Which platforms does GDPR apply to?

ConductAtlas tracks GDPR-relevant provisions across 100 platforms. Visit the regulation page to see all affected platforms and their specific provisions.

How does ConductAtlas monitor GDPR compliance?

ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect GDPR obligations. Every change is archived with cryptographic verification.

Regulation (EU) 2016/679

General Data Protection Regulation

Regulation — European Union

Effective: May 25, 2018 100 platforms tracked 16699 provisions indexed Enforced by: European Data Protection Board (EDPB), National Data Protection Authorities (DPAs) Last reviewed May 9, 2026

Overview

The General Data Protection Regulation is the European Union's comprehensive data protection framework, replacing the 1995 Data Protection Directive. It establishes strict requirements for how organizations collect, process, store, and share personal data of individuals in the EU and EEA.

GDPR grants data subjects specific rights including the right to access, rectification, erasure ("right to be forgotten"), data portability, and the right to object to automated decision-making. Organizations must demonstrate a lawful basis for processing (consent, contractual necessity, legitimate interest, legal obligation, vital interest, or public task) and implement appropriate technical and organizational safeguards.

Enforcement is carried out by national Data Protection Authorities coordinated through the European Data Protection Board. Penalties can reach up to €20 million or 4% of global annual turnover, whichever is higher — making GDPR one of the most consequential regulatory frameworks for platform governance globally.

Penalties

Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Lower-tier violations (e.g. record-keeping failures): up to €10 million or 2% of turnover.

Key Articles & Sections

Art. 5 Principles of Processing

Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.
Read full text →
Art. 6 Lawfulness of Processing

Six lawful bases for processing: consent, contract, legal obligation, vital interests, public task, legitimate interests.
Read full text →
Art. 7 Conditions for Consent

Consent must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.
Read full text →
Art. 13-14 Transparency Requirements

Controllers must provide detailed information at point of collection including purposes, legal basis, recipients, retention periods, and data subject rights.
Read full text →
Art. 15 Right of Access

Data subjects have the right to obtain confirmation of processing and access to their personal data.
Read full text →
Art. 17 Right to Erasure

The "right to be forgotten" — data subjects can request deletion when data is no longer necessary, consent is withdrawn, or processing is unlawful.
Read full text →
Art. 20 Right to Data Portability

Data subjects can receive their data in a structured, commonly used, machine-readable format and transmit it to another controller.
Read full text →
Art. 22 Automated Decision-Making

Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects.
Read full text →
Art. 25 Data Protection by Design and Default

Controllers must implement appropriate technical and organizational measures at the time of design and by default.
Read full text →
Art. 32 Security of Processing

Controllers and processors must implement appropriate technical and organizational security measures including encryption and pseudonymization.
Read full text →
Art. 33-34 Breach Notification

Personal data breaches must be reported to supervisory authority within 72 hours. Data subjects must be notified if breach poses high risk.
Read full text →
Art. 44-49 International Transfers

Personal data transfers outside EU/EEA require adequacy decisions, standard contractual clauses, binding corporate rules, or other safeguards.
Read full text →

Platforms We Track Subject to GDPR

23andMe

10 relevant provisions

Activision

72 relevant provisions

Adobe

80 relevant provisions

Adyen

41 relevant provisions

Affirm

83 relevant provisions

Afterpay

31 relevant provisions

AI21 Labs

72 relevant provisions

Airbnb

11 relevant provisions

Airtable

8 relevant provisions

Allstate

0 relevant provisions

Amazon

5 relevant provisions

Amazon Marketplace

42 relevant provisions

American Airlines

107 relevant provisions

Amplitude

75 relevant provisions

Ancestry

109 relevant provisions

Anthropic

190 relevant provisions

Anyscale

84 relevant provisions

Apple

40 relevant provisions

Apple App Store

66 relevant provisions

Apple Pay

6 relevant provisions

Arlo

2 relevant provisions

Asana

27 relevant provisions

Atlassian

91 relevant provisions

AT&T

7 relevant provisions

Audible

0 relevant provisions

Auth0

16 relevant provisions

AWS

106 relevant provisions

AWS Bedrock

92 relevant provisions

BeReal

70 relevant provisions

Best Buy

73 relevant provisions

Showing 30 of 100 platforms. View all platforms →

Recent Changes Related to GDPR

Jul 23, 2026 Postman Low

An update detected on July 23, 2026 modified the table of contents in Postman's Terms of Service document. The navigation menu changed from listing 'Postman Workshop Terms of Use' to listing 'Trainin…
View change record →
Jul 23, 2026 Meta Ads Low

Meta Ads removed Weight Loss and Cosmetic Products and Procedures as a separate category in its Health and Wellness advertising policy, detected on July 23, 2026. Weight loss and weight gain product …
View change record →
Jul 23, 2026 American Airlines Low

American Airlines updated its privacy policy landing page in an update detected on July 23, 2026. The change removed a line directing users to enable JavaScript and reorganized the page header struct…
View change record →
Jul 23, 2026 American Airlines Low

American Airlines removed instructional language about enabling JavaScript from the opening of their Conditions of Carriage document in an update detected on July 23, 2026. The removed text stated 'H…
View change record →
Jul 23, 2026 Samsung Low

Samsung updated its privacy policy website navigation and promotional sections in an update detected on July 23, 2026. The changes added references to new Samsung products (Galaxy Z Fold8, Galaxy Wat…
View change record →
Jul 23, 2026 Asana Low

The detected change involves minor modifications to Asana's Privacy Statement navigation and footer structure captured on July 23, 2026. Specific sentence-level modifications affected the page layout…
View change record →
Jul 23, 2026 Asana Low

Asana's Terms of Service underwent a navigation and header restructuring detected on July 23, 2026. The changes involved reordering of menu items and navigation elements in the document header and fo…
View change record →
Jul 23, 2026 Synthesia Low

Synthesia's updated privacy policy now explicitly discloses that voice and text inputs from demo experiences are processed as part of their data collection. The policy expanded its list of data types…
View change record →
Jul 23, 2026 AT&T Low

AT&T's Terms of Service was modified on July 23, 2026, with a single sentence changed in the document. The specific operational impact of this sentence-level modification cannot be determined from th…
View change record →
Jul 23, 2026 Google Gemini Low

Google Gemini updated product naming in its privacy notice on July 23, 2026. The document previously referred to 'Notebooks' and 'NotebookLM' when describing where files are saved and where privacy i…
View change record →

ⓘ

ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology