Kentucky, USA

US-KY schema gdpri-v2 trajectory: not yet assessedhybrid regimeoverlaps: FIM, WPM, AIC

Last updated 2026-09-28 · 10 categories · 43 claims · 30 sources in the cumulative register

10Categoriesbaseline.[]

57Sub-modulesbaseline..sub_modules{}

43Claimsbaseline..claims[]

9Tier-1 sourcesrun_metadata.t1_source_count

Traffic-light mix (sums to 10 rendered categories; click to filter)

No red categories; 19 sub-modules are flagged red.

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

The Kentucky Consumer Data Protection Act became effective on 1 January 2026, having been signed into law on 4 April 2024, making Kentucky the fifteenth state to enact comprehensive consumer privacy legislation. The Kentucky Attorney General's Office of Data Privacy holds exclusive authority to enforce the Act and may seek injunctive relief, civil penalties, and reasonable attorneys' fees and investigative costs. There is no private right of action, so enforcement runs solely through the Attorney General, who must provide a 30-day cure period before bringing an action seeking damages of up to $7,500 per violation.

Other Developments

Consent and processing thresholds follow the established state-law template. The KCDPA is understood to require opt-in consent for processing sensitive data, following the pattern set by Colorado, Connecticut, and Virginia, while defining 'sale' narrowly as limited to monetary consideration. Reports suggest this narrower sale definition, combined with the absence of a universal opt-out mechanism requirement, positions Kentucky's statute as comparatively lighter-touch among the 2026 wave of state comprehensive privacy laws.

Data subject rights carry a defined response window. Kentucky controllers are understood to be required to respond to consumer rights requests within 45 days and to establish an appeals process for requests they deny, consistent with the broader pattern of state privacy statutes taking effect around the same period.

Data protection impact assessments phase in slightly ahead of general effectiveness. Controllers must perform and document a data protection impact assessment for processing activities generated on or after 1 June 2026 that involve sensitive data, targeted advertising, profiling, or the sale of personal data, and the Attorney General may demand a copy of that assessment during an investigation.

Cross-Monitor Connections

The KCDPA's DPIA and processing-obligation architecture intersects with financial-integrity's tracking of Kentucky's separate virtual-currency-kiosk consumer-protection regime under SB 189, insofar as both regimes impose new documentation and disclosure obligations on entities handling consumer data and funds within the same legislative session, though the two statutes operate under separate regulators and separate legal bases. No world-payments, advennt, or artificial-intelligence cross-reference was identified in the KCDPA material reached this cycle.

Outlook

The Attorney General's enforcement posture in the early months since the 1 January 2026 effective date, and the practical operation of the mandatory 30-day cure period, are the near-term items to watch, since no enforcement actions were identified in the record reached this cycle. The 1 June 2026 DPIA phase-in date is a second dated milestone worth tracking, as it introduces a documentation obligation ahead of the Act's broader compliance landscape settling into a steady state.

2 earlier updates not shown here.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Kentucky's Consumer Data Protection Act (KCDPA) entered into force on January 1, 2026, codified at KRS 367.3611-367.3629, with the Attorney General's Office of Data Privacy holding exclusive enforcement authority. A challenger-fold correction resolved a bifurcated effective-date error in House Bill 473: the bill's HIPAA-data exemption and its narrowing of the profiling-related DPIA trigger both take effect January 1, 2026 alongside the main statute, while the DPIA assessment obligation itself is scoped to processing activities generated on or after June 1, 2026.

Other Developments

The KCDPA applies to controllers meeting a threshold of 100,000 Kentucky consumers, or 25,000 consumers plus 50% of revenue from data sales, and exempts cities, state agencies, nonprofits, and institutions of higher education. Processing follows a default disclosure-and-opt-out model rather than a GDPR Article 6-style lawful-basis list, with affirmative prior consent required before processing sensitive data, defined broadly to include race, religion, health diagnosis, sexual orientation, immigration status, genetic and biometric identifiers, precise geolocation, and known child data under 13. Consumers gain a full Virginia-model rights bundle, including access, correction, deletion, opt-out of targeted advertising and profiling, and data portability, with a 45-day response window and a statutory appeal mechanism. Controller duties include contractual terms with processors and security obligations, alongside DPIA requirements triggered by disparate-impact profiling; Kentucky's separate breach-notification statute requires notice to affected residents and, above 1,000 residents, to nationwide consumer reporting agencies and credit bureaus. Sectoral overlays exempt HIPAA-regulated health information and, following House Bill 473, information from HIPAA-covered health care providers; the KCDPA is also presumed to exempt GLBA-regulated financial institutions at the entity level, and a separate Kentucky Insurance Data Security Act governs the insurance sector. The Attorney General filed a parens patriae action against Character Technologies in January 2026 over AI chatbot safety and data-protection violations, following a July 2025 lawsuit against Temu over unlawful collection of sensitive personal information; both actions were brought under the general Consumer Protection Act, which does not appear to provide a private class-action mechanism, and the KCDPA itself carries no private right of action, with enforcement exclusive to the Attorney General backed by penalties of up to $7,500 per uncured violation following a 30-day cure period. On algorithmic governance, consumers may opt out of profiling used in significant-effect decisions, and biometric and genetic data are classified as sensitive; Kentucky Senate Bill 4 separately introduces risk-assessment requirements for high-risk AI systems in the public sector. On children's protections, the under-13 sensitive-data rule is confirmed, while the Kentucky Kids Code and House Bill 12's age-verification proposal remain unconfirmed in enactment status. In adtech, notice and opt-out duties are confirmed, but whether the enacted statute recognises universal opt-out signals or a dark-patterns prohibition remains unconfirmed.

Cross-Monitor Connections

Kentucky's presumed entity-level GLBA exemption carries downstream financial-sector data-governance implications relevant to the financial-integrity monitor. The breach-notification statute's 1,000-resident threshold for notifying nationwide consumer reporting agencies and credit bureaus touches payments-adjacent credit-reporting infrastructure tracked by the world-payments monitor. The Character Technologies enforcement action and Senate Bill 4's public-sector AI risk-governance requirements carry AI-Act-adjacent significance for the artificial-intelligence monitor, beyond the data-protection angle retained here.

Outlook

Kentucky's regulatory direction is tightening: House Bill 692 will require consent for automatic content recognition and smart-monitor data collection from July 1, 2027, and the enactment status of the Kentucky Kids Code, House Bill 12, and Senate Bill 4's AI-governance timeline remain open items for continued tracking. Cross-border transfer, adequacy, and localisation modules remain structurally absent at the Kentucky state level, consistent with the pattern across US state comprehensive privacy statutes.

trust tier: ai_unverified

Latest update · 22 September 2026

Regulatory Status

The Kentucky Consumer Data Protection Act took effect January 1, 2026, enforced exclusively by the Kentucky Attorney General's Office of Data Privacy, with no private right of action and civil penalties of up to $7,500 per violation. The Act follows the standard VCDPA model on applicability thresholds, sensitive-data opt-in consent, a standard consumer-rights bundle, and sectoral exemptions for HIPAA-covered health information and employment-context data. HB473 (2025) amended the Act to expand healthcare exemptions and to make DPIA obligations apply prospectively from June 1, 2026.

Outlook

The DPIA prospective-application date of June 1, 2026 is the near-term item to watch, alongside whether the Attorney General's office moves beyond its current education-first enforcement posture.

1 earlier update not shown here.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Regulatory Status

Kentucky's Consumer Data Protection Act (KCDPA) entered into force on January 1, 2026, with the Attorney General's Office of Data Privacy holding exclusive enforcement authority and no independent data protection authority in the state. The statute follows the Virginia dual-threshold model, applying to controllers meeting 100,000 Kentucky consumers, or 25,000 consumers plus 50% of revenue from data sales, and grants a full rights bundle including access, correction, deletion, opt-out, and portability, backed by a 45-day response window. Controller duties include contractual terms with processors, security obligations, and a disparate-impact-triggered DPIA requirement, the effective-date structure of which was corrected via challenger fold: House Bill 473's HIPAA exemption and DPIA-trigger narrowing both commenced January 1, 2026 alongside the main statute, while the DPIA assessment obligation itself applies only to processing generated on or after June 1, 2026. The Attorney General has pursued active enforcement under the general Consumer Protection Act, including actions against Temu in 2025 and Character Technologies in 2026, ahead of and following the KCDPA's own effective date; the KCDPA carries no private right of action and enforcement is exclusive to the Attorney General, backed by civil penalties of up to $7,500 per uncured violation following a 30-day cure period. No cross-border transfer, adequacy, or data-localisation regime exists at the Kentucky state level, consistent with the pattern across US state comprehensive privacy statutes.

Outlook

10 of 10 categories

Signal

Density

Selections OR within a group, AND across groups. Press / to search.

#

Primary statute is in force with a clearly identified enforcement authority and Tier-1 (ag.ky.gov) confirmation of effective date and thresholds.

Primary frameworkKentucky Consumer Data Protection Act (KCDPA), KRS 367.3611–367.3629

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — GreenPrimary statute is in force with a clearly identified enforcement authority and Tier-1 (ag.ky.gov) confirmation of effective date and thresholds.

