Kentucky Consumer Data Protection Act

Does Kentucky have a comprehensive privacy law? Yes. The Kentucky Consumer Data Protection Act (HB 15), signed April 4, 2024, has been in effect since January 1, 2026.

• Status: In Effect
• Law: Kentucky Consumer Data Protection Act (HB 15, 2024; 2024 Ky. Acts ch. 72; new sections of KRS Chapter 367)
• Signed: April 4, 2024 · Effective: January 1, 2026
• Applies to: Persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents and that, during a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from the sale of personal data
• Cure period: Yes; 30 days after written notice from the Attorney General; the statute sets no end date
• Enforcement: Kentucky Attorney General (exclusive authority); up to $7,500 for each continued violation; no private right of action
• Last verified: November 4, 2026 · Official source: Kentucky Legislature, HB 15 (2024)
• Related: Kentucky Consumer Data Protection Act (KCDPA) guide

The Kentucky Consumer Data Protection Act (HB 15), signed by the Governor on April 4, 2024, took effect on January 1, 2026. It enacts robust measures safeguarding consumer privacy.

The Act, which introduces new sections into the Kentucky Revised Statutes Chapter 367, significantly changes how businesses handle and process the personal data of Kentucky residents. It empowers individuals with a suite of rights pertaining to their personal data, ranging from the ability to confirm data processing to the right to opt out of targeted advertising and profiling activities.

Scope of Application

The law applies to businesses operating in Kentucky or targeting Kentucky residents and handling the personal data of a significant number of consumers. Unlike some other state laws, Kentucky does not include a revenue threshold for applicability. However, certain entities, such as governmental bodies, educational institutions, and organizations covered by specific federal laws like HIPAA or GLBA, are exempt from the law’s requirements.

Controllers Obligations

Businesses acting as data controllers must adhere to several obligations, including limiting the collection of personal data to the stated purpose, implementing security measures, and providing clear privacy notices to consumers. They are also prohibited from discriminating against consumers who exercise their rights under the law and must avoid processing sensitive personal or children’s data without appropriate consent.

Consumers Rights

The law grants consumers several rights regarding their personal data, including access, rectification, deleting, and obtaining a copy of their data. Consumers also have the right to opt out of targeted advertising, the sale of personal data, or profiling activities. Businesses must respond to consumer requests within 45 days and provide the requested information free of charge, subject to certain exceptions.

Submitting an Appeal

If a business rejects a consumer’s request, the consumer can appeal the decision. The company must provide a written explanation for the denial, and consumers can escalate the matter to the Kentucky Attorney General if necessary.

Enforcement

The Kentucky Attorney General has exclusive enforcement authority under the law. Before taking any action against a business for non-compliance, the Attorney General must provide a 30-day notice-and-cure period. Violations of the law can result in penalties of up to USD 7,500 per violation.

The law includes a 30-day cure period, which allows businesses to rectify violations within a specified timeframe. This provision offers a degree of leniency by allowing one to address compliance issues before facing penalties. However, it also underscores the importance of prompt action and ongoing compliance efforts to avoid potential enforcement actions by the attorney general. 

Comparison with Other State Laws

Rep. Josh Branscum, R-Ky, touted HB 15 as a “workable solution” to ensure consumer rights and protections, framing the proposal as “a great starting point” and “a framework for our legislature to improve upon for sessions to come.”

House Bill 15 mirrors Virginia’s opt-out statute closely, with identical coverage thresholds for entities controlling or processing personal data. The bill also aligns with Virginia’s requirements for data protection impact assessments, user opt-outs, and a 30-day cure provision.

However, it also includes some unique provisions, such as its approach to defining biometric data and the narrow definition of “sale” of personal data. The law exempts certain entities and data categories, aligning with the exemptions seen in other state laws.

Implications for Businesses

Businesses operating in Kentucky must assess whether the law applies to them based on the specified processing thresholds and potential exemptions. Determining this requires a careful examination of their data processing activities and whether they meet the criteria outlined in the law. Additionally, businesses must understand the requirements for qualifying for exemptions, which may involve providing evidence or meeting certain conditions.

This is not the first time a data privacy bill has been introduced in the Kentucky legislature. A similar bill was introduced in 2022 but did not receive much traction. The 2023 bill would have required covered businesses to assess and update their personal data collection processes, develop a privacy policy, and implement procedures to comply with the newly established rights by January 1, 2025, and would also have required specific contract terms between data controllers and their data processors. The 2023 legislative effort advanced further than its 2022 counterpart, and in 2024 Kentucky enacted the Kentucky Consumer Data Protection Act (HB 15).

While a uniform consumer data privacy law has been a hot topic in Congress for several years, the U.S. lacks a comprehensive one. In the meantime, businesses are forced to navigate many state privacy regulations. The number of states enacting comprehensive data privacy laws continues to grow, with California, Colorado, Connecticut, Utah, and Virginia among the first to adopt sweeping data privacy laws. Other states like Nevada have enacted more limited consumer privacy protection laws. With this ever-changing privacy landscape, businesses must stay abreast of the privacy laws in the states where they operate and collect residents’ information.