<?php
/**
 * Privacy laws GoConsent checks against, with who they apply to.
 *
 * Reviewed 2026-10-09 against official statutes and agency pages (sources in the
 * GoConsent rules matrix). Starting points for compliance, not legal advice.
 *
 * Comprehensive state laws, fields:
 *   name, law, cite, effective (Y-m-d), test:
 *     n        consumers (residents' data per year) that triggers the law, or null
 *     nsell    lower consumer count when the business earns revenue from selling data, or null
 *     rev      true when "over about $25M revenue" alone triggers it
 *     rev_and  true when the revenue test must ALSO be met (TN, UT)
 *     sba      true when every business that is not an SBA "small business" is covered (TX, NE)
 *     sba_exempt  SBA small businesses are exempt even above the counts (MN)
 *     sba_unless_sells  covered above n unless a small business (under 500 employees) that does not sell data (AL)
 *     from     later thresholds by date, e.g. array( '2027-01-01' => array( 'n' => 10000 ) ) (DE)
 *     sensitive true when processing sensitive data alone triggers it (CT)
 *     never    true when thresholds are out of reach for GoConsent's audience (FL: $1B revenue)
 *   gpc       Y-m-d from which a universal opt-out signal (GPC) must be honored, or false
 *   appeal    appeal process required
 *   optin     sensitive data needs opt-in consent
 *   annual    privacy policy must be updated at least every 12 months
 *   incentive "Notice of Financial Incentive" for loyalty/rewards programs
 *
 * @package GoConsent
 */

namespace GoConsent\Rules;

defined( 'ABSPATH' ) || exit;

/**
 * Law catalog.
 */
class Catalog {

	/** Date of the last legal review. */
	const REVIEWED = '2026-10-09';

	/**
	 * Comprehensive state privacy laws.
	 *
	 * @return array
	 */
	public static function states() {
		$a = array(
			'US-CA' => array( 'California', 'California Consumer Privacy Act (CCPA/CPRA)', 'Cal. Civ. Code § 1798.100 et seq.', '2020-01-01', array( 'n' => 100000, 'rev' => true ), '2020-08-14', false, false, true, true ),
			'US-VA' => array( 'Virginia', 'Virginia Consumer Data Protection Act', 'Va. Code § 59.1-575 et seq.', '2023-01-01', array( 'n' => 100000, 'nsell' => 25000 ), false, true, true, false, false ),
			'US-CO' => array( 'Colorado', 'Colorado Privacy Act', 'Colo. Rev. Stat. § 6-1-1301 et seq.', '2023-07-01', array( 'n' => 100000, 'nsell' => 25000 ), '2024-07-01', true, true, false, true ),
			'US-CT' => array( 'Connecticut', 'Connecticut Data Privacy Act', 'Conn. Gen. Stat. § 42-515 et seq.', '2023-07-01', array( 'n' => 35000, 'sensitive' => true, 'nsell' => 0 ), '2025-01-01', true, true, false, false ),
			'US-UT' => array( 'Utah', 'Utah Consumer Privacy Act', 'Utah Code § 13-61-101 et seq.', '2023-12-31', array( 'rev_and' => true, 'n' => 100000, 'nsell' => 25000 ), false, false, false, false, false ),
			'US-TX' => array( 'Texas', 'Texas Data Privacy and Security Act', 'Tex. Bus. & Com. Code § 541.001 et seq.', '2024-07-01', array( 'sba' => true ), '2025-01-01', true, true, false, false ),
			'US-OR' => array( 'Oregon', 'Oregon Consumer Privacy Act', 'Or. Rev. Stat. § 646A.570 et seq.', '2024-07-01', array( 'n' => 100000, 'nsell' => 25000 ), '2026-01-01', true, true, false, false ),
			'US-FL' => array( 'Florida', 'Florida Digital Bill of Rights', 'Fla. Stat. § 501.701 et seq.', '2024-07-01', array( 'never' => true ), false, true, true, false, false ),
			'US-MT' => array( 'Montana', 'Montana Consumer Data Privacy Act', 'Mont. Code § 30-14-2801 et seq.', '2024-10-01', array( 'n' => 25000, 'nsell' => 15000 ), '2025-01-01', true, true, false, false ),
			'US-IA' => array( 'Iowa', 'Iowa Consumer Data Protection Act', 'Iowa Code ch. 715D', '2025-01-01', array( 'n' => 100000, 'nsell' => 25000 ), false, true, false, false, false ),
			'US-DE' => array( 'Delaware', 'Delaware Personal Data Privacy Act', 'Del. Code tit. 6, § 12D-101 et seq.', '2025-01-01', array( 'n' => 35000, 'nsell' => 10000, 'from' => array( '2027-01-01' => array( 'n' => 10000, 'nsell' => 5000 ) ) ), '2026-01-01', true, true, false, false ),
			'US-NE' => array( 'Nebraska', 'Nebraska Data Privacy Act', 'Neb. Rev. Stat. § 87-1101 et seq.', '2025-01-01', array( 'sba' => true ), '2025-01-01', true, true, false, false ),
			'US-NH' => array( 'New Hampshire', 'New Hampshire Privacy Act', 'N.H. Rev. Stat. ch. 507-H', '2025-01-01', array( 'n' => 35000, 'nsell' => 10000 ), '2025-01-01', true, true, false, false ),
			'US-NJ' => array( 'New Jersey', 'New Jersey Data Privacy Act', 'N.J. Stat. § 56:8-166.4 et seq.', '2025-01-15', array( 'n' => 100000, 'nsell' => 25000 ), '2025-07-15', true, true, false, false ),
			'US-TN' => array( 'Tennessee', 'Tennessee Information Protection Act', 'Tenn. Code § 47-18-3201 et seq.', '2025-07-01', array( 'rev_and' => true, 'n' => 175000, 'nsell' => 25000 ), false, true, true, false, false ),
			'US-MN' => array( 'Minnesota', 'Minnesota Consumer Data Privacy Act', 'Minn. Stat. § 325M.10 et seq.', '2025-07-31', array( 'n' => 100000, 'nsell' => 25000, 'sba_exempt' => true ), '2025-07-31', true, true, false, false ),
			'US-MD' => array( 'Maryland', 'Maryland Online Data Privacy Act', 'Md. Code, Com. Law § 14-4701 et seq.', '2025-10-01', array( 'n' => 35000, 'nsell' => 10000 ), '2025-10-01', true, true, false, false ),
			'US-IN' => array( 'Indiana', 'Indiana Consumer Data Protection Act', 'Ind. Code § 24-15', '2026-01-01', array( 'n' => 100000, 'nsell' => 25000 ), false, true, true, false, false ),
			'US-KY' => array( 'Kentucky', 'Kentucky Consumer Data Protection Act', 'Ky. Rev. Stat. § 367.3611 et seq.', '2026-01-01', array( 'n' => 100000, 'nsell' => 25000 ), false, true, true, false, false ),
			'US-RI' => array( 'Rhode Island', 'Rhode Island Data Transparency and Privacy Protection Act', 'R.I. Gen. Laws § 6-48.1-1 et seq.', '2026-01-01', array( 'n' => 35000, 'nsell' => 10000 ), false, true, true, false, false ),
			// Enacted, not yet in force.
			'US-OK' => array( 'Oklahoma', 'Oklahoma Consumer Data Privacy Act (SB 546)', 'SB 546 (2026)', '2027-01-01', array( 'n' => 100000, 'nsell' => 25000 ), false, true, true, false, false ),
			'US-LA' => array( 'Louisiana', 'Louisiana Consumer Privacy Act (SB 386)', 'SB 386 (2026)', '2027-01-01', array( 'n' => 75000, 'rev' => true ), '2027-01-01', true, true, false, false ),
			'US-AL' => array( 'Alabama', 'Alabama Personal Data Protection Act (HB 351)', 'HB 351 (2026)', '2027-05-01', array( 'n' => 25000, 'sba_unless_sells' => true ), false, false, true, false, false ),
			'US-VT' => array( 'Vermont', 'Vermont Data Privacy and Online Surveillance Act (Act 145)', 'Act 145 (2026)', '2028-01-01', array( 'n' => 35000, 'nsell' => 3000 ), '2028-01-01', true, true, false, false ),
		);
		$out = array();
		foreach ( $a as $id => $r ) {
			$out[ $id ] = array(
				'name'      => $r[0],
				'law'       => $r[1],
				'cite'      => $r[2],
				'effective' => $r[3],
				'test'      => $r[4],
				'gpc'       => $r[5],
				'appeal'    => $r[6],
				'optin'     => $r[7],
				'annual'    => $r[8],
				'incentive' => $r[9],
			);
		}
		/**
		 * Filter the comprehensive state law catalog.
		 *
		 * @param array $out Laws by location code.
		 */
		return apply_filters( 'goconsent_catalog_states', $out );
	}

	/**
	 * Laws with no size threshold, keyed by id. Each applies when its market is served
	 * (and, for industry laws, when the industry is chosen).
	 *
	 * @return array
	 */
	public static function others() {
		$o = array(
			'CALOPPA'  => array(
				'market' => 'US-CA',
				'short'  => 'CalOPPA',
				'law'    => 'California Online Privacy Protection Act',
				'cite'   => 'Cal. Bus. & Prof. Code §§ 22575–22579',
			),
			'DOPPA'    => array(
				'market' => 'US-DE',
				'short'  => 'DOPPA',
				'law'    => 'Delaware Online Privacy and Protection Act',
				'cite'   => 'Del. Code tit. 6, § 1205C',
			),
			'NV603A'   => array(
				'market' => 'US-NV',
				'short'  => 'Nevada NRS 603A',
				'law'    => 'Nevada online privacy notice law',
				'cite'   => 'Nev. Rev. Stat. §§ 603A.300–.360',
			),
			'WA_MHMDA' => array(
				'market' => 'US-WA',
				'health' => true,
				'short'  => 'Washington My Health My Data Act',
				'law'    => 'Washington My Health My Data Act',
				'cite'   => 'RCW 19.373',
			),
			'NV_SB370' => array(
				'market' => 'US-NV',
				'health' => true,
				'short'  => 'Nevada SB 370',
				'law'    => 'Nevada consumer health data law (SB 370)',
				'cite'   => 'Nev. Rev. Stat. ch. 603A (SB 370, 2023)',
			),
			'CT_CHD'   => array(
				'market' => 'US-CT',
				'health' => true,
				'short'  => 'Connecticut consumer health data rules',
				'law'    => 'Connecticut Data Privacy Act, consumer health data provisions',
				'cite'   => 'Conn. Gen. Stat. § 42-515 et seq.',
			),
			'COPPA'    => array(
				'market'   => '*US',
				'industry' => 'kids',
				'short'    => 'COPPA',
				'law'      => 'Children’s Online Privacy Protection Act (2025 amended rule)',
				'cite'     => '15 U.S.C. § 6501; 16 C.F.R. Part 312',
			),
			'GLBA'     => array(
				'market'   => '*US',
				'industry' => 'finance',
				'short'    => 'GLBA',
				'law'      => 'Gramm-Leach-Bliley Act privacy rule',
				'cite'     => '15 U.S.C. § 6801; 16 C.F.R. Part 313',
			),
			'GDPR'     => array(
				'market' => 'EU',
				'short'  => 'EU GDPR',
				'law'    => 'EU General Data Protection Regulation + ePrivacy Directive',
				'cite'   => 'Regulation (EU) 2016/679; Directive 2002/58/EC Art. 5(3)',
			),
			'UK_GDPR'  => array(
				'market' => 'UK',
				'short'  => 'UK GDPR',
				'law'    => 'UK GDPR + PECR (as amended by the Data (Use and Access) Act 2025)',
				'cite'   => 'UK GDPR; PECR 2003 reg. 6',
			),
			'PIPEDA'   => array(
				'market' => 'CA',
				'short'  => 'PIPEDA',
				'law'    => 'PIPEDA (and Quebec Law 25)',
				'cite'   => 'S.C. 2000, c. 5',
			),
		);
		return apply_filters( 'goconsent_catalog_others', $o );
	}
}