Overview
The Kentucky Consumer Data Protection Act (KCDPA) is a comprehensive state privacy law that grants Kentucky residents new rights over their personal data while setting clear compliance requirements for businesses. Signed into law on April 4, 2024, the KCDPA takes effect on January 1, 2026.
Kentucky’s law follows the Virginia CDPA model, making it business-friendly while still providing strong consumer protections.
Who Must Comply?
The KCDPA applies to businesses that operate in Kentucky or target Kentucky residents and meet one of the following criteria:
✔ Process personal data of at least 100,000 Kentucky consumers annually
✔ Process personal data of at least 25,000 Kentucky consumers and derive over 50% of gross revenue from selling personal data
Exemptions:
The law does not apply to:
🚫 Government agencies
🚫 Nonprofits
🚫 Financial institutions subject to GLBA
🚫 HIPAA-covered entities
🚫 Higher education institutions
Key Consumer Rights Under KCDPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request corrections to inaccurate personal data.
✔ Right to Delete – Consumers can request the deletion of personal data.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
- Automated profiling that affects legal or financial decisions
📌 No Private Right of Action – Unlike California’s CPRA, consumers cannot sue businesses directly for violations.
Business Compliance Requirements
✔ Universal Opt-Out Mechanism (Starting January 1, 2026) – Businesses must recognize Global Privacy Control (GPC) signals.
✔ Opt-In Consent for Sensitive Data – Businesses must obtain explicit consumer consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Biometric data
📌 Health conditions
📌 Children’s data
✔ Privacy Policy & Transparency – Companies must provide clear privacy policies explaining data collection and use.
✔ Data Protection & Security – Businesses must implement reasonable safeguards to protect consumer data.
✔ Risk Assessments for High-Risk Processing – Companies must conduct Data Protection Assessments (DPA) for:
📌 Targeted advertising
📌 Data sales
📌 AI-driven automated decision-making
Real-World Enforcement Cases
The Kentucky Attorney General enforces the KCDPA, with penalties of up to $7,500 per violation.
📌 30-Day Cure Period for Violations – Businesses have 30 days to fix compliance issues before fines are imposed.
Since KCDPA does not take effect until January 1, 2026, major enforcement cases have not yet occurred, but companies failing to provide opt-out mechanisms are expected to be early enforcement targets.
📌 Comparison with Other State Privacy Laws
The Kentucky KCDPA is more flexible for businesses than California’s CPRA but closely resembles Virginia’s CDPA:
✅ No Private Right of Action – Consumers cannot sue companies directly.
✅ Stronger Opt-Out Requirements – Businesses must honor universal opt-out signals in 2026.
✅ Less Strict Than CPRA – Kentucky’s law has fewer compliance obligations than California’s CPRA.
Future of KCDPA Regulation
📌 Stronger enforcement expected in 2026, particularly for AI-driven profiling.
📌 Possible expansion of consumer rights in future amendments.
📌 Potential updates to align with federal privacy laws if enacted.Kentucky’s KCDPA is a consumer-friendly but business-oriented privacy law, balancing consumer rights with clear compliance measures.
