 October 2026. |
Google Play (United States) |
2026-10-01 |
none |
2026-10-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.3, docs/GOOGLE-PLAY.md |
| 2026-10-01 |
Apple EU business terms update. Core Technology Commission replaces the Core Technology Fee, ADPLA Attachment 14 (Apple Developer news gmws0jgp and 0cgo95n6) |
From 1 October 2026 the per-install Core Technology Fee is replaced by a 5 percent Core Technology Commission on digital transactions in apps distributed outside the App Store, the Initial Acquisition Fee and Store Services Fee are eliminated, apps may offer alternative payment options alongside Apple In-App Purchase, and marketplace and web distribution eligibility widens to seven alternative criteria. Attachment 14 of the ADPLA must be accepted. |
European Union (EU) |
2026-08-18 |
until 1 October 2026 |
2026-10-01 |
CRITICAL |
docs/EU-REGULATORY-2026.md section 2.3 |
| 2026-10-22 |
Apple multiseat subscription purchases (Apple Developer news likeohx4) |
Since 16 September 2026 multiseat purchases are enabled by default for subscriptions in App Store Connect. Volume Purchasing through Apple Business and Apple School Manager launches on 22 October 2026, and Group Purchases launch this winter. Before 22 October decide for each auto-renewable subscription whether organizations and groups may buy seats, and disable multiseat purchases, or limit them across the App Store, Apple Business, and Apple School Manager, where they do not fit your pricing or entitlement logic. Source https://developer.apple.com/news/?id=likeohx4 |
Apple App Store (Global) |
2026-09-16 |
about 5 weeks |
2026-10-22 |
MEDIUM |
docs/APPLE.md 2026 changes you must act on |
| 2026-10-23 |
Apple iPhone Duo platform readiness |
iPhone Duo, Apple’s first foldable iPhone, opens for pre-order on 16 October 2026 and ships 23 October 2026, launching on iOS 27.1. Apps built with Xcode 26 or earlier still run but do not extend under the status bar and camera. Build with Xcode 27.1 (beta from 18 September 2026) and the iOS 27.1 SDK, test every pose in the Duo simulator, resize from size classes and scene bounds, handle reserved regions (outer camera, inner camera when active, the folding region), and let navigation bars, toolbars, and tab bars present vertically. Since 5 October 2026 App Store Connect accepts iPhone Duo optimized apps and Duo screenshots, which earn a product page badge, and from April 2027 Duo screenshots are required for apps using the iOS 27.1 SDK or later (APPLE-IPHONE-DUO-SCREENSHOTS-REQ). Tracked in issue #724. Sources https://developer.apple.com/news/?id=kkphp5qo https://www.apple.com/newsroom/2026/09/apple-unveils-iphone-duo/ https://developer.apple.com/documentation/technologyoverviews/preparing-your-app-for-iphone-duo |
Apple App Store (Global) |
2026-09-09 |
about 6 weeks |
2026-10-23 |
HIGH |
docs/PLATFORM-MECHANICS-2026.md section 1.8, docs/PRE-SUBMISSION-CHECKLIST.md Apple specific, docs/GAP-ANALYSIS-2026-09.md open items |
| 2026-11-13 |
Digital Personal Data Protection Rules 2025, G.S.R. 846(E), rule 4 |
Registered Consent Managers commence one year after Gazette publication (13 November 2025). Be ready to interoperate with a registered Consent Manager ahead of the 18-month tranche on 13 May 2027. |
India |
2026-11-13 |
none |
2026-11-13 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 3.6, references/rules/privacy.md |
| 2026-12-02 |
EU AI Act, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, Article 111(4) and Article 5(1)(ba) and (bb) |
Retrofit Article 50(2) machine-readable AI-content marking onto any generative audio, image, video, or text system already on the market before 2 August 2026, and stop operating any AI system whose intended or reasonably foreseeable output is non-consensual intimate imagery or child sexual abuse material. |
European Union (EU) |
2026-12-02 |
none |
2026-12-02 |
HIGH |
docs/EU-REGULATORY-2026.md section 1.1, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2026-12-09 |
Product Liability Directive (EU) 2024/2853, Articles 21 and 22 |
From 9 December 2026 national strict-liability law treats standalone software and app updates as a product. Anything placed on the market or put into service on or after that date falls under the new regime. |
European Union (EU) |
2026-12-09 |
none |
2026-12-09 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5, references/rules/safety.md |
| 2026-12-10 |
Privacy Act 1988 APP 1.7 to 1.9, inserted by the Privacy and Other Legislation Amendment Act 2024 |
From 10 December 2026 the privacy policy must state the kinds of personal information used by, and the decisions made by, automated decision-making that significantly affects rights or interests. |
