Built to the GDPR, annotated for the rest
The GDPR is the most prescriptive regime for privacy notices, so a notice that satisfies Articles 13 and 14 covers most of what other laws require. The icons below exist only because another regime adds a practice, a right or a disclosure that the GDPR does not.
United Kingdom
The UK GDPR mirrors the EU text, with the ICO as supervisory authority and the International Data Transfer Agreement in place of the EU standard contractual clauses. The Data (Use and Access) Act 2025 adds a "recognised legitimate interests" basis (Annex 1) with no balancing test, names direct marketing, intra-group administration and network security as example legitimate interests, and reworks the automated-decision rules as Articles 22A–22D.
Icons added for the UK: Recognised legitimate interest, IDTA.
Australia
APP 1.4 requires a policy to state the kinds of information held, how it is collected, purposes, access and correction, the complaints process, and whether information is likely to go overseas and to which countries. There is no lawful-basis concept; the primary/secondary purpose test in APP 6 does similar work. Notifiable data breach rules sit in Part IIIC of the Privacy Act 1988.
Icons added for Australia: Countries of overseas recipients; the complaints and collection method snippets carry APP variants.
United States (California)
The CCPA/CPRA thinks in categories: personal information collected, sources, business purposes, third parties, and whether information is "sold" or "shared" for cross-context behavioural advertising, each looking back 12 months. It adds a right to opt out of sale/sharing (with a mandatory link and honouring of opt-out preference signals such as Global Privacy Control), a right to limit use of sensitive personal information, and a non-discrimination guarantee.
Icons added for the US: Sold, Not sold, Cross-context sharing, Opt out, Limit sensitive use, Non-discrimination, Opt-out signals.
ePrivacy, the DSA and the AI Act
Cookies and device storage are governed by Article 5(3) of the ePrivacy Directive (PECR in the UK), not the GDPR; consent is needed for anything non-essential. The Digital Services Act adds transparency for online platforms about advertising (Art 26), recommender systems (Art 27) and content moderation (Arts 14–17); the AI Act requires people to be told when they interact with an AI system (Art 50). The icons for cookies, cookie consent, personalised advertising, moderation and AI assistants carry those references.