Vanuatu
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Vanuatu enacted a Cybercrime Act (No. 22 of 2021) aligned with the Budapest Convention, criminalising illegal access, illegal interception, and data/system interference. A Data Protection and Privacy Act (No. 13 of 2024) entered into force in early 2025 — the first comprehensive data-protection statute in this group — covering lawfulness, purpose limitation, data-subject rights, and cross-border transfers. Electronic Transactions Act 2000 provides e-commerce recognition. Copyright and Related Rights Act 2000 provides narrow fair dealing; no sui generis database right; no TDM exception. fast_moving because the DPPA 2024 is newly in force and its enforcement practice is not yet established.
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | without permission |
| Public-page carve-out | unsettled |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | fair dealing narrow |
| Text and data mining — commercial status | unsettled |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | Data Protection and Privacy Act No. 13 of 2024 |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-23. Confidence: low. Fast-moving area — verify before relying. Not legal advice.