Australia |
2026-12-10 |
none |
2026-12-10 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.2, references/rules/privacy.md |
| 2026-12-10 |
Children’s Online Privacy Code under the Privacy Act 1988 |
The Code must be finalised and registered by 10 December 2026, bringing binding children’s-privacy obligations to social media, relevant electronic services, and designated internet services. |
Australia |
2026-12-10 |
none |
2026-12-10 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.2, references/guidelines/by-app-type/kids-category-and-families.md |
| 2027-01-01 |
Alabama HB 161 (App Store Accountability Act) |
App stores verify age category, link minors to a parent account, and obtain verifiable parental consent per download and in-app purchase. Effective 1 January 2027 per HB 161 Section 14 (enrolled text). Accounts in existence on 2 October 2026 must be age-verified with consent before 1 October 2027. |
Alabama (USA State) |
2027-01-01 |
none |
2027-01-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.2, references/rules/privacy.md |
| 2027-01-01 |
Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 2 subscription contracts regime |
Auto-renewing subscription apps sold to UK consumers need pre-contract information, renewal reminders, two cooling-off periods, an easy cancellation path, and the new refund rules. Government announced on 9 August 2026 that the regime commences in January 2027 (exact day not yet published), superseding the earlier spring 2027 estimate. |
United Kingdom (UK) |
2027-01-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.1, references/rules/payments.md |
| 2027-01-01 |
ANPD Digital ECA roadmap, Etapa II and III |
ANPD publishes guidance and normative parameters on age-assurance mechanisms from August 2026 with adaptation through November 2026, and starts active enforcement of the Digital ECA age-assurance obligations from January 2027. |
Brazil |
2026-08-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.3, references/rules/privacy.md |
| 2027-01-01 |
AB 1043, Digital Age Assurance Act, Civil Code Title 1.81.9 |
Operating systems and app stores collect age at setup and expose an age-bracket signal by API. Developers request and use the signal. Operative 1 January 2027. |
California (USA State) |
2027-01-01 |
none |
2027-01-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.4, references/rules/privacy.md |
| 2027-01-01 |
SB 976, Protecting Our Kids from Social Media Addiction Act, Health and Safety Code sections 27001 to 27006 |
From 1 January 2027 treat every user as a minor unless age assurance reasonably determines otherwise before serving an addictive feed or sending notifications between midnight and 6am or during school hours. AG age-assurance regulations due the same day. |
California (USA State) |
2027-01-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.4, references/guidelines/by-app-type/social-and-user-generated-content.md |
| 2027-01-01 |
AB 56, Health and Safety Code Chapter 25 from section 28000 |
Covered social media platforms display the Surgeon General black-box warning daily on first use, again after three cumulative hours, then hourly. Operative 1 January 2027. |
California (USA State) |
2027-01-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.4, references/guidelines/by-app-type/social-and-user-generated-content.md |
| 2027-01-01 |
CPPA regulations, 11 CCR section 7200(b), 7155(b), 7157(a)(1), 7121(a) |
Give notice, allow opt-out, and answer access requests for automated decision-making technology used in significant decisions by 1 January 2027. Complete risk assessments for pre-2026 processing by 31 December 2027 and submit by 1 April 2028. Cybersecurity audit certifications start 1 April 2028 for revenue above 100 million dollars. |
California (USA State) |
2027-01-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.4, references/rules/privacy.md |
| 2027-01-01 |
Age-Appropriate Design Code Act, Act 63 |
Highest-privacy defaults for minors, minimised collection, no late-night push notifications, AG age-assurance rules apply. Effective 1 January 2027. Rulemaking comments due 2 October 2026. |
Vermont (USA State) |
2027-01-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.5, references/guidelines/by-app-type/kids-category-and-families.md |
| 2027-01-01 |
HB 2225, Chapter 168, Laws of 2026, regulating artificial intelligence companion chatbots |
Companion chatbot disclosure and minor protections, including an hourly disclosure for continuing minor use. Effective 1 January 2027. |
Washington (USA State) |
2027-01-01 |
none |
2027-01-01 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.5, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2027-01-01 |
