> Laws register | Trust Center | Dating API: https://www.datingapi.io/trust/laws [Trust Center](https://www.datingapi.io/trust) / Laws register # Every law we build for, and who carries each duty. For the US, Canada, the UK, the EU and Australia, with German law alongside the EU rules. Each entry links to the official text, names the parts that matter for a dating app, and splits the duty between you as the app operator and us as your processor. This is our reading, not legal advice. - [European Union](#eu) - [Germany](#germany) - [United Kingdom](#uk) - [United States](#us) - [Canada](#canada) - [Australia](#australia) - [Standards](#standards) - [Who does what](#who) Reviewed 18 October 2026 - [Overview](https://www.datingapi.io/trust) - [Company](https://www.datingapi.io/trust/company) - [Security](https://www.datingapi.io/trust/security) - [Privacy](https://www.datingapi.io/trust/privacy) - [Sub-processors](https://www.datingapi.io/trust/subprocessors) - [Age checks](https://www.datingapi.io/trust/age-and-identity) - [Online safety](https://www.datingapi.io/trust/online-safety) - [AI](https://www.datingapi.io/trust/ai) - [Incidents](https://www.datingapi.io/trust/incidents) - [Laws](https://www.datingapi.io/trust/laws) Who does what ## Your duties, ours, and the shared ones. Under data protection law you are the controller and we are your processor. Under the DSA and the Online Safety Act you are the service. This is how the work divides. | Duty | Who | How | | --- | --- | --- | | **Decide why and how member data is used** | You | Your lawful basis, privacy notice and terms. We follow your written instructions. | | **Ask members for consent** | Both | You decide what you ask for; we build the screens and record the answers, including consent for device storage (TDDDG §25) and for any face check. | | **Check members are adults** | Both | You set the policy for your app. We run the checks, with face and ID checks available from 30 November 2026. | | **Moderation decisions and reasons** | Both | You set the rules. Our trust and safety team applies them, reviews reports and records the reasons. | | **DSA transparency reports and database submissions** | You | You are the provider under the DSA. We supply the data. | | **Tell regulators and members about a breach** | You | We tell you within 12 hours and give you the facts each notice needs. | | **Data protection impact assessment** | You | We give you the inputs: data flows, risks and the measures in place. | | **Member requests to see, correct or delete data** | Both | Members ask through your app; we do the work and complete it within 30 days at most. | | **Security of the platform** | Us | Every control on the Security page. | | **Choosing and checking sub-processors** | Us | Reviewed before use and every year, with at least 30 days’ notice of changes. | | **International transfers** | Both | The standard contractual clauses in our DPA cover transfers we make for you. | | **Provider details (Impressum) and consumer terms** | You | Your app, your name. We build the screens to your text. | | **Card payments** | You | Handled by PCI DSS Level 1 payment providers. We never see or store full card numbers. | In place Operating today. Partly in place Some of it operates today; the rest finishes by the date shown. In progress Work has started and finishes by the date shown. Being reviewed We are checking our terms or design against it with our lawyers. Not in use Switched off for every partner until the date shown. Mainly your duty The duty sits with you as the app operator. We supply what you need. Not stored by us We never hold this data. Laws register · 9 entries ## European Union Regulations apply directly in every member state; directives through national law. ### General Data Protection Regulation (EU) 2016/679 (DSGVO) In progress · Nov 2026 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) What matters Article 9 (dating data can reveal sex life and sexual orientation), 22 (automated decisions), 28 (processor terms), 32 (security), 33 and 34 (breach notice), 35 (impact assessments), 44 to 49 (transfers). Your part Lawful basis, privacy notice, consent, impact assessment, notice to your regulator and members. Our part Act only on your instructions, keep data secure, control sub-processors, tell you about a breach within 12 hours, help with member requests, delete at the end. [More on this](https://www.datingapi.io/trust/privacy) ### Standard contractual clauses, Decision (EU) 2021/914 In progress · Nov 2026 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) What matters Modules 2 and 3 cover transfers of member data outside the EU. Your part Sign the DPA, which includes the clauses. Our part Include the clauses in our DPA and flow them down to every sub-processor outside the EU. [More on this](https://www.datingapi.io/trust/subprocessors) ### EU-US Data Privacy Framework, Decision (EU) 2023/1795 In progress · Nov 2026 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj) What matters The General Court upheld the framework in September 2025 (Latombe); an appeal is with the Court of Justice. We rely on the standard contractual clauses either way. Your part Nothing extra. Our part Self-certify High Intent Media Inc., alongside the clauses. [More on this](https://www.datingapi.io/trust/privacy) ### Digital Services Act (EU) 2022/2065 Partly in place · Jan 2027 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2022/2065/oj) What matters Notice and action (Article 16), statements of reasons (17), complaints (20), out-of-court settlement (21), misuse (23), the Transparency Database (24(5)) and minors (28, with the Commission’s 2025 guidelines). Your part You are the provider: your terms, reports and transparency. Our part Report tools, decision records, reasons, appeals to a person and the data for your reports. [More on this](https://www.datingapi.io/trust/online-safety) ### AI Act (EU) 2024/1689 In progress · Nov 2026 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) What matters AI literacy (Article 4), banned practices (5), transparency (50, from 2 August 2026) and the high-risk list in Annex III (from 2 December 2027 after the 2026 amendments). Your part Tell members about AI in your own notices. Our part Keep the AI register current, label AI content, keep people in the loop. [More on this](https://www.datingapi.io/trust/ai) ### NIS2 Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 In progress · Jan 2027 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) What matters Social networking platforms are listed in Annex II. Regulated partners must manage supplier security (Article 21(2)(d)) and report incidents in 24 hours, 72 hours and one month (Article 23). Your part Register, manage risk and report, if you are in scope. Our part Meet the Article 21 measures as your supplier, and give you notice fast enough for your Article 23 deadlines. [More on this](https://www.datingapi.io/trust/security) ### Data Act (EU) 2023/2854 Being reviewed Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2023/2854/oj) What matters Switching between data processing services (Articles 23 to 31): at most 2 months’ notice, a 30-day transition, and no switching charges at all from 12 January 2027. Your part Nothing extra. Our part Free export at any time and run-off support are already in our standard terms. We are checking the notice and transition periods against the Act. [More on this](https://www.datingapi.io/trust/company) ### Cyber Resilience Act (EU) 2024/2847 Being reviewed Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) What matters Covers products with digital elements, which can include apps. Reporting duties since 11 September 2026; the rest from 11 December 2027. Pure software as a service is usually outside it. Your part As the app publisher, you may be the manufacturer of your app. Our part Tell you within 12 hours of an exploited vulnerability, and confirm which of the apps we build are in scope. [More on this](https://www.datingapi.io/trust/incidents) ### Consumer Rights Directive, withdrawal button (Directive (EU) 2023/2673) Being reviewed Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/dir/2023/2673/oj) What matters Since 19 June 2026, online contracts need a withdrawal function. Relevant wherever we run web checkout for a partner. Your part Your consumer terms and your billing. Our part Build the withdrawal and cancellation screens into any checkout we run for you. Laws register · 6 entries ## Germany German law that sits alongside the EU rules for partners and members in Germany. ### Federal Data Protection Act (BDSG) In progress · Nov 2026 Official text: [gesetze-im-internet.de](https://www.gesetze-im-internet.de/bdsg_2018/) What matters §22: specific measures for special category data. §38: when German companies must appoint a data protection officer. Your part Your own data protection officer, if you are in scope. Our part Treat all member data as special category data, with the measures on the Privacy page. [More on this](https://www.datingapi.io/trust/privacy) ### Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG) Being reviewed Official text: [gesetze-im-internet.de](https://www.gesetze-im-internet.de/ttdsg/) What matters §25: consent before storing or reading information on a member’s device, unless strictly necessary. Covers app SDKs, push tokens and analytics. Your part Decide what you ask consent for. Our part Tell you what each app stores on the device, and build the consent screens for anything that is not strictly necessary. ### Digital Services Act (Germany) (DDG) Mainly your duty Official text: [gesetze-im-internet.de](https://www.gesetze-im-internet.de/ddg/) What