Kentucky Consumer Data Protection Act
The Kentucky Consumer Data Protection Act (KCDPA) was signed into law April 4, 2024, with an effective date of January 1, 2026. The law includes provisions common to many other state consumer privacy laws, with a few notable differences including the lack of a consent obligation for selling minors’ personal information (PI) and no requirement to honor universal opt-out mechanisms.
What you need to know about the KCDPA:
The KCDPA applies to for-profit entities that:
- Conduct business or provide products or services to residents of Kentucky, and
- Annually control or process the personal information of either:
- 100,000 consumers; or
- 25,000 consumers and derives at least 50% of gross revenue from sale of personal information.
Exempt Entities: Exempt entities include:
- State government entities;
- GLBA-covered entities;
- HIPAA-covered entities and business associates;
- Higher education Institutions (as defined by the state, excludes for-profit schools);
- Certain insurance fraud related organizations;
- First responders in connection with catastrophic events; and
- Certain utilities.
Exempt Data: Kentucky exempts a long list of personal information, including but not limited to:
- Protected Health Information under HIPAA;
- Various federally and internationally protected health and patient information, including that protected by the Common Rule, human subject data, and more;
- Various forms of credit data regulated by the FCRA; and
- Data covered by a wide variety of other federal laws including Fair Credit Reporting Act; and
- Data covered by a wide variety of other federal laws including the Family Educational Rights and Privacy Act, Farm Credit Act, and Driver’s Privacy Protection Act.
Use-case exceptions: The KCDPA is not applicable in some circumstances, such as:
- Processing PI in an employment or commercial (B2B) context;
- Processing PI for emergency contact purposes; and
- Processing PI of another individual in relation to the provision of benefits.
In addition, the KCDPA specifies that its law should not be construed to restrict a business’s collection, use, or retention of PI for:
- Conducting internal research for development, improvement, and repair of products, services, and technology (R&D);
- Product recalls;
- Identifying and repairing technical errors that impair existing or intended functionality; and
- Performing internal operations.
Key Components of the KCDPA
The KCDPA covers “personal data,” also called personal information or PI, which Kentucky defines as: “any information that is linked or reasonably linkable to an identified or identifiable individual.” Like many other states, there is an exception for de-identified and publicly available data.
KCDPA’s definition of sensitive personal information consists of:
- Racial or ethnic origin;
- Religious beliefs;
- Mental or physical diagnosis;
- Sexual orientation;
- Citizenship or immigration status;
- PI about a known child;
- Precise geolocation data; and
- Genetic or biometric data processed for identification purposes.
Parental consent is required to process PI collected from a known child (under 13) in accordance with COPPA.
There are no additional protections for minors.
Where a controller processes de-identified data, KCDPA requires it to take reasonable measures to ensure the data cannot be associated with an individual; publicly commit to maintaining such data without an attempt to re-identify it; and contractually obligate any recipients of the data to comply with this law.
Kentucky also exempts pseudonymous data from access, portability, deletion, correction, and opt-out rights where the controller can show it keeps information that would allow the data to be re-identified to the consumer separate and subject to technical and organizational controls that prevent its use for re-identification.
In a word: YES!
Consent is required for the collection of Automatic Content Recognition Data, which is defined as “data about a consumer’s content viewing history collected through the use of technology that is embedded or operated through a smart television or smart monitor, integrated with internet connectivity and an operating system that identifies, in real time, the specific content displayed by analyzing audio or video fingerprints, including but not limited to content received through broadcast, cable, satellite, streaming services, or external inputs, through digital fingerprinting, watermark detection, or similar comparison techniques. Exceptions include data collected about a consumer’s interactions with content provided by the controller’s own services; generated in the course of providing a feature or service requested by a consumer; or collected for the purpose of enforcing terms of service.
Consent is also required for secondary use of information that is not necessary or compatible with the purpose for collection and hasn’t been noticed to the consumer.
A privacy notice must include:
- The categories of PI processed;
- The purpose for processing PI;
- Categories of PI shared with third parties;
- Categories of third parties with which PI is shared;
- The categories of personal information shared with third parties;
- Description of targeted advertising and selling activities including a procedure for opting out of the processing for these purposes; and
- The methods for a consumer to exercise their rights (see below) and appeal a decision on their rights request.