SB 546, Oklahoma Consumer Data Privacy Act |
Honour access, correction, deletion, portability, and opt-out of sale, targeted advertising, and profiling from 1 January 2027. |
Oklahoma (USA State) |
2027-01-01 |
none |
2027-01-01 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 2.5, references/rules/privacy.md |
| 2027-01-12 |
Data Act, Regulation (EU) 2023/2854, Article 29(1) |
Providers of data processing services charge zero for a customer switching away. Legacy indefinite or long-dated contracts concluded on or before 12 September 2025 must meet Chapter IV unfair-terms rules by 12 September 2027. |
European Union (EU) |
2027-01-12 |
none |
2027-01-12 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5 |
| 2027-01-25 |
Stop Addictive Feeds Exploitation (SAFE) for Kids Act, AG final rules published 29 July 2026 |
From 25 January 2027 restrict addictive feeds and midnight-to-6am notifications for minors absent verifiable parental consent, using certified age assurance. |
New York (USA State) |
2027-01-25 |
none |
2027-01-25 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 2.5, references/guidelines/by-app-type/social-and-user-generated-content.md |
| 2027-01-27 |
Contacts Permissions, Location Permissions, and Foreground Service policy changes for apps targeting Android 17, API level 37 (Play Console Help answers 16909972 and 16965181) |
Apps targeting API 37 or later may request READ_CONTACTS only when the Android Contact Picker is insufficient for core functionality (declaration required), must implement the Android location button with the onlyForLocationButton manifest flag for location-button scope, and may no longer use a foreground service for geofencing (use the Geofence API). Pre-review checks flag contacts and location issues in Play Console from 27 October 2026. |
Google Play (Global) |
2026-10-27 |
until 27 January 2027 |
2027-01-27 |
HIGH |
docs/GOOGLE-PLAY.md 2026 policy rounds, references/rules/android.md |
| 2027-01-31 |
Online Safety Act 2023, Ofcom statutory report on the use of app stores by children |
Ofcom publishes its report on app stores by January 2027. It feeds the Secretary of State decision on whether app stores are brought into scope of the Online Safety Act. Watch item, no direct developer duty yet. |
United Kingdom (UK) |
2027-01-31 |
none |
2027-01-31 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 3.1 |
| 2027-02-01 |
Play Console technical quality requirements. memory, bitmap, and DEX optimization thresholds (Play Console Help answer 17492799) |
Google states From February 2027 (exact day not published) apps must meet minimum optimization of at least 25 percent coverage across optimization, shrinking, and obfuscation with a tool such as R8, must not hold bitmaps in memory in non-visible states, and must stay within memory bad-behavior thresholds. Failure affects visibility and publishing capabilities. |
Google Play (Global) |
2026-08-26 |
until February 2027 |
2027-02-01 |
HIGH |
docs/GOOGLE-PLAY.md 2026 policy rounds, references/rules/performance.md |
| 2027-03-01 |
Under-16 social media ban and functionality restrictions, secondary legislation under the Children’s Wellbeing and Schools Act (announced 15 June 2026) |
Regulations are to be laid before the end of 2026 and implemented in spring 2027 (exact day not yet published, tracked here as 1 March 2027). User-to-user social platforms must block under-16 accounts. For 16 and 17 year olds livestreaming and stranger contact are off by default, notifications are off from midnight to 6am, autoplay and personalised feeds are off by default. AI romantic companion chatbots must enforce a minimum age of 18. |
United Kingdom (UK) |
2027-03-01 |
none |
2027-03-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 3.1, references/guidelines/by-app-type/social-and-user-generated-content.md |
| 2027-04-01 |
Apple App Store Submission Requirements |
Starting April 2027 apps and games uploaded to App Store Connect must be built with the iOS 27 and iPadOS 27 SDK or later, and the matching tvOS 27, visionOS 27, and watchOS 27 SDKs. Apple has published the month only, no exact day, so this entry is tracked as 1 April 2027 and must be re-checked when Apple names the date. macOS is not in Apple’s list. Announced 9 September 2026 with the Xcode 27 Release Candidate. Source https://developer.apple.com/news/?id=k1mtkt1k |
Apple App Store (Global) |
2026-09-09 |
about 7 months |
2027-04-01 |
CRITICAL |
docs/PLATFORM-MECHANICS-2026.md section 1.6, docs/APPLE.md 2026 changes, docs/PRE-SUBMISSION-CHECKLIST.md Apple specific |
| 2027-04-01 |
Apple App Store Submission Requirements |
