I built a spot-the-difference game where the differences are your legal rights.
Two phones, side by side. Same app, same company, two versions of you — one in Ohio, one in Berlin. Flip one dropdown from "United States" to "European Union" and watch the comparison flip from red ✗ to green ✓, a passport stamp slam onto the card, and the narrator congratulate you: you now legally exist.
The app didn't change. The company didn't change. Only the law changed — and suddenly one of you can demand your data back and the other can ask nicely. Privacy isn't a product feature. It's a jurisdiction feature.
Live demo: open index.html — single file, no build step, no backend. Shareable state via URL: ?app=ttk&a=us&b=eu.
Pick one of five apps (TikTok, Instagram, YouTube, WhatsApp, Amazon), give each twin a jurisdiction (US federal, California, EU, India), and read the diff: consent rules, the rights checklist, breach-notification clocks (the EU's shows 72:00:00; the US federal one shows 🤷), minors protections, the fines each app has actually faced in that jurisdiction, features that literally don't exist on one side, and who enforces it all. Each twin gets a RIGHTS SCORE — computed from the checklist with visible weights, not asserted, so it can never disagree with the rows shown. Every cell claim carries a [§] link to the regulation article, enforcement decision, or press report.
A small "Guess Who's Protected" quiz runs on first load (skippable). Presets cover the greatest hits: The Big Gap (US vs EU), Civil War (California vs US federal — same country, different rights), The Ban Hammer (TikTok vs India), and Twin Paradox (same jurisdiction twice, so the narrator can mock you).
The obvious design is a full apps × jurisdictions matrix: 5 × 4 = 20 objects, each repeating "GDPR gives you Art. 17 erasure" five times. That duplicates everything, drifts out of sync, and makes adding a jurisdiction a five-object chore.
Instead the data is layered:
- Layer 1 — jurisdiction baselines. Everything that's true for all apps in a place: rights checklist, consent model, breach clock, minors rules, regulator, "use what you've got" actions. One object per jurisdiction, internally consistent by construction.
- Layer 2 — app × jurisdiction overrides. Only the exceptions: fines this app faced here, feature divergences, and the banned flag (TikTok × India). Sparse — most cells don't exist.
Render = baseline merged with override. Adding a fifth jurisdiction (UK is the obvious candidate) is one new object, not five.
- The US isn't a cartoon villain. California gets its own jurisdiction precisely to show the US isn't monolithic — CCPA/CPRA delivers deletion, opt-out of sale, and the only dedicated state privacy regulator (CPPA). COPPA is genuinely enforced; the FTC's fine list proves it.
- The EU isn't a cartoon hero. The regulator row notes the enforcement lag honestly: major GDPR cases took 5+ years through the Irish one-stop-shop bottleneck. Strict law ≠ fast justice.
- India is scored on paper, flagged in practice. The DPDP Act reads strong (opt-in consent, under-18 ad ban, 72-hour breach detail to the Board), but the Rules were only notified in November 2025 and penalties can't be levied until May 2027. Every Indian cell carries that caveat.
- Every jurisdiction ends with agency, not doom. DSAR templates, California's mandatory "Do Not Sell" link, GPC, the FTC complaint form, India's grievance officers. Doom is cheap; agency is rare.
Jurisdiction ≠ residence ≠ citizenship — real applicability is much messier. GDPR can follow EU residents abroad (Art. 3); US state laws key off residency, not IP; enforcement intensity varies wildly within one legal text. The rights score compresses qualitative law into a number with visible, arguable weights — argue with the weights, they're in the page. Facts carry a last verified: 2026-07-03 date; the fastest-moving ones (Meta's pay-or-consent model, TikTok's €530M appeal, the US TikTok joint venture, DPDP enforcement phases) will age first.
The same company treats you exactly as well as its least-avoidable regulator demands. Know which one is yours — then use the rights you do have. The last row of every comparison tells you how.
No cookies, no trackers, no analytics. This page about privacy law is not subject to any of it, because it collects nothing.
MIT — see LICENSE.