Subscribe to our newsletter!

Submit

Thank you for signing up for our newsletter!

We’re excited to have you with us and will keep you updated with the latest news, insights, and updates straight to your inbox.
Oops! Something went wrong while submitting the form.
Back to Blog
July 30, 2020
|
Read time {time} min

Data Residency: Meaning, Laws, & Requirements

Written by
Permission
Stay in the loop

Get the latest insights, product updates, and news from Permission — shaping the future of user-owned data and AI innovation.

Subscribe

Have you heard about data residency?

If you haven’t, it’s a concept that determines where different organizations store your data.

Some nations have stricter data protection laws, while others have implemented only minor measures.

As you don’t want your data to fall into the wrong hands, the location of your personal information is crucial.

In this article, we will discuss what data residency means and how it differs from data localization and data sovereignty. We’ll also explore the measures different nations use.

What Does Data Residency Mean?

Data residency is where an organization – government body, industrial body, or business – specifies the geographical location of their choice for where they store their data.

There are various reasons why an organization would do this:

  1. Tax benefits. In this case, a nation’s government may offer a beneficial tax environment for a business. However, in exchange, the company would ensure that a significant part of its operations stays within the country’s borders. As data storage is an important component of business operations, it may choose to host its data in the country.
  2. The business could also include data residency in its company policy to make it transparent for its customers where their data is stored.
  3. The company may also choose to host its data in a specific country due to financial (e.g., it’s cheaper to set up a data center or use a local data service provider’s services) or regulatory (e.g., the government has beneficial data protection laws) reasons.

Data Residency vs. Data Localization vs. Data Sovereignty

Have you heard of data localization and data sovereignty?

These terms are often used interchangeably with data residency frequently being used in the wrong way.

While data residency, data localization, and data sovereignty are closely related, they refer to concepts with different meanings, which could create some confusion amongst both consumers and businesses.

Let’s resolve the confusion and get things clear now.

Data Residency

The first and least restrictive concept is data residency, where a government body, industrial body, or business simply specifies the geographical location where it stores its data.

As illustrated in the last section’s examples, with data residency, the organization has a choice as to where it wishes to store its data.

Data Sovereignty

On the other hand, data sovereignty is a more restrictive concept. It represents the idea that data is subject to the nation’s laws where it is collected, processed, and stored.

Therefore, businesses have to comply with local data protection laws to avoid getting fined by the government.

Data Localization

Data localization is the most restrictive concept of the three.

While data residency gives organizations a choice to specify the geographical location where its data is stored, data localization refers to keeping the data of businesses within the borders of a country.

The concept almost always refers to the storage and creation of the data, and some nations that have implemented data localization laws require organizations to keep only the copy of the data within the country.

If there’s a valid reason, such data localization laws allow the government to audit its citizens’ data without requiring the nation’s authorities to interact with other governments.

On the other hand, some nations have implemented very restrictive data localization laws, prohibiting the data from crossing the country’s borders.

For example, Russia’s On Personal Data Law (OPD-Law) requires organizations to store, retrieve, and update data exclusively in data centers within the nation’s borders.

While stating that their goal is to protect their citizens’ data, these nations often implement strict data localization measures to secure a market advantage for local data centers that align with their data protectionism-related goals.

By doing so, such laws restrict the international flow of data. Therefore, critics argue that it prevents organizations from realizing the full potential of their data while contributing to “digital factionalism” and the “splinternet.”

Data Residency and the GDPR

The General Data Protection Regulation (GDPR) is among the world’s most popular data privacy laws.

As per the GDPR, companies that interact with the personal information of European Union citizens – both within and outside the EU – have to comply with strict data privacy laws.

While EU authorities can impose fines up to 20 million EUR on businesses or acquire 4% of their total global turnover as a penalty for non-compliance, there are no data residency laws in the GDPR.

Therefore, as per the EU data residency laws, organizations are free to choose where they host the data of European Union citizens.

However, businesses still have to comply with the EU’s (mostly data sovereignty-related) laws that require companies to fulfill specific requirements when transferring data outside of the European Union.

For example, a business could only transfer data to a third country if that nation has similarly adequate data safeguards as the EU or the company has a valid legal reason.

As of today, the EU has issued 13 adequacy decisions.

This means that European Union authorities (at least partially) consider these nations to have satisfactory data safeguards, allowing companies to transfer the personal information of EU citizens to these locations.

Data Residency Requirements by Country

Australia

According to the Personally Controlled Health Records Act of 2012, all personal medical information in Australia has to be stored in local servers.