Starting April 2027 App Store Connect requires iPhone Duo screenshots for any app using the iOS 27.1 SDK or later (Apple’s screenshot specification page scopes it to that SDK, and the 5 October 2026 news post says every app and game submitted). App Store Connect has accepted iPhone Duo optimized apps and Duo screenshots since 5 October 2026, and a product page with Duo screenshots shows a badge that the app is optimized for iPhone Duo. Apple has published the month only, no exact day, so this entry is tracked as 1 April 2027 and must be re-checked when Apple names the date. Sources https://developer.apple.com/news/?id=kkphp5qo https://developer.apple.com/help/app-store-connect/reference/app-information/screenshot-specifications |
Apple App Store (Global) |
2026-10-05 |
about 6 months |
2027-04-01 |
HIGH |
docs/PLATFORM-MECHANICS-2026.md section 1.8, docs/PRE-SUBMISSION-CHECKLIST.md Apple specific |
| 2027-04-01 |
Play Console technical quality requirements. Zero-Tap Sign-In restoration (Play Console Help answer 17492799) |
Google states From April 2027 (exact day not published) any app supporting user sign-in, optional or mandatory, must restore the user’s sign-in state when they move to a new Android device using the Restore Credentials API. Games are currently out of scope. |
Google Play (Global) |
2026-08-26 |
until April 2027 |
2027-04-01 |
HIGH |
docs/GOOGLE-PLAY.md 2026 policy rounds, references/rules/design.md |
| 2027-04-26 |
ADA Title II web and mobile app accessibility, 28 CFR Part 35 Subpart H, Interim Final Rule FR Doc. 2026-07663 (20 April 2026) |
A mobile app provided or made available by a state or local government entity serving 50,000 or more people must conform to WCAG 2.1 Level AA. Reaches a commercial developer through the contract or licensing chain. The 2024 date of 24 April 2026 was extended to 26 April 2027. |
United States (Federal) |
2026-04-20 |
none |
2027-04-26 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.8, references/rules/design.md |
| 2027-05-06 |
Utah SB 142 (App Store Accountability Act) as amended by HB 498 (2026) |
Request and receive age category from store, confirm parental consent for minor accounts, delete verification data. HB 498 (2026) moved every substantive duty to Beginning May 6, 2027, brought pre-installed apps into scope, repealed Division rulemaking, and replaced AG enforcement with a private right of action (1,000 dollars per violation minimum). The CCIA challenge was voluntarily dismissed on 21 April 2026. |
Utah (USA State) |
2027-05-06 |
12 months for operational aspects |
2027-05-06 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 1, section 2.2, references/rules/privacy.md |
| 2027-05-11 |
Section 504 web and mobile app accessibility for recipients of HHS financial assistance, 45 CFR 84.84(b), Interim Final Rule 91 FR 25496 (11 May 2026) |
A mobile app provided directly or through a contractual or licensing arrangement by any recipient of HHS federal financial assistance with 15 or more employees must conform to WCAG 2.1 Level AA. Extended from 11 May 2026 to 11 May 2027. |
United States (Federal) |
2026-05-07 |
none |
2027-05-11 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 2.8, references/guidelines/by-app-type/health-fitness-and-medical.md |
| 2027-05-13 |
Digital Personal Data Protection Act (DPDPA) 2023 / DPDP Rules 2025 |
Verifiable parental consent through government-backed system (e.g. DigiLocker) for under-18s; behavioral tracking/targeted ads prohibited. |
India |
2025-11-13 |
18 months |
2027-05-13 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.6, references/guidelines/by-app-type/kids-category-and-families.md |
| 2027-07-01 |
Louisiana HB 977 (2026), Act No. 185, R.S. 51:1771 to 1775 (App Store Accountability Act), replacing HB 570 (2025) |
Age category request, parental consent, re-request consent on major updates. Act 481 of 2025 (HB 570) never takes effect. HB 977 re-enacts the regime effective 1 July 2027. Apple’s storefront still exposes the Louisiana age-range signal on its own schedule. |
Louisiana (USA State) |
2027-07-01 |
12 months |
2027-07-01 |
CRITICAL |
docs/GLOBAL-REGULATORY-2026.md section 1, section 2.2, references/rules/privacy.md |
| 2027-07-01 |
SB 243, Business and Professions Code Chapter 22.6, sections 22601 to 22606 |
Companion chatbot operators report annually to the Office of Suicide Prevention on crisis referrals and protocols from 1 July 2027, on top of the disclosure and minor-protection duties already in force. |
California (USA State) |
2027-07-01 |
none |
2027-07-01 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 2.5, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2027-08-31 |
