Kentucky

Kentucky Consumer Data Protection Act

Kentucky’s consumer privacy law. It gives Kentucky residents rights over their personal data and sets rules for businesses that meet its size limits.

Status
In effect since January 1, 2026
Citation
Ky. Rev. Stat. § 367.3611 et seq.
Official text
Read the law(opens in a new tab)

Who it covers

Businesses that handle data of 100,000+ Kentucky residents a year, or 25,000+ if they earn revenue from selling data.

What it asks of your website

  • A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
  • Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
  • Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
  • Offer an appeal when you turn down a privacy request.
  • From Jul 1, 2027: don’t require an account to use privacy rights, and get consent before collecting smart TV viewing (automatic content recognition) data.

Who has to comply

The Kentucky Consumer Data Protection Act took effect on January 1, 2026. It applies to businesses that handle the personal data of 100,000 or more Kentucky consumers in a calendar year, or 25,000 or more while getting over 50% of gross revenue from selling personal data.

Nonprofits are exempt, as are colleges, government bodies, Gramm-Leach-Bliley financial institutions and HIPAA covered entities. People acting in a work or business-to-business role aren’t covered consumers.

Visitors’ rights and your deadlines

  • Rights to access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling.
  • Respond within 45 days, extendable once by 45 more. Free up to twice a year.
  • Appeals: answer in writing within 60 days, with a way to contact the Attorney General.

Opt-out signals and sensitive data

Kentucky doesn’t require honoring universal opt-out signals such as Global Privacy Control.

Sensitive data needs consent. It includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic and biometric data, data of a known child, and precise geolocation. Children’s data must be handled under COPPA. Data protection assessments are required for targeted advertising, sale, profiling and sensitive data, for processing that started on or after June 1, 2026.

Your privacy notice, and changes coming in 2027

The notice must list the categories of data you process and why, how to use and appeal rights, and the categories of data and third parties you share with. Disclose sales and targeted advertising clearly and conspicuously, with how to opt out.

A 2026 amendment (HB 692) takes effect on July 1, 2027. It bars making consumers create a new account to use their rights, and requires consent before collecting automatic content recognition data, such as from smart TVs.

Enforcement

The Attorney General’s Office of Data Privacy has exclusive authority and takes complaints online; there’s no private right of action. Before acting, the Attorney General must give 30 days’ written notice to cure, with no end date in the statute. Penalties are up to $7,500 for each continued violation, plus costs and attorney fees.

In January 2026 the Attorney General brought the law’s first enforcement action, a lawsuit against the maker of Character.AI.

Where GoConsent helps

Privacy Policy builder

A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.

Opt-outs and requests

Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.

Copy and delete requests (Pro)

Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.

Children’s Privacy Policy (Pro)

A children’s privacy notice page for sites that may collect information from children under 13.

A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.

FAQ

Questions, answered

When did Kentucky’s privacy law take effect?

January 1, 2026.

Do I have to honor Global Privacy Control in Kentucky?

The law doesn’t require it.

Is there a cure period in Kentucky?

Yes, 30 days after written notice from the Attorney General.

Sources

Check your site against this law

GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.

Get GoConsent free See Pro plans