While the law ensures that foreign governments are unable to access Australian citizens’ personal health records, the Oceanic nation’s data residency law prevents medical service providers, such as IBM Watson Health, from offering solutions to the nation’s citizens and organizations.

Canada

In Canada, two provinces (British Columbia and Nova Scotia) require public bodies (e.g. schools, public agencies, hospitals) to store their personal data within the nation’s borders where the data can only be accessed from the country.

China

China has one of the strictest data residency and localization laws on the globe.

In addition to restricting access to certain websites as part of the Golden Shield Program (also referred to as “the Great Firewall of China”), organizations have to comply with a wide range of data residency measures.

For example, companies offering e-banking services in China have to locate their data servers in the Asian nation. At the same time, Chinese personal financial information can only be analyzed, stored, and processed locally.

Also, the data of internet-based mapping services, as well as medical and health records, have to be kept in China.

Certain companies also have to comply with a cybersecurity law that prohibits personal information and important business data from leaving the country.

France

In France, data produced by local and national public administrations have to be stored with cloud services that are within the country’s borders.

It is also illegal in the European country to move information that is connected to legal proceedings outside of the nation.

Germany

Germany has similar views on data residency as France, advocating the idea of national clouds where personal information can be stored locally within its borders.

While data residency laws can vary by state, all organizations within Germany have to store accounting data in the European country.

Furthermore, organizations and individuals liable for taxes in Germany have to keep their accounting records within the country’s borders (with some exceptions).

Russia

Similarly to China, Russia has implemented strict data residency and localization laws.

As per the 2015 Personal Data Law, the data operators that collect personal information from Russian citizens are required to do all their data-related operations using databases that are physically located in the nation.

In addition to requiring companies to store all telecommunications data in the country for six months, the Russian government could impose a fine or shut down the services of businesses that refuse or fail to comply with the nation’s data residency laws.

Data Residency: An Important Concept Influencing Where Your Data Is Stored

As organizations specify the geographical location to store data, data residency has a great influence on where businesses keep your personal information.

Since data residency laws vary by country – for example, there are strict requirements in China and Russia while minimal regulation in Canada and the EU (GDPR) – it’s important to know where the services you use are storing your data.

If that nation has data sovereignty laws, businesses have to comply with them, which means that the government may access your personal information for any (valid) reasons.

While proper data sovereignty rules can help consumers protect their personal information, strict data localization laws could do more harm than good (e.g., the government can monitor the data easily while restricting the international flow of information).

Achieve Full Control Over Your Data With Permission

Permission, the advertising platform of the future, uses blockchain technology to achieve true data sovereignty by enabling full control over its users’ personal information.

Consumers are free to choose whether and how advertisers can use their data.

In exchange for sharing their personal information and engaging with advertising campaigns, users are rewarded in ASK, Permission’s native cryptocurrency, which they can spend on the Permission platform, hodl, or exchange.

Sounds great, huh?

Now check out Permission’s official website to learn more about this new blockchain-based advertising model and its innovative Browser Extension! You can also join the discussion via the Permission.io Telegram channel.

Recent articles

Is Muse Family Friendly?

Nov 9th, 2026
|
{time} read time

Haven't downloaded Meta's new AI agent?
Even if it's a hard pass for you, Muse still keeps a file on you, according to its own operating instructions.

‍

Muse launched September 8 and reached an estimated 10.9 million downloads worldwide by October 20, according to Sensor Tower. People connect it to their email, calendar, and messages, even to their bank accounts and health data. WIRED reported that independent AI researcher Karan Joshi got Muse to reveal that it was instructed to keep "a page for every person in the user's life." Family. Friends. Partners. Coworkers.

‍

Those people don't use Muse, and as researchers wrote, they "have no say in being profiled." Their information still ends up working for Meta. Meta has to know the people around you to be useful, and Muse works from public information and what users choose to share. But it wouldn't be the first time Meta kept tabs on people who never signed up. In 2018, Mark Zuckerberg told Congress that Facebook collects data on non-users.

‍

What you tell Meta's AI

‍

Since December 2025, what people say to Meta AI has shaped the ads they see across Meta's apps, and in most countries there's no way to opt out. That's a billion monthly users whose questions, worries, and plans can become ad signals. Help with a budget, a gift for a partner, a job they want to quit: every question reveals what someone needs, fears, or wants to buy. You produce it. Meta sells access to it.

‍

Meta says Muse isn't connected to its ad system. But Muse is designed to know your inbox, your calendar, your bank account, and the people in your life, and the line between Muse and Meta's ads is a company policy. Policies can change.