No.
Kentucky follows the narrower definition of ‘sale’ used in some other states as well, defining it as exchange for monetary consideration (as opposed to monetary and other valuable consideration).
There are limits on the definition of “sale” to ensure that certain business functions are not unintentionally impeded by this law. Examples of activities deemed not to be a sale include: the disclosure of PI to provide a product or service requested by the consumer, a disclosure of PI at the direction of the consumer, and the disclosure of PI that the consumer intentionally made available to the public.
Some states have built protections for consumer health data into their comprehensive privacy laws, while others have passed CHD-specific laws.
Kentucky does not have specific protections for CHD.
The Kentucky attorney general (AG) has sole enforcement authority over KCDPA. Under the KCDPA the AG may bring an enforcement action after providing a 30-day notice and an opportunity for the business to cure the alleged violation(s); the cure period has no sunset. Actions can be brought that seek fines up to $7,500.
Privacy Rights
The privacy rights created under the KCDPA generally align with those provided under other state laws. Consumers have the:
- Right to know whether a business is processing their PI;
- Right to access PI;
- Right to correct inaccuracies in PI;
- Right to delete PI about them;
- Right to obtain a copy of PI provided by them (data portability); and
- Right to opt out of the sale of personal, processing for targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
Kentucky requires that businesses respond to individual rights requests within 45 days of receipt, with a permissible 45-day extension in limited circumstances. Responses must be provided free of charge once a year. Businesses may deny a rights request in certain circumstances, including inability to verify the identity of a requestor. When a business denies a request, the business must notify the consumer within the 45-day timeframe and provide the reason for the denial as well as instructions for how to appeal the decision.
The appeals process must be conspicuously available to consumers and similar to the process for submitting and initial privacy rights request. Businesses must respond to appeals within 60 days of receipt and, if denying an appeal, must provide the consumer with an online method, if available, to file a complaint with the AG.
Universal Opt Out
The KCDPA does not require controllers to recognize universal opt-out signals. Universal opt-out, or global privacy control, is a technical standard that enables users to automatically communicate their privacy preferences, such as opting out of the sale of their personal information, to websites through their web browsers or other technologies.
Privacy Impact Assessments
The KCDPA requires that businesses conduct data protection or privacy impact assessments in certain high-risk processing.
The KCDPA requires assessments for activities created or generated after June 1, 2026, that present a heightened risk of harm, specifically including:
- Processing for targeted advertising;
- Processing sensitive PI;
- Selling PI;
- Processing for the purposes of profiling if it presents a ‘reasonably foreseeable risk’ of
- Unfair or deceptive treatment or unlawful disparate impact on consumers;
- Financial, physical or reputational injury to consumers;
- Physical or other intrusion on the solitude or seclusion, or private affairs or concerns, which would be offensive to a reasonable person; or
- Other substantial injury.
- Any processing of PI that presents a heightened risk of harm to consumers
Vendor Contracts
Kentucky requires controllers to have a contract in place with vendors that dictates obligations with respect to processing PI. Contracts must include:
- Instructions for processing PI;
- The nature and purpose of processing;
- Type of data that is subject to processing;
- The duration of processing;
- A duty of confidentiality for individuals who process the PI;
- Obligation to delete or return all PI at the controller’s direction or when it has completed the services, unless retention of the PI is required by law;
- Obligation to make available all information necessary to demonstrate the vendor’s compliance with its obligations;
- Compliance with audits by the controller or independent auditor and to provide a report of the assessment to the controller; and
- Pass along obligations to any subcontractor in a written contract.
Data Minimization
The KCDPA limits the collection of PI “to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer.” Where processing is not necessary or compatible with the purpose for collection, organizations must obtain consumers’ consent for the processing.
Data Privacy is Just Good Business
Managing privacy compliance with all these new state privacy laws popping up in the U.S., might seem like a daunting task. But just because the task appears daunting, it doesn’t mean that it’s impossible to handle.
You don’t have to go at it alone! With the right support, you can make data privacy measures a sustainable part of your daily operations. That’s where Red Clover Advisors comes in – to deliver practical, actionable, business-friendly privacy strategies to help you achieve data privacy compliance and establish yourself as a consumer-friendly privacy champion that customers will appreciate.
