79%
of Kentucky's 19 requirements are already met by California (CA). Here is what KCDPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
KCDPA adds2 Controllers must offer an appeal, answer in writing within 60 days, and on denial give a way to contact the Attorney General.
KRS 367.3615(4) · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
KCDPA adds1 Applies to businesses controlling or processing data of 100,000+ Kentucky consumers, or 25,000+ consumers with over 50% of gross revenue from data sales.
KRS 367.3613(1) · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
KCDPA adds1 Processing sensitive data requires opt-in consent.
KRS 367.3611, 367.3617(1)(e) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
KCDPA adds3 Deidentified data needs safeguards, a public no-reidentification commitment and contract flow-down; pseudonymous data is exempt from rights if kept separate.
KRS 367.3623 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means KCDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
