Kentucky (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Kentucky Consumer Data Protection Act | KRS 367.3611 to 367.3629 (2024 Ky. Acts ch. 72, HB 15), as amended | In force | 1 January 2026 |
| Notification of computer security breach | KRS 365.732 | In force | 15 July 2014 |
- Kentucky Consumer Data Protection Act: HB 473 (2025 Ky. Acts ch. 13) exempted HIPAA-protected data held by health care providers and limited data sets, and required impact assessments for profiling that risks unlawful disparate impact. HB 692 (2026 Ky. Acts ch. 118) requires consent to collect smart TV content recognition data from 1 July 2027.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses that operate in Kentucky or target its residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of 25,000 while earning over 50% of gross revenue from selling personal data. Government, financial institutions and GLBA data, HIPAA covered entities and business associates, nonprofits, higher education and some utilities are exempt. Employee and business-contact data are out of scope.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Give a clear privacy notice and honour rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and significant profiling. Reply within 45 days (one 45-day extension), free twice a year, and decide appeals within 60 days. Sensitive data needs opt-in consent. Collect only what’s adequate, relevant and reasonably necessary for the disclosed purposes.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx
Consent age for online services
Section titled “Consent age for online services”A child is under 13, as in COPPA. A known child’s data must be processed in line with COPPA, and parents can use the child’s rights. There’s no teen consent rule.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx
Children
Section titled “Children”Data collected from a known child is sensitive data and must be handled under COPPA. Meeting COPPA’s verifiable parental consent rules counts as compliance. The act sets no extra rules for teenagers.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers that sell personal data or use it for targeted advertising must disclose it clearly and explain how to opt out. The act has no duty to honour universal opt-out signals such as Global Privacy Control. From 1 July 2027, collecting automatic content recognition data from smart TVs or monitors needs consent.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/record/26rs/hb692.html
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Telemarketing companies must register with the Attorney General 10 days before soliciting Kentuckians ($300, then $50 a year). Sales calls may not go to numbers on the national Do Not Call Registry, outside 10 a.m. to 9 p.m., or to anyone under 18, and prerecorded sales calls need prior express consent.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx
Breach notification
Section titled “Breach notification”Tell affected Kentucky residents in the most expedient time possible and without unreasonable delay after discovering a breach of unencrypted personal information that causes, or that the business reasonably believes has caused or will cause, identity theft or fraud. If more than 1,000 people must be told at once, also tell the nationwide credit reporting agencies. There’s no duty to tell the Attorney General. Entities covered by GLBA or HIPAA are exempt.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx
Registration and fees
Section titled “Registration and fees”No data protection registration or fee, and no data broker registry. Telemarketing companies register separately (see marketing).
Sources: apps.legislature.ky.gov/law/statutes/chapter.aspx
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: apps.legislature.ky.gov/law/statutes/chapter.aspx
International transfers
Section titled “International transfers”Kentucky law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: apps.legislature.ky.gov/law/statutes/chapter.aspx
Impact assessments
Section titled “Impact assessments”Do and document a data protection impact assessment for targeted advertising, selling personal data, risky profiling, sensitive data and other high-risk processing. It applies to processing activities created or generated from 1 June 2026. The Attorney General can demand it in an investigation, and it stays confidential.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling used for decisions with legal or similarly significant effects, such as on lending, housing, insurance, education, criminal justice, jobs, health care or basic necessities. Risky profiling also needs an impact assessment.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx · apps.legislature.ky.gov/law/statutes/statute.aspx
Penalties
Section titled “Penalties”The Attorney General has exclusive enforcement. It must give 30 days’ written notice first; if the business cures and confirms in writing, no action for damages follows. The cure right doesn’t expire. Up to $7,500 per continued violation, plus investigation costs and attorney’s fees. No private right of action.
Sources: apps.legislature.ky.gov/law/statutes/statute.aspx
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ky.yaml.