Google Play Billing Library deprecation ladder (developer.android.com billing deprecation FAQ) |
Play Billing Library 8 becomes the minimum for all published apps by 31 August 2027 (extension to 1 November 2027), and version 9 by 31 August 2028 (extension to 1 November 2028). The 31 August 2026 v8 gate for new submissions carried an extension to 1 November 2026. Already-published lower-version binaries keep transacting until their deadline. |
Google Play (Global) |
2026-08-31 |
until 1 November 2027 |
2027-11-01 |
HIGH |
docs/PLATFORM-MECHANICS-2026.md section 2.4, references/rules/payments.md |
| 2027-12-02 |
EU AI Act, Regulation (EU) 2024/1689 (as amended by AI Omnibus, in force 27 July 2026) |
High-risk AI systems (Annex III) obligations, compliance checks, and governance requirements deferred by the AI Omnibus (in force 27 July 2026). Date set by Regulation (EU) 2026/1744 of 8 July 2026, in force, not a proposal. |
European Union (EU) |
2024-08-01 |
40 months |
2027-12-02 |
HIGH |
docs/EU-REGULATORY-2026.md section 1.5, references/guidelines/by-app-type/ai-and-generative-apps.md |
| 2027-12-11 |
Cyber Resilience Act, Regulation (EU) 2024/2847 |
Main security-by-design and vulnerability handling obligations. |
European Union (EU) |
2024-12-11 |
36 months |
2027-12-11 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5 |
| 2027-12-24 |
eIDAS 2, Regulation (EU) 910/2014 as amended by Regulation (EU) 2024/1183, Article 5f(2) |
A private relying party above micro or small size that uses strong user authentication in banking, finance, health, telecom, transport, energy, education, or digital infrastructure must accept the EU Digital Identity Wallet on user request, 36 months after the implementing acts (derived date 24 December 2027). |
European Union (EU) |
2027-12-24 |
none |
2027-12-24 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5, references/rules/privacy.md |
| 2028-04-03 |
Regulation (EU) 2026/1881 of 24 July 2026, temporary ePrivacy derogation for voluntary CSAM detection |
Voluntary CSAM scanning in number-independent interpersonal communications services is lawful only until 3 April 2028. A messaging app relying on it needs the permanent CSA Regulation basis or must stop. |
European Union (EU) |
2026-08-01 |
none |
2028-04-03 |
MEDIUM |
docs/EU-REGULATORY-2026.md section 5, references/rules/safety.md |
| 2028-04-26 |
ADA Title II web and mobile app accessibility, 28 CFR Part 35 Subpart H, Interim Final Rule FR Doc. 2026-07663 |
Same WCAG 2.1 AA duty for public entities under 50,000 people and every special district government, extended to 26 April 2028. |
United States (Federal) |
2026-04-20 |
none |
2028-04-26 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 2.8, references/rules/design.md |
| 2028-05-10 |
Section 504 web and mobile app accessibility, 45 CFR 84.84(b)(2), Interim Final Rule 91 FR 25496 |
Same WCAG 2.1 AA duty for HHS-funded recipients with fewer than 15 employees, extended from 10 May 2027 to 10 May 2028. |
United States (Federal) |
2026-05-07 |
none |
2028-05-10 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 2.8, references/guidelines/by-app-type/health-fitness-and-medical.md |
| 2028-07-01 |
SB26-051, Age Attestation on Computing Devices |
Operating system providers request age at account setup and expose a real-time age-signal API. Developers request the signal at launch or account creation. Effective 1 July 2028, existing devices by 1 January 2029. |
Colorado (USA State) |
2028-07-01 |
none |
2028-07-01 |
MEDIUM |
docs/GLOBAL-REGULATORY-2026.md section 2.5, references/rules/privacy.md |
| 2028-07-16 |
Act on the Protection of Personal Information amendment, promulgated 17 July 2026 (Act No. 56 of 2026, number from secondary sources) |
Rebuild consent, children’s data, and biometric handling for the amended APPI, including a new under-16 threshold where the legal representative is the party for consent, notice, and use-stop requests, plus a surcharge regime. Effective within two years of promulgation, exact day set by cabinet order. |
Japan |
2028-07-16 |
none |
2028-07-16 |
HIGH |
docs/GLOBAL-REGULATORY-2026.md section 3.8, references/rules/privacy.md |
| 2028-08-02 |
EU AI Act, Regulation (EU) 2024/1689 (as amended by AI Omnibus, in force 27 July 2026) |
High-risk AI systems embedded in physical products (Annex I machinery, toys, lifts, etc.) compliance deferred by the AI Omnibus (in force 27 July 2026). Date set by Regulation (EU) 2026/1744 of 8 July 2026, in force, not a proposal. |
European Union (EU) |
2024-08-01 |
48 months |
2028-08-02 |
HIGH |
docs/EU-REGULATORY-2026.md section 1.5, references/guidelines/by-app-type/ai-and-generative-apps.md |