matters §5: provider details every service must show (the Impressum). Names the Bundesnetzagentur as Germany’s DSA regulator. Your part Your app’s Impressum and your DSA contact point. Our part Show our own provider details on the Company page. [More on this](https://www.datingapi.io/trust/company) ### Interstate Treaty on the Protection of Minors in the Media (JMStV, with the KJM’s age check rules) Not in use · until 30 Nov 2026 Official text: [kjm-online.de](https://www.kjm-online.de) What matters Age checks for content not suitable for minors. The KJM accepts Yoti’s facial age estimation; since 2025 the buffer for 18+ is three years, so an estimate must read 21 or over. Your part Decide whether your app’s content must sit behind an age-checked closed group. Our part Set the age estimate threshold per country, using the KJM buffer in Germany. [More on this](https://www.datingapi.io/trust/age-and-identity) ### NIS2 Implementation Act and the new BSI Act (NIS2UmsuCG, BSIG) In progress · Jan 2027 Official text: [bsi.bund.de](https://www.bsi.bund.de) What matters In force since 6 December 2025. German companies in scope must register with the BSI and pass security duties down to their suppliers by contract. Your part Registration and reporting, if you are in scope. Our part Meet the NIS2 measures, and support your supplier checks with our questionnaire answers and audit rights. [More on this](https://www.datingapi.io/trust/security) ### Civil Code: cancellation and withdrawal buttons (BGB §312k and §356a) Being reviewed Official text: [gesetze-im-internet.de](https://www.gesetze-im-internet.de/bgb/) What matters Online subscriptions need a cancellation button, and online contracts a withdrawal button. Your part Your consumer terms and your billing. Our part Build both buttons into any web checkout we run for a German partner. Laws register · 2 entries ## United Kingdom ### UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025 In progress · Nov 2026 Official text: [legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2018/12/contents) What matters Processor terms, security, breach notice, and the UK addendum for transfers. Your part Lawful basis, privacy notice, notice to the ICO. Our part The same processor duties as under the EU GDPR, with the UK addendum in our DPA. [More on this](https://www.datingapi.io/trust/privacy) ### Online Safety Act 2023 Partly in place · Nov 2026 Official text: [legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2023/50/contents) What matters Highly effective age assurance, illegal content and child safety duties, enforced by Ofcom with fines of up to 10% of global revenue. Your part Your risk assessments and your duties as the service. Our part Report and block tools, moderation, records, and face and ID checks from 30 November 2026. [More on this](https://www.datingapi.io/trust/online-safety) Laws register · 6 entries ## United States Federal and state law. ### California Consumer Privacy Act, as amended by the CPRA In progress · Nov 2026 Official text: [cppa.ca.gov](https://cppa.ca.gov/regulations/) What matters Service provider terms, no selling or sharing, help with member requests. Your part Your notices and member rights. Our part Service provider terms in our US state addendum. [More on this](https://www.datingapi.io/trust/privacy) ### Illinois Biometric Information Privacy Act (740 ILCS 14) Not in use · until 30 Nov 2026 Official text: [ilga.gov](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57) What matters Written release before collection, and a public retention and destruction schedule. Your part Nothing extra while face checks are off. Our part The consent screen and the published biometric data policy. [More on this](https://www.datingapi.io/trust/age-and-identity) ### Texas Capture or Use of Biometric Identifier Act (Bus. and Com. Code §503.001) Not in use · until 30 Nov 2026 Official text: [statutes.capitol.texas.gov](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm) What matters Consent before capture, and destruction within one year of the purpose ending. Your part Nothing extra while face checks are off. Our part The same consent screen and retention schedule. [More on this](https://www.datingapi.io/trust/age-and-identity) ### Washington biometric law (RCW 19.375) and My Health My Data Act (RCW 19.373) Not in use · until 30 Nov 2026 Official text: [app.leg.wa.gov](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373) What matters The health data act counts biometric data as consumer health data, with consent and a separate privacy policy. Your part Your consumer health data notice, if face checks are switched on for your app. Our part The consent screen and policy text for your notice. [More on this](https://www.datingapi.io/trust/age-and-identity) ### Colorado Privacy Act, biometric amendment