Comprehensive state privacy law
Kentucky privacy law
Kentucky Consumer Data Protection Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- KRS 367.3611 to 367.3629
- Enacted
- April 4, 2024. 2024 Ky. Acts ch. 72 (HB 15), signed by the Governor 4 April 2024
- In force
- January 1, 2026
- Effective dates
- January 1, 2026: whole Act (2024 Ky. Acts ch. 72, section 12)
- June 1, 2026: data protection impact assessments apply to processing activities created or generated on or after this date (KRS 367.3621(8))
- July 1, 2027: consent rule for automatic content recognition data from smart televisions and smart monitors (2026 Ky. Acts ch. 118)
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. Nothing in the Act or any other law gives rise to a private right of action for its violations (KRS 367.3627(4)).
- Cure period
- 30 days. Before any action the Attorney General must give 30 days' written notice. If the controller or processor cures and gives an express written statement that the violations are cured and will not recur, no action for damages may be brought. The cure right is permanent. (KRS 367.3627(2))
- Rulemaking
- No. The Act grants no rulemaking power.
Amendments
- 2025 Ky. Acts ch. 13 (HB 473), signed 15 March 2025 (in force January 1, 2026). Before the Act took effect: added data exemptions for information held by HIPAA covered health care providers and for limited data sets, renumbered the data exemptions, and made the profiling assessment trigger refer to 'unlawful' disparate impact (KRS 367.3613 and 367.3621).
- 2026 Ky. Acts ch. 118 (HB 692), signed 13 April 2026 (in force July 1, 2027). Defines 'automatic content recognition data' and 'smart monitor' (KRS 367.3611) and bars controllers from collecting automatic content recognition data without the consumer's consent (KRS 367.3617(1)(f)). The enacted version does not add this data to the 'sensitive data' definition (the introduced version did). Exclusions cover data about the controller's own services, data needed for a feature the consumer requested, and data collected to enforce terms of service.
Topics
- ApplicabilityThe Act applies to persons that do business in Kentucky or target its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while earning over 50% of gross revenue from selling personal data. Government bodies, GLBA financial institutions and their affiliates, HIPAA covered entities and business associates, nonprofits and institutions of higher education are excluded at entity level. Many data types are exempt, including HIPAA, FCRA, FERPA and employment-context data.
- Consumer rightsConsumers may confirm and access their data, correct it, delete it, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant-effect profiling. Controllers must answer within 45 days, extendable once by 45 days with notice, and responses are free up to twice a year. Appeals must be decided in writing within 60 days, with a route to complain to the Attorney General if denied.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child, and precise geolocation. Controllers must obtain consent before processing sensitive data, and must follow COPPA for data collected from a known child (under 13). From 1 July 2027, collecting automatic content recognition data from smart televisions or monitors also requires consent. There is no separate teen rule.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not discriminate against consumers who use their rights. The privacy notice must list data categories, purposes, how to exercise and appeal rights, and data and third-party categories shared, and sale or targeted advertising must be disclosed with the opt-out method. Data protection impact assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing created or generated on or after 1 June 2026. The Act contains no universal opt-out signal requirement.
- ProcessorsProcessors must follow controller instructions and help with rights requests, security and breach notification, and impact assessments. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, deletion or return, compliance information, assessments and flow-down to subcontractors. The role of controller or processor is decided on the facts.
- EnforcementThe Attorney General has exclusive enforcement authority and investigative powers. Before suing, the Attorney General must give 30 days' written notice, and a cure with an express written statement bars an action for damages; this cure right does not expire. Continued violations or breach of the written statement can lead to damages of up to $7,500 for each continued violation, plus expenses and fees. There is no private right of action.
Sources
- KRS chapter 367 index (sections 367.3611 to 367.3629, current and future versions)
- KRS 367.3613 (application and exemptions, as amended 2025)
- KRS 367.3621 (data protection impact assessments, as amended 2025)
- 2024 Ky. Acts ch. 72 (HB 15)
- 2025 Ky. Acts ch. 13 (HB 473)
- 2026 Ky. Acts ch. 118 (HB 692)
- 26RS HB 692 bill record (status: signed by Governor 13 April 2026, Acts Ch. 118)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Kentucky statute
Reference material, not legal advice.