DPO SchoolDPO School

Kentucky Consumer Data Protection Act

Kentucky privacy law (KCDPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not discriminate against consumers who use their rights. The privacy notice must list data categories, purposes, how to exercise and appeal rights, and data and third-party categories shared, and sale or targeted advertising must be disclosed with the opt-out method. Data protection impact assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing created or generated on or after 1 June 2026. The Act contains no universal opt-out signal requirement.

Key points

  1. Collection limited to what is adequate, relevant and reasonably necessary for disclosed purposes; no incompatible use without consent.

    Section: KRS 367.3617(1)(a) and (b)

  2. Privacy notice: data categories, purposes, how to exercise and appeal rights, categories of data shared and categories of third parties.

    Section: KRS 367.3617(3)

  3. Sale of personal data or targeted advertising must be disclosed clearly and conspicuously with how to opt out.

    Section: KRS 367.3617(4)

  4. One or more secure and reliable request methods must be described in the notice; no new account may be required.

    Section: KRS 367.3617(5)

  5. Impact assessments required for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing, for activities created or generated on or after 1 June 2026.

    Section: KRS 367.3621(1) and (8)

  6. No requirement to honour a universal opt-out signal appears in the Act.

    Section: KRS 367.3611 to 367.3629

  7. 'Sale' means exchange for monetary consideration only.

    Section: KRS 367.3611(27)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Kentucky statute

Reference material, not legal advice.