Sub-modules (5)

Regulator And AuthorityGreen

The Office of Data Privacy, created within the Kentucky AG's office, has exclusive statutory authority to enforce the KCDPA.

Claims (1):

The Kentucky Office of Data Privacy, housed within the Attorney General's office, has exclusive authority to enforce the KCDPA.

Act And InstrumentsGreen

The KCDPA is the sole comprehensive instrument; codified at KRS 367.3611–367.3629, effective January 1, 2026.

Claims (1):

The Kentucky Consumer Data Protection Act (KCDPA) went into effect on January 1, 2026 and is codified at KRS 367.3611 to 367.3629.

Material ScopeGreen

Applicability turns on a 100,000-consumer / 25,000-consumer-plus-50%-revenue threshold, with categorical entity exemptions (government, nonprofits, higher education) and data-level exemptions (HIPAA-regulated data).

Claims (2):

The KCDPA applies to controllers that control or process personal data of at least 100,000 Kentucky consumers, or that derive over 50% of gross revenue from the sale of personal data while controlling or processing the data of at least 25,000 Kentucky consumers.
The KCDPA exempts certain entities, including cities, state agencies and political subdivisions, nonprofit organizations, and institutions of higher education, from its scope.

Territorial ScopeAmber

Coverage is limited to Kentucky-resident consumers, excluding employment/commercial-context individuals; precise extraterritorial-reach statutory language was not independently retrieved from primary text.

Claims (1):

The KCDPA's definition of 'consumer' is limited to Kentucky residents, excluding individuals acting in an employment or commercial context.

Regulator Registration And FilingRed

No general controller registration or filing obligation with the Attorney General was identified for the KCDPA (unlike some states' data-broker registries).

Absence provenance: unavailable. Searched: Kentucky Consumer Data Protection Act controller registration, KCDPA filing requirement Attorney General.

Key findings (9)

KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file
KCDPA in force Jan 1 2026; sole enforcer AG Office of Data Privacy. — source on file

Category narrative94 words

Kentucky's comprehensive consumer-privacy regime is the Kentucky Consumer Data Protection Act (KCDPA), enacted as House Bill 15 (signed April 4, 2024) and codified at KRS 367.3611–367.3629, which entered into force January 1, 2026. It is a Virginia-model, controller/processor statute enforced exclusively by a dedicated Office of Data Privacy inside the Attorney General's office (no independent DPA). Material scope is threshold-based (100,000 KY consumers, or 25,000 consumers plus 50% of revenue from data sales) with broad entity- and data-level exemptions (government bodies, nonprofits, higher-education institutions, HIPAA-regulated health data). No freestanding controller registration/filing regime was identified.

Periodic update · new data 2026-09-28

Regulator & Framework

The Kentucky Consumer Data Protection Act became effective on 1 January 2026, having been signed into law on 4 April 2024, making Kentucky the fifteenth state to enact comprehensive consumer privacy legislation. The Kentucky Attorney General's Office of Data Privacy was created to enforce the Act and holds exclusive enforcement authority, including the ability to seek injunctive relief, civil penalties, and reasonable attorneys' fees and investigative costs. The Act is understood to apply to any person conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that meets the statute's applicability thresholds, though the exact thresholds were not independently re-verified this cycle and the precise KRS section numbers for each obligation were not retrieved from the enrolled bill text.

Kentucky's framework sits within the now-familiar wave of comprehensive US state consumer-privacy statutes that took effect around the same period, with the Office of Data Privacy positioned as a dedicated enforcement body rather than a general consumer-protection division handling privacy as one of several portfolios. This structural choice signals a degree of institutional focus on privacy enforcement distinct from Kentucky's broader consumer-protection apparatus.

Outlook

The near-term item to watch is the Office of Data Privacy's enforcement posture in its first year of operation, since no enforcement actions were identified in the record reached this cycle. Confirmation of the exact statutory citations and applicability thresholds, not independently retrieved this cycle, would sharpen the precision of future coverage of this jurisdiction's regulator-and-framework posture.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Regulator & Framework

The Kentucky Consumer Data Protection Act, codified at KRS 367.3611 through 367.3629 and originating from HB15 (2024), took effect January 1, 2026. It is enforced exclusively by the Kentucky Attorney General's Office of Data Privacy; there is no separate dedicated data-protection agency. HB473 (2025) amended the Act, expanding healthcare exemptions and clarifying the prospective application of DPIA obligations to processing initiated on or after June 1, 2026; this amendment finding is Probable rather than Confirmed, since primary Acts text was not independently retrieved this cycle to verify the exact amendment language.

