The Kentucky Consumer Data Protection Act applies to businesses that control or process personal data of at least 100,000 Kentucky consumers a year, or 25,000 consumers if more than half of gross revenue comes from selling personal data. It took effect January 1, 2026.
What the Kentucky Consumer Data Protection Act Requires
Kentucky closely follows Virginia’s model: a clear privacy notice, consumer rights to access, correct, delete, and port personal data, opt-in consent for sensitive data, opt-outs for targeted advertising, sale, and significant profiling, and data protection assessments for higher-risk activities.
Enforcement and Penalties
The Attorney General has exclusive enforcement authority with a permanent 30-day cure period and civil penalties up to $7,500 per violation. There is no private right of action and no requirement to honor universal opt-out signals. For businesses already built to the Virginia standard, Kentucky compliance is largely a matter of extending existing notices and opt-out flows to Kentucky consumers.
Source: Kentucky General Assembly: HB 15, KRS Chapter 367
Report a violation: If you believe a business is violating this law, you can file a complaint with the Kentucky Attorney General Office of Consumer Protection.
