Regulations › US states › Kentucky
KCDPA
Kentucky Consumer Data Protection Act
WhenIn effect since 1 January 2026
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses controlling or processing data of 100,000+ Kentucky consumers, or 25,000…
Universal opt-outNot required
Cure periodThe AG must give 30 days' written notice
Request deadlineControllers must respond within 45 days, extendable once by 45 days
Maximum penaltyCivil penalty up to $7,500 per violation, plus attorney's fees and costs
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
Applies to businesses controlling or processing data of 100,000+ Kentucky consumers, or 25,000+ consumers with over 50% of gross revenue from data sales.KRS 367.3613(1) · source ↗
Enacted as 2024 Ky. Acts ch. 72 (HB 15). KRS numbers mapped from Act section order; 367.3613, 367.3617 and 367.3621 confirmed by the 2025 and 2026 amending acts.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and higher education, plus data-level exemptions.KRS 367.3613(2)-(3) · source ↗
2025 Ky. Acts ch. 13 (HB 473), signed March 2025, added HIPAA provider and limited-data-set exemptions and a COPPA deemed-compliance rule, effective January 1, 2026.
Sensitive data and minors
Sensitive data
1
Processing sensitive data requires opt-in consent.KRS 367.3611, 367.3617(1)(e) · source ↗
2026 Ky. Acts ch. 118 (HB 692), signed April 13, 2026, requires consent to collect automatic content recognition data, effective July 1, 2027.
Children and teens
1
A child is under 13 (COPPA); a known child's data is sensitive and needs parental consent. No teen-specific protections.KRS 367.3611, 367.3615(1) · source ↗
Data minimization
1
Collection must be adequate, relevant and reasonably necessary to disclosed purposes.KRS 367.3617(1)(a) · source ↗
Consumers' rights
Rights
2
Confirm and access, correct, delete, portability, and opt out of targeted ads, sale and significant profiling.KRS 367.3615(2) · source ↗
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days.KRS 367.3615(3)(a) · source ↗
Appeals
2
Controllers must offer an appeal, answer in writing within 60 days, and on denial give a way to contact the Attorney General.KRS 367.3615(4) · source ↗
Business duties
Assessments
2
Assessments are required for targeted ads, sale, risky profiling, sensitive data and other heightened-risk processing; the AG may demand them.KRS 367.3621 · source ↗
As amended by 2025 Ky. Acts ch. 13; applies to processing activities created or generated on or after June 1, 2026.
Processor contracts
2
Contract with instructions, duration, confidentiality, return or deletion, compliance information, assessments and written subcontractor flow-down.KRS 367.3619(2) · source ↗
Privacy notice
1
Notice must cover data categories, purposes, rights and appeals, and third-party sharing; sale and targeted ads must be clearly disclosed.KRS 367.3617(3)-(5) · source ↗
Loyalty programs
1
General non-discrimination rule with a carve-out for bona fide loyalty, rewards and club card programs.KRS 367.3617(1)(d) · source ↗
De-identified data
3
Deidentified data needs safeguards, a public no-reidentification commitment and contract flow-down; pseudonymous data is exempt from rights if kept separate.KRS 367.3623 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority, including investigative demands; penalties go to a consumer privacy fund.KRS 367.3627(1), 367.3629 · source ↗
Cure period
0
The AG must give 30 days' written notice; a cure with a written statement bars the action. The cure right does not sunset.KRS 367.3627(2) · source ↗
Maximum penalty
2
Civil penalty up to $7,500 per violation, plus attorney's fees and costs.KRS 367.3627(3), (5) · source ↗
Rulemaking
0
No rulemaking authority in the Act.KRS 367.3611 to 367.3629 · source ↗
No rulemaking provision found.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws