Kentucky Consumer Data Privacy Act

The Kentucky Consumer Data Privacy Act (KCDPA) takes a cautious approach to privacy regulation, largely copying and pasting provisions from the Virginia Consumer Data Protection Act (prior to that law's amendments regarding minors’ data).

When Does the KCDPA Go Into Effect?

The Kentucky privacy law goes into effect on January 1, 2026.

What Rights Do Consumers Have Under Kentucky Law?

The KCDPA gives consumers the following rights.

  • Right to Know - Consumers have the right to confirm whether a business is processing their personal data and to access that data.
  • Right to Correct - Consumers can request that a business correct any inaccurate personal information it holds about a consumer.
  • Right to Delete - Upon request, businesses must delete personal data concerning the consumer.
  • Right to Portability - Upon request, businesses must provide a copy of the consumer’s personal data in a readily portable format so that it can be transmitted to another controller.
  • Right to Opt Out - Consumers can opt out of:
    • The sale of their personal data
    • Targeted advertising
    • Profiling in furtherance of automated decisions that produce legal or similarly significant effects

Unlike many of the more recent state privacy laws, the KCDPA has no provisions requiring the recognition of universal opt-out mechanisms (UOOMs), such as Global Privacy Control, on their websites.

What Is “Personal Data”?

Personal data is “any information that is linked or reasonably linkable to an identified or identifiable individual.” Deidentified data or publicly available information is excluded from this definition.

Personal data is more than just names and email addresses, though, and can cover anything from IP addresses to internet cookies to shopping habits.

Are Data Protection Assessments Required?

The KCDPA requires organizations to perform data protection assessments for certain types of processing activities that present a “heightened risk of harm” to consumers. This includes:

  • Targeted advertising
  • Sale of personal data
  • Profiling of consumers, where it presents a foreseeable risk of harm
  • Processing of sensitive personal data
  • Any other processing activity that presents a heightened risk of harm to consumers

How Much Do Violations Cost?

The statute provides for damages of up to $7,500 per violation. The Attorney General's Office must give businesses 30 days to cure any alleged violations.

Can Businesses Be Sued by Consumers?

The KCDPA does not grant a private right of action to consumers, meaning they cannot sue an organization over violations. Only the Kentucky Attorney General’s Office has authority to enforce the law.