Kentucky enacts comprehensive consumer data privacy law

LEXINGTON, Ky. (WKYT) - Kentucky will implement a comprehensive consumer data privacy framework on Jan. 1, 2026, establishing new rights for residents and obligations for businesses that collect personal information.

The Kentucky Consumer Data Protection Act applies to companies doing business in Kentucky or targeting state residents when they control or process personal data of at least 100,000 consumers annually, or control personal data of at least 25,000 consumers while deriving more than 50% of gross revenue from selling that data.

Consumer rights and business obligations

The law grants Kentucky residents five key rights: accessing their personal data, correcting inaccurate information, deleting personal data, obtaining portable copies of their data, and opting out of targeted advertising, data sales, and certain profiling activities.

Businesses must provide accessible methods for consumers to submit requests without requiring new account creation. Companies have 45 days to respond to requests, with one possible 45-day extension, and must provide up to two free responses per year.

Controllers must limit data collection to what is necessary for disclosed purposes and provide clear privacy notices detailing data categories collected, processing purposes, consumer rights, and third-party sharing practices.

Risk assessments and security measures

Companies must conduct data protection impact assessments for high-risk processing activities, including targeted advertising, data sales, profiling that could cause harm, and processing of sensitive data such as health information, biometric data, and precise location data.

The assessment requirement applies to processing activities created or generated on or after June 1, 2026. Controllers must implement reasonable administrative, technical and physical security measures appropriate to the data and associated risks.

Enforcement and penalties

The Kentucky Attorney General has exclusive enforcement authority under the law. Before pursuing penalties, the AG must provide 30 days written notice allowing companies to cure violations and provide written commitments to compliance.

Continued violations after the cure period or breach of compliance commitments can result in civil penalties up to $7,500 per violation. The law does not create a private right of action for consumers.

Penalties collected will fund a Consumer Privacy Fund administered by the Attorney General’s office to support enforcement activities.

Exemptions and exceptions

The law exempts state and local governments, financial institutions regulated under the Gramm-Leach-Bliley Act, HIPAA-covered entities, nonprofit organizations, higher education institutions, and certain utility and telecommunications entities.

The legislation also provides exceptions for processing necessary to comply with legal obligations, cooperate with law enforcement, support legal claims, address emergencies, fulfill consumer-requested services, and conduct legitimate research activities.