Kentucky Consumer Data Protection Act (KCDPA)
In force Kentucky · In force Jan 1, 2026 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires opt-in consent for sensitive data and data protection assessments for high-risk processing.
- Who it applies to
- Persons conducting business in Kentucky or targeting Kentucky residents that during a calendar year control or process personal data of 100,000+ consumers, or 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
- Penalties
- Civil penalties up to $7,500 for each continued violation plus injunctive relief. Permanent 30-day cure period (no sunset).
- Enforced by
- Kentucky Attorney General (exclusive)
- Official name
- Kentucky Consumer Data Protection Act (HB 15, 2024), KRS 367.3611-367.3629
- Citation
- HB 15 (2024 Ky. Acts ch. 72); KRS 367.3611 et seq.
- Topics
- privacy
Verified 2026-09-22 apps.legislature.ky.gov
Research notes
30-day cure period is permanent, so no cure-expiry deadline. Penalty text refers to each 'continued' violation after the cure period. No 2025-2026 amendments confirmed.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Kentucky Consumer Data Protection Act (KCDPA)
- What are the Kentucky Consumer Data Protection Act (KCDPA) compliance deadlines?
- Jan 1, 2026: KCDPA takes effect.
- When does Kentucky Consumer Data Protection Act (KCDPA) take effect?
- Kentucky Consumer Data Protection Act (KCDPA) took effect on Jan 1, 2026.
- Who does Kentucky Consumer Data Protection Act (KCDPA) apply to?
- Persons conducting business in Kentucky or targeting Kentucky residents that during a calendar year control or process personal data of 100,000+ consumers, or 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
- What are the penalties under Kentucky Consumer Data Protection Act (KCDPA)?
- Civil penalties up to $7,500 for each continued violation plus injunctive relief. Permanent 30-day cure period (no sunset).