---
title: "Kentucky privacy law (KCDPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/kentucky/sensitive-data"
source: "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Kentucky Consumer Data Protection Act

# Kentucky privacy law (KCDPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child, and precise geolocation. Controllers must obtain consent before processing sensitive data, and must follow COPPA for data collected from a known child (under 13). From 1 July 2027, collecting automatic content recognition data from smart televisions or monitors also requires consent. There is no separate teen rule.

## Key points

1. Sensitive data: race or ethnicity, religion, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, known child data and precise geolocation.

   Section: [KRS 367.3611(28)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)

2. Consent is required before processing sensitive data; for data from a known child, processing must follow COPPA.

   Section: [KRS 367.3617(1)(e)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)

3. A child has the COPPA meaning (under 13), and COPPA-compliant parental consent satisfies the Act.

   Section: [KRS 367.3611(5); KRS 367.3613(4)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)

4. From 1 July 2027, controllers may not collect automatic content recognition data without the consumer's consent.

   Section: [KRS 367.3617(1)(f) (2026 Ky. Acts ch. 118)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)

5. Consent means a clear affirmative act that is freely given, specific, informed and unambiguous.

   Section: [KRS 367.3611(6)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)

## Sources

- [KRS chapter 367 index (sections 367.3611 to 367.3629, current and future versions)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)
- [2026 Ky. Acts ch. 118 (HB 692)](https://apps.legislature.ky.gov/law/acts/26RS/documents/0118.pdf)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Kentucky statute](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092)

Reference material, not legal advice.

## Other topics for Kentucky

- [Applicability](https://dposchool.com/state-privacy-laws/state/kentucky/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/kentucky/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/kentucky/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/kentucky/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/kentucky/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/kentucky/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/kentucky/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents