Kentucky has joined a growing list of American states that regulate how companies collect and use consumer information. If your business touches personal data belonging to Kentucky residents, this new law changes how you must operate.
The Kentucky Consumer Data Protection Act came into force at the beginning of 2026, granting residents strong control over their personal information. It also places binding obligations on companies that process qualifying volumes of consumer data.
This guide walks through the statute, its consumer rights, its enforcement structure, and the practical steps your organisation should take right now. You will finish reading with a clear picture of what compliance actually looks like.
The Kentucky Consumer Data Protection Act, often shortened to KCDPA, is Kentucky’s first comprehensive consumer privacy statute. Codified as KRS 367.3611 through 367.3629, it took effect on 1 January 2026 for qualifying controllers and processors.
The law follows the design template used by Virginia, Colorado, and other opt-out style privacy statutes. It creates enforceable rights for residents, imposes transparency duties on businesses, and gives the state Attorney General exclusive supervisory authority.
Rather than banning data processing, the KCDPA regulates it through disclosure, choice, and accountability. Businesses can continue to use personal data for legitimate purposes so long as they respect resident preferences and document their governance decisions.
The original bill, House Bill 15, was signed into law by Governor Andy Beshear on 4 April 2024 after strong bipartisan support in the General Assembly. The eighteen-month runway gave regulated entities time to redesign compliance programmes.
Kentucky amended the statute through House Bill 473, signed on 15 March 2025, which broadened healthcare-related exemptions and clarified that certain data protection assessment duties apply only to processing activities generated after 1 June 2026.
The full statutory text sits in the Kentucky Revised Statutes Chapter 367, where compliance teams should confirm definitions and thresholds before finalising any interpretation. Every section reference in this guide aligns with the numbered provisions in that official source.
The KCDPA does not apply to every organisation that handles data, but its scope catches most mid-market and larger companies operating in Kentucky.
A business becomes a covered controller when it processes personal data of at least 100,000 Kentucky consumers during a calendar year. This threshold captures most retailers, publishers, and software firms with a meaningful national footprint.
A lower threshold applies where data monetisation is central to the business model. Companies processing data of 25,000 or more Kentucky consumers and earning half or more of gross revenue from selling personal data are also captured.
Kentucky excludes several categories of organisation completely, regardless of how much data they process. State agencies, cities, political subdivisions, nonprofit organisations, and institutions of higher education fall outside the statute and follow their own sectoral rules instead.
Financial institutions regulated by the Gramm-Leach-Bliley Act and covered entities under HIPAA also sit outside the KCDPA. These exemptions prevent duplicate compliance regimes and reduce friction for firms that already meet stringent federal privacy expectations.
Even inside a covered business, certain categories of information are carved out. Protected health information, patient identifying data, employment records used only for HR purposes, and information regulated by the Fair Credit Reporting Act are common examples.
Deidentified data and lawfully publicly available records also sit outside the statute. This is significant for research teams, marketers using aggregated audiences, and product teams that rely on public web content for training or benchmarking their models.
The KCDPA draws a sharp line between ordinary personal data and a smaller category called sensitive data, which triggers heightened protections.
Personal data means any information linked or reasonably linkable to an identified or identifiable natural person. It captures obvious identifiers such as names and email addresses, along with device IDs, cookies, and behavioural profiles built from browsing patterns.
The definition intentionally travels beyond direct identifiers. Kentucky follows the modern approach used in other US and European frameworks, which recognises that combinations of technical signals can also identify an individual with high accuracy.
Sensitive data requires opt-in consent before processing, which is a stricter standard than the opt-out rules that apply to most other data. Getting this classification wrong is one of the most common early sources of regulatory risk.
Categories include racial or ethnic origin, religious beliefs, physical or mental health diagnoses, sexual orientation, citizenship or immigration status, precise geolocation, genetic identifiers, and biometric information. Data from any child under thirteen also qualifies as sensitive personal information.
Kentucky residents receive seven distinct rights they can exercise against controllers. Together, these rights give consumers meaningful influence over how organisations handle their personal information.
Residents may ask a controller to confirm whether it processes their personal data, and to hand over a copy of the data being processed. The controller can withhold trade secret information but must otherwise provide a meaningful disclosure.
Residents may correct inaccurate information and request deletion of data the controller collected directly or received from third parties. Deletion may be refused only where a recognised legal exemption, such as fraud prevention or legal defence, applies.
Portability lets a resident receive a copy of their data in a readily usable, machine-friendly format so they can move it to another service. This mirrors similar rights under the GDPR and the California Privacy Rights Act.
Residents may opt out of targeted advertising, sales of personal data, and profiling that produces legal or similarly significant effects. Opt-out mechanisms must be genuinely accessible and honour recognised universal signals when they are activated.
Processing sensitive personal data without prior opt-in consent is prohibited. This creates a functional need for a consent capture flow that can prove exactly which sensitive categories the resident agreed to, when they agreed, and through which interface.
Owning consumer rights on paper is not the same as operationalising them. Kentucky imposes concrete duties on controllers that turn the statute into daily work.
Every controller must publish a clear, accessible, and meaningful privacy notice. It should list the categories of data processed, the purposes, the categories of data shared, the categories of third parties, and the mechanism residents use to exercise rights.
Controllers must respond to verified consumer requests without undue delay and no later than forty-five days after receipt. A single forty-five-day extension is permitted where the request is genuinely complex or the volume is unusually large.
If a controller denies a request, the resident may appeal. The controller has sixty days from the appeal to explain its decision in writing and, when the appeal is denied, must direct the resident to the Attorney General.
Data protection assessments are mandatory for high-risk activities, including targeted advertising, data sales, sensitive data processing that relies on documented user consent, and profiling that presents a heightened risk of harm to a Kentucky resident’s rights or interests.
Written contracts must bind every processor to the KCDPA. They should specify the nature and purpose of the processing, the categories of data, retention periods, the security duties, and the right of the controller to audit the processor.
Kentucky’s enforcement model gives businesses a real chance to remediate before penalties land, but that safety net is narrower than it first appears.
The Attorney General’s Kentucky Office of Data Privacy holds exclusive enforcement authority. Consumers cannot sue controllers directly, but they can lodge formal complaints with the Office when a denied appeal or an unresolved rights request warrants investigation.
Once notified of an alleged violation, a controller has thirty days to remedy the problem and provide written confirmation. Unlike other states that phased out cure rights, Kentucky’s cure period is permanent and does not sunset over time.
Failure to cure exposes a controller to civil penalties of up to seven thousand five hundred dollars per violation. Because each affected record can count as a separate violation, real-world exposure quickly scales into significant financial risk.
The first KCDPA action, filed in January 2026 against Character Technologies, showed regulators can bypass the cure period by combining KCDPA claims with parallel counts under other consumer protection statutes that carry no cure requirement themselves.
Multi-state privacy programmes benefit from understanding where Kentucky aligns with peers and where its rules require dedicated policy work.
| Provision | Kentucky (KCDPA) | Tennessee (TIPA) | Indiana (INCDPA) |
|---|---|---|---|
| Effective date | 1 January 2026 | 1 July 2025 | 1 January 2026 |
| Consumer threshold | 100,000 residents | 175,000 residents | 100,000 residents |
| Sale-based threshold | 25,000 + 50% revenue | 25,000 + 50% revenue | 25,000 + 50% revenue |
| Sensitive data | Opt-in consent | Opt-in consent | Opt-in consent |
| Cure period | 30 days, permanent | 60 days | 30 days, permanent |
| Max civil penalty | $7,500 per violation | $7,500 (up to $15,000 wilful) | $7,500 per violation |
| Private right of action | No | No | No |
| Sole enforcer | Attorney General | Attorney General | Attorney General |
Kentucky borrows structural language from the Indiana Consumer Data Protection Act and Virginia’s original template. Businesses that already comply with Indiana or Virginia can reuse most of their privacy notices, opt-out mechanisms, and data governance workflows in Kentucky.
Both Kentucky and Indiana adopt the same 100,000 consumer threshold and share the permanent thirty-day cure period. Reusing the same request intake form, the same appeal workflow, and the same processor contract templates cuts implementation cost significantly.
Most modern state laws now require opt-in consent for sensitive processing, which brings Kentucky into a comfortable middle position. Companies with existing GDPR consent flows can adapt them for Kentucky without redesigning the entire user experience across their digital estate.
The definition of sensitive data varies subtly. Kentucky lumps precise geolocation with categories such as racial or ethnic origin, whereas some states treat geolocation separately. Reviewing category by category rather than assuming uniform coverage prevents accidental gaps in sensitive data handling procedures.
The permanent thirty-day cure period is Kentucky’s most business-friendly divergence. Most other state laws let their cure periods sunset after an introductory window, meaning enforcement escalates naturally as those markets mature and regulators gain experience with each new statute.
Kentucky also carves out broader entity exemptions than most peer states. Compared to the more prescriptive Rhode Island Data Transparency and Privacy Protection Act, Kentucky’s obligations feel lighter for controllers already using mainstream US privacy playbooks their teams handle daily.
A phased plan turns the statute from an abstract obligation into a manageable workstream that finance, legal, and product teams can execute together.
Begin with a full data inventory covering every collection point, storage location, and downstream disclosure. Attach the purpose, retention timeline, and lawful basis to each data element so later steps in the roadmap have a factual foundation.
Rewrite your privacy notice to explicitly address KCDPA rights, appeal pathways, opt-out mechanisms, and sensitive data categories processed. Do the same for supplemental disclosures such as cookie policies and mobile app privacy screens where user attention is often thinner.
Legal duties become operational realities only when frontline staff understand them. Roll out targeted training for customer service, marketing, engineering, and vendor management teams so that everyone knows how to route rights requests, escalate incidents, and honour opt-out settings across every channel.
A consent platform is not optional infrastructure for KCDPA operations. Manual scripts do not scale; they break during peak campaign traffic, and they leave gaps that regulators can exploit if a consumer challenge escalates into a formal investigation.
Kentucky rights only work if the plumbing behind them works. Deploying one of the best consent management platforms automates opt-in capture, opt-out signals, universal signal recognition, and audit trails without adding manual overhead for your privacy team.
Privacy governance is not a project with a finish line. Assign an accountable owner, schedule quarterly reviews of the DPIA register, and monitor regulator guidance from the Kentucky Office of Data Privacy so your programme adapts as the rules mature.
Most enforcement risk comes from a handful of predictable errors that repeat across industries. Recognising them early saves rework and reduces legal exposure.
Opt out choices must persist across sessions, devices, and marketing channels. Many companies still record a consumer’s opt-out in one system while continuing to feed the same profile into advertising platforms through a legacy integration nobody has retired yet.
The KCDPA treats deidentified data as outside its scope, but pseudonymous data remains fully in scope. Marketing teams often assume any hashed identifier equals deidentification, which triggers avoidable compliance issues during a subsequent regulatory review or consumer complaint.
Some controllers document a single assessment and never revisit it. The KCDPA expects living records that reflect each meaningful change in processing purpose, technology stack, or vendor arrangement, and Kentucky can request them at any point in an investigation.
Global Privacy Control and similar signals must be honoured automatically without requiring a second click. The opt-in vs opt-out distinction matters here, since Kentucky follows an opt out model for advertising but demands opt in consent whenever sensitive data enters the processing pipeline.
The Kentucky Consumer Data Protection Act signals a maturing privacy landscape across the United States. Businesses that treat compliance as a design principle rather than a checkbox will earn stronger customer trust while insulating themselves from enforcement risk. Investing in solid governance now positions your organisation to adapt smoothly as further US state laws come online.
Take control of Kentucky privacy duties with a proven platform. Seers AI automates consent capture, opt-out signals, DPIA records, and audit trails so your team stays ready for every consumer request without added manual effort or expensive rework.
START FREE TODAYThe Kentucky Consumer Data Protection Act does not create a separate data broker registry like some other states. However, data brokers that meet the controller thresholds must still honour every consumer right, publish transparent notices, and enter into KCDPA-compliant contracts with any downstream processor. Broker sales trigger the opt-out right, so business models built on onward monetisation need explicit consumer choice.
Regulators expect controllers to keep a defensible record trail. This typically covers privacy notices with version history, data protection assessment reports, consumer rights request logs, appeal decisions with reasoning, processor contracts with executed signatures, and evidence of consent for sensitive data processing. Retaining these artefacts for the statutory limitation period supports quick responses if the Kentucky Office of Data Privacy opens an inquiry.
Yes. The statute permits an authorised agent to submit certain rights requests on a consumer’s behalf, particularly opt-out requests. The controller may take reasonable steps to verify the agent’s authority, which usually means a written authorisation or an equivalent digital token. Access and deletion requests generally still require direct authentication of the consumer to protect against fraudulent activity.
Pseudonymous data sits between fully identified and deidentified information. Under the KCDPA, it remains personal data whenever the key that links pseudonyms to individuals is retained. Companies wanting to reduce compliance exposure must apply proper technical and organisational controls that keep the identifying key strictly separated. Only then can the pseudonymous dataset be treated as posing lower risk to individuals.
Kentucky expects controllers to recognise universal opt-out signals that a consumer’s browser or device transmits automatically. The Global Privacy Control is the most widely adopted example. When such a signal arrives, the controller must treat it as a valid opt-out from targeted advertising and sale of personal data without requiring the consumer to complete additional steps or forms.
Business contact information used purely in an employment or commercial context often falls outside the statute, provided the data is only used for those business purposes. However, if the same records get reused for consumer marketing, targeted advertising, or profiling, the KCDPA applies fully. Companies should audit their CRM tags to confirm which contacts sit inside or outside the scope.
HIPAA covered entities and their business associates are entirely exempt from the KCDPA. Protected health information regulated under HIPAA, patient records, and information governed by other federal healthcare statutes also remain outside scope even inside a covered company. This layered design avoids duplicate compliance requirements and lets regulated healthcare organisations continue relying on their existing sector-specific privacy programmes.
Profiling is regulated when it produces legal or similarly significant effects such as denials of credit, employment, housing, education, or essential services. Consumers may opt out of that profiling, and controllers must complete a data protection assessment before deploying it. Generative AI systems trained on Kentucky residents’ personal data typically fall under the same rules, which include the sensitive data consent duties.
Rimsha ZafarRimsha is a Senior Content Writer at Seers AI with over 5 years of experience in advanced technologies and AI-driven tools. Her expertise as a research analyst shapes clear, thoughtful insights into responsible data use, trust, and future-facing technologies.
Take our Free Cookie Audit and find out
Join 50,000+ websites using Seers.Ai to turn compliance into trust, insights, & measurable business growth.