‍

‍Follow the money

‍

In the third quarter of 2026, Meta earned $63 billion from advertising. That's nearly 98 cents of every dollar it brought in, and an average of $17.72 per person in just three months.

‍

What did those people get in return? Free access. You supply the raw material, and Meta sells it to advertisers. That's data exploitation: the value is created by you and captured by someone else.

‍

It's also why Meta put 39 percent of its October ad spending into promoting Muse, according to Sensor Tower. An agent inside your inbox, calendar, and bank account is the richest data source Meta has ever built. And even Muse's "forget" command, TIME found, doesn't necessarily erase the message that contained the secret.

‍

What families are up against

‍

Muse is adults-only, but the people in a user's life get a page, too, kids included. The nonprofit Fairplay says Muse's cuddly mascot, Jolly, is built to appeal to young children. Its striking resemblance to Disney Pixar's Baymax is deceptive. And in December, Meta plans to ship Muse Charm, a Tamagotchi-style gadget with a camera and microphones.

‍

According to Pew Research Center, 64 percent of U.S. teens use AI chatbots, but only about half of parents say their own teen does. When a kid confides in a chatbot, that conversation may become data. Our kids are growing up generating value they'll never see, for companies they never chose.

‍

Own Your Data®

‍

Giving up on AI isn't the answer. The problem isn't that an assistant knows you. It's who owns that knowledge, and who profits from it.

‍

With data ownership, an AI assistant can still remember your plumber, plan your week, and help with your budget, without a company keeping a copy of your life to sell. You decide what gets shared, with whom, and for how long. And when your data creates value, you share in it.

‍

That matters more as the Agentic Web arrives, where AI agents will shop, book, compare, and negotiate on our behalf. Whoever owns that data will own the value it creates. If that's Meta, the Agentic Web becomes the most complete surveillance system ever built. If it's you, you get the full benefit of AI and keep control of the information that makes it work.

‍

The question isn't whether to use AI. 

It's whether your AI works for you or for an advertiser.

Your data has value. It should be yours.

The Algorithm Is Working

Oct 19th, 2026
|
{time} read time

At six years old, she started watching YouTube and graduated to Instagram at nine. She spent more than 16 hours on Instagram in a single day.
‍

‍When Instagram chief Adam Mosseri was asked about this usage on the witness stand, he called it "problematic use."
‍

A jury in Los Angeles decided differently. In March, Meta and YouTube were found negligent, and the girl, a 20-year-old woman at the time of settlement, was awarded $6 million in damages. TikTok and Snap settled before the trial began. Meta and Google representatives disagree with the verdict.
‍

‍Look at what was on trial. Not a video. Not a post. Not a bad actor. It was target-designed algorithms. That's the argument here. Your child isn't failing a willpower test. They're up against one of the most sophisticated persuasion machines ever built, and it is working exactly as intended.

How the hook works

‍What will keep this person here? This is the directive every recommendation algorithm runs on. It learns from every pause, replay, and skip. It never gets tired, and it never cares about your kid’s bedtime.
‍

At YouTube, that machine drives more than 70 percent of everything people watch, according to Neal Mohan, the company’s product chief in 2018. Mohan said YouTube’s algorithm for mobile sessions hooked people in for an hour on average. A YouTube memo shown at the trial stated that to win teens, you bring them in as tweens.

In the same trial, state attorneys pointed out that TikTok internal research found that a user forms a habit after watching 260 videos. With clips as short as eight seconds playing automatically, that's roughly 35 minutes. The same findings say TikTok's researchers tied compulsive use to anxiety and weaker memory and analytical skills.
‍

‍At Instagram, a 2019 study found teens felt "hooked despite how it makes them feel." One employee wrote that people were binging so hard they could no longer feel the reward. Others, in messages revealed in court, called themselves "basically pushers." And a 2017 executive email said Mark Zuckerberg had made teens the company's top priority.
‍

In gaming, Roblox averaged 132 million daily players in early 2026. Among those, about three in four are under 18. The company reports hours engaged to investors every quarter, right next to its user counts.
‍

And, in 2025, a Pew Research Center study found that “roughly one in five U.S. teens say they're on TikTok and YouTube almost constantly.” 

Follow the incentive

‍Why build it this way? Because these apps are free, so kids aren't the customer. Their attention is. More screen time means more ads, more captured data, and more reasons for kids to open the app tomorrow. A product that makes a kid feel good and then logs off is a product that loses. And here’s what happens when safety collides with that math.
‍

“Roblox left the front door unlocked, and discord handed predators a private room,” said Arkansas Attorney General Tim Griffin when he filed suit against the gaming company alleging that Roblox rejected employee proposals to warn kids and parents about grooming. “Children paid the price. That stops now.”
‍

Tools meant to curb use can’t be taken seriously, either. This summer, a federal judge in Kentucky wrote that Meta’s own documentation said that its own time-limiting tools were a “public relations stunt.” They knew that more time on social media was linked to worse outcomes for teens.
‍

Internal TikTok documents, per the Kentucky complaint, show the company cared more about how its time-management tools looked than whether they worked.
‍

‍Then came August. Meta agreed to pay about $17 billion to settle claims brought by 51 attorneys general who accused the company of designing Instagram to hook kids. They pointed to infinite scroll, algorithmic recommendations, and constant notifications. The attorneys called it the largest state settlement with a single defendant in history. Meta said they’d done nothing wrong, arguing teen mental health is too complex to pin on one app.
‍

Again, the goal, or incentive, is for Roblox, TikTok, and Instagram to continue to evolve algorithms to “hook” kids and then deny their own documentation. 

What parents are really up against

‍For parents, it’s a stopwatch tool vs. a data war. A screen-time total tells you how long. It doesn't tell you what the algorithm fed your kid, which loops they're stuck in, or what's pulling at them at 1 a.m. According to the Pew Research Center, about four in ten parents say they could be doing better at managing screen time.
‍

Parents themselves can’t out-engineer the algorithm. They need to see it: what their kids are watching, playing, and asking AI. They also need better ways to steer than a flat "no." That’s where Permission, Family Friendly AI™ comes in.

Permission gives parents AI-powered insight into how their kids use AI and the internet, then helps guide healthier habits and reward positive ones.

These companies had years to build the brakes. Parents shouldn't have to wait for the next verdict to help protect their kids.

The Impact of Growing Up Online

Oct 6th, 2026
|
{time} read time

As a parent, it’s painful to imagine your child struggling with something you can’t see. And yet, this may be happening more than you realize. 

A 2025 study involving 4,285 young people brings that concern into focus. Those who developed increasingly addictive patterns of social media use had more than twice the risk of suicidal behaviors compared with those whose use was lower.

For your family, that means something far more frightening than another argument about putting the phone away. It means the possibility that the child you love could be hurting enough to put their own life in danger, while you’re planning dinner, reminding them about homework, and assuming they’re having an ordinary day.

You want your child to have a bright future full of friendships, discoveries, and possibilities. Protecting that future starts with understanding what they’re experiencing now, including what makes their online world so difficult to step away from.

You might notice they’ve stopped joining family activities or seem distressed when they can’t check their phone. You might ask questions only to hear “I’m fine” and wonder whether to keep asking. None of these moments alone tells you what is happening, but they can certainly leave you feeling helpless.

Your child may need more than a reminder to log off. They may need help naming what feels overwhelming, stepping away from an unhealthy pattern, or finding support they aren’t sure how to ask for.

A phone can be put in a drawer. Whatever your child is carrying emotionally may still be there. Making room for that conversation means giving them somewhere to bring the difficult parts of their digital life.

How does technology affect kids' development?

Technology is a double-edged sword for children’s development. While it can support learning, research links heavy screen use to difficulties with skills children rely on every day. These include paying attention, managing frustration, and communicating with others.

A 2025 study found that Canadian preschoolers aged 3.5-5.5 who averaged 3-6 hours of daily screen use scored significantly lower on inhibitory control and effortful control at age 5.5 than children in the group averaging less than an hour.

Inhibitory and effortful control help children:

  • Resist impulses
  • Direct their attention
  • Regulate their behavior

These skills are essential when a child needs to wait their turn, listen to instructions, or keep working at a task after something goes wrong. If a child carries these struggles into adulthood, it may be much harder to meet deadlines, manage responsibilities, and navigate disagreements at work or in relationships.

A 2024 study of 220 Australian families also linked more screen time to fewer adult words, child vocalizations, and back-and-forth conversations. That leaves fewer opportunities for children to practice asking questions, explaining how they feel, and telling you what they need. 

As a result, children may be missing out on valuable practice in making themselves understood, which can linger into adulthood. 

Technology, attention, and independent thinking

A 2023 study tracking the smartphones of 203 U.S. children ages 11-17 found that participants got 237 notifications a day on average, and nearly 25% of those arrived during school hours. 

While kids didn’t see or answer every notification immediately, this gives you an idea of how many reasons children have to look up from studying or engaging in their lives on a daily basis.

This and the prevalence of short-form, fast-paced content like TikTok and Instagram Reels may be two reasons attention spans appear to be getting shorter. In fact, according to researcher and author of Attention Span: A Groundbreaking Way to Restore Balance, Happiness and Productivity, Gloria Mark, overall attention spans have decreased from 2.5 minutes to 47 seconds over the past couple of decades.

This doesn’t mean children’s brains have lost the ability to focus for longer periods. However, growing up with fast-moving technology conditions them to read hastily and “skim” text as opposed to reading and comprehending it thoroughly. And it means their brains need to work that much harder to maintain focus. 

So it makes sense that, according to the 2023 National Assessment of Educational Progress (NAEP), just 14% of 13-year-olds read for fun almost every day. That number dropped from 27% in 2012. NAEP Long-Term Trend Assessment Results: Reading and Mathematics

Alarmingly, the NAEP’s 2024 report also found that 33% of U.S. eighth graders scored below the Basic reading level–the largest share on record. 

Research has linked reading for pleasure in early life with better attention, memory, academic achievement, and fewer mental health problems in adolescence. If children can’t or won’t read, they miss out on these benefits.

Technology, social media, and children’s mental health

Your child’s emotional health may also be at stake. Numerous studies have linked social media use to higher levels of depression and poor self-perception–especially in early adolescence, when a child’s sense of self is still taking shape.

Problematic social media use can also cut into sleep time. Over time, this can make it significantly harder for a child to regulate their emotions, and may even double their risk of depression. 

What’s more, in another WHO report involving Europe, central Asia, and Canada, 15% of adolescents said they had experienced cyberbullying. This may lead to higher levels of anxiety, and potentially even self-harm and suicidal thoughts or behaviors. 

Of course, this doesn’t guarantee that your child will develop depression or low-self-esteem by using technology. But it does give parents a reason to look beyond time spent online and to understand how digital experiences leave their child feeling.

Stay connected to your child’s online life

You don’t need to know every platform or read every private message to protect your child. Understanding their online habits can help you recognize when they need help and start meaningful conversations.

Permission is a Family Friendly AI app that gives parents insights into their children’s use of AI and the internet, helping families guide healthier behavior and encourage positive habits through parent-controlled rewards.

Children deserve room to explore, and someone to turn to when online life feels difficult. With a clearer picture of their digital world, you can help make sure they have both.

Your ASK Wallet, Now Powered by Coinbase

Sep 22nd, 2026
|
{time} read time

We've partnered with Coinbase to bring best-in-class wallet technology to our community.

Today we're updating the technology that powers your ASK wallet. Here's what's changing, what it means for you, and what stays exactly the same.

What's changing

We've moved your Permission wallet to Coinbase's platform. What that means in plain language is this: starting today, you are in full control of your ASK. When you click to send, redeem, or manage your balance, the transaction happens from your account, signed by your login. We no longer hold your wallet keys. Coinbase does, on your behalf, under your authority.

We chose Coinbase's embedded wallet specifically because it brings institutional-grade security to our users without requiring you to manage anything yourself. The infrastructure is Coinbase's. The wallet is yours.

Beyond the custody change, our users now have a wallet that can go wherever they go: exportable, cross-chain ready, and backed by a platform that serves millions of people around the world. We're proud to bring that to our community.

What it means to control your own keys

As Permission has grown, we felt strongly that your funds should be held by a platform built specifically for that purpose, with the security standards and regulatory rigor that come with it. Moving to Coinbase's embedded wallet reflects that commitment.

With today's change, Coinbase secures your private key inside their systems, and only your Permission login can authorize transactions. When you click to send or redeem ASK, the transaction is authorized by you, through your login. We are no longer part of that process.

What this means practically: your wallet operates on its own, independent of Permission. Treat your Permission login like you would a bank password. It is now the key to your wallet. If you ever want to take your wallet entirely outside of Permission, Coinbase supports key export and that option is yours.

What Coinbase sees

Because Coinbase is now part of the infrastructure, your email address, account identifier, and wallet information are shared with them for the purpose of operating the wallet. For details on how Coinbase handles this data, you can review their embedded wallet documentation and their privacy information.

For how Permission handles your data, our Terms of Use and our Privacy Policy govern that relationship, as they always have.

What stays the same

Everything you experience in the app. Earning ASK, redeeming it, transferring it, viewing your balance, managing your family. None of that changes.

And, what does change, we're excited about: key export, cross-chain support, and institutional-grade security. These are capabilities that would have taken years to build in-house and that Coinbase has spent that time perfecting. We chose to partner with the best-in-class, and our product and users will be better for it.

If you have questions, support is always here.

The Permission Team 🤝