Not in use · until 30 Nov 2026 Official text: [leg.colorado.gov](https://leg.colorado.gov/bills/hb24-1130) What matters Consent and a written retention policy for biometric identifiers. Your part Nothing extra while face checks are off. Our part The consent screen and the published biometric data policy. [More on this](https://www.datingapi.io/trust/age-and-identity) ### State online dating safety laws In progress · Nov 2026 Official text: [Regulatory Oversight, Sept 2026](https://www.regulatoryoversight.com/2026/09/swipe-right-on-compliance-match-groups-settlement-with-new-jersey-over-criminal-background-screening-policies/) What matters Disclosures about criminal background checks, and safety tips, in several states. Your part Your terms and safety pages. Our part We don’t run criminal background checks, and show the notice each state requires, in your app’s words. [More on this](https://www.datingapi.io/trust/online-safety) Laws register · 2 entries ## Canada ### PIPEDA In progress · Nov 2026 Official text: [laws-lois.justice.gc.ca](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/) What matters Safeguards, breach records and reporting. Your part Breach reports and records. Our part Safeguards, and the facts for your breach records. [More on this](https://www.datingapi.io/trust/privacy) ### Quebec Law 25 (Act respecting the protection of personal information in the private sector) In progress · Nov 2026 Official text: [legisquebec.gouv.qc.ca](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1) What matters Privacy impact assessments before data leaves Quebec. Your part The transfer assessment. Our part The inputs for it: where data goes and how it is protected. [More on this](https://www.datingapi.io/trust/privacy) Laws register · 1 entry ## Australia ### Online Dating Industry Code In progress · Jan 2027 Official text: [infrastructure.gov.au](https://www.infrastructure.gov.au/department/media/news/new-industry-code-now-operational-make-online-dating-safer) What matters Detect and act on harm that starts online, support members who report it, and keep records for reports on account closures and moderation. Your part Your code commitments and reports. Our part Report tools, moderation records and the data for your reports. [More on this](https://www.datingapi.io/trust/online-safety) Laws register · 3 entries ## Standards Not laws, but what auditors and buyers ask for. ### ISO/IEC 27001:2022 In progress · target June 2027 Official text: [iso.org](https://www.iso.org/standard/27001) What matters Information security management system, audited by an accredited body. Your part Nothing. Our part Build the system, book the auditor by 15 December 2026, certificate targeted for June 2027. [More on this](https://www.datingapi.io/trust/security) ### BSI C5 cloud computing criteria catalogue Partly in place Official text: [bsi.bund.de](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5.html) What matters The cloud security criteria German buyers often ask about. Your part Nothing. Our part Our controls are mapped to the C5 domains on the Security page. No C5 attestation yet. [More on this](https://www.datingapi.io/trust/security) ### PCI DSS Not stored by us Official text: [pcisecuritystandards.org](https://www.pcisecuritystandards.org) What matters Security of card data. Your part Your payment provider. Our part Card data is handled by PCI DSS Level 1 payment providers. We never see or store full card numbers. More in the Trust Center [### Company and continuity Who we are, who signs, and what protects you if anything goes wrong Open](https://www.datingapi.io/trust/company)[### Security controls Every control with its status, mapped to ISO/IEC 27001 and BSI C5 Open](https://www.datingapi.io/trust/security)[### Privacy and data transfers Our role as processor, sensitive data, retention and transfers Open](https://www.datingapi.io/trust/privacy)[### Sub-processors Who else handles member data, where, and under which safeguard Open](https://www.datingapi.io/trust/subprocessors)[### Age checks and biometric data How age and ID checks will work, and why none run until 30 November Open](https://www.datingapi.io/trust/age-and-identity)[### Moderation and online safety Reports, decisions, appeals and the DSA and Online Safety Act duties Open](https://www.datingapi.io/trust/online-safety)[### AI register Every AI system on the platform, its status and how the AI Act treats it Open](https://www.datingapi.io/trust/ai)[### Incidents Our notice times, set against your own legal deadlines Open](https://www.datingapi.io/trust/incidents) Questions for our security or privacy team? [security@highintentmedia.com](mailto:security@highintentmedia.com) and [privacy@highintentmedia.com](mailto:privacy@highintentmedia.com). Or [request the security pack](https://www.datingapi.io/trust#request).