The Act applies to persons conducting business in Kentucky, or producing products or services targeted to Kentucky residents, who during a calendar year control or process the personal data of at least 100,000 consumers, or control or process the data of at least 25,000 consumers while deriving over fifty percent of gross revenue from the sale of personal data. This is a standard VCDPA-model applicability threshold, Confirmed at the level of the Act's basic structure.

Outlook

The item to watch is whether the Kentucky Attorney General's Office of Data Privacy issues formal rulemaking or guidance beyond its current consumer-facing rights summary, which has not been confirmed either way this cycle.

Periodic update · new data 2026-09-14

Regulator & Framework

The Kentucky Consumer Data Protection Act, codified at KRS 367.3611 through 367.3629, has been in force since January 1, 2026. It was originally enacted as House Bill 15 on April 4, 2024, and has since been amended twice: by House Bill 473, signed March 15, 2025, and by House Bill 692, signed April 13, 2026. Enforcement authority rests exclusively with the Kentucky Attorney General; the statute confers no private right of action, meaning individuals cannot bring their own claims and must rely entirely on the Attorney General's office to act.

The statute applies to controllers and processors that control or process the personal data of at least 100,000 consumers annually, or of 25,000 consumers where the entity derives more than 50 percent of gross revenue from the sale of personal data. This threshold structure follows the now-familiar comprehensive state-privacy model, positioning Kentucky among the growing cohort of states with an omnibus consumer-data-protection statute built on a similar template.

Outlook

Watch for how the Attorney General's office continues to exercise its exclusive enforcement authority following the Character Technologies action, and whether further amendments follow the pattern set by House Bill 473 and House Bill 692 of incremental, session-by-session tightening of an already-operative statute.

Sources and claims (5)

ConfirmedKentucky Attorney General's Office — The Kentucky Consumer Data Protection Act (KCDPA) went into effect on January 1, 2026 and is codified at KRS 367.3611 to 367.3629.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The Kentucky Office of Data Privacy, housed within the Attorney General's office, has exclusive authority to enforce the KCDPA.observed 2026-08-05
ConfirmedIAPP — The KCDPA applies to controllers that control or process personal data of at least 100,000 Kentucky consumers, or that derive over 50% of gross revenue from the sale of personal data while controlling or processing the data of at least 25,000 Kentucky consumers.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The KCDPA exempts certain entities, including cities, state agencies and political subdivisions, nonprofit organizations, and institutions of higher education, from its scope.observed 2026-08-05
ProbableIAPP — The KCDPA's definition of 'consumer' is limited to Kentucky residents, excluding individuals acting in an employment or commercial context.observed 2026-08-05

#

Consent/opt-out structure is well evidenced from Tier-1 sources, but no GDPR Art.6-equivalent lawful-basis enumeration exists, and pseudonymisation/anonymisation safe-harbour detail is only lightly sourced.

Primary frameworkKCDPA, KRS 367.3611 et seq. (consent/opt-out model; no Art.6-style lawful-basis enumeration)

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — AmberConsent/opt-out structure is well evidenced from Tier-1 sources, but no GDPR Art.6-equivalent lawful-basis enumeration exists, and pseudonymisation/anonymisation safe-harbour detail is only lightly sourced.

Sub-modules (4)

Lawful BasesAmber

No enumerated lawful-basis list; processing is permitted by default, subject to notice and opt-out/consent overlays.

Claims (1):

The KCDPA does not enumerate GDPR-style Article 6 lawful bases; instead it structures processing permissions around consumer consent for sensitive data and opt-out rights for targeted advertising, sale, and certain profiling.

Special CategoriesGreen

Sensitive data is broadly defined and subject to opt-in consent.

Claims (1):

The KCDPA defines 'sensitive data' to include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for personal identification, precise geolocation data, and data collected from a known child under 13.

Pseudonymisation And AnonymisationAmber

Kentucky's law, in common with contemporaneous state statutes, includes requirements around processing deidentified/pseudonymous data, though KY-specific statutory text was not directly retrieved.

Claims (1):

Comprehensive state privacy laws coming into effect alongside the KCDPA in 2026, including Kentucky's, include requirements for processing deidentified or pseudonymous data.

Key findings (9)

Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file
Consent/opt-out model, no Art.6-style lawful-basis list; broad sensitive-data definition. — source on file

Category narrative62 words

The KCDPA does not use a GDPR-style enumerated lawful-basis model; instead it is a consent/opt-out architecture: general processing is permitted by default subject to disclosure and opt-out rights (targeted advertising, sale, certain profiling), while 'sensitive data' processing requires affirmative prior consent. Sensitive data is broadly defined (race/ethnicity, religion, health diagnosis, sexual orientation, immigration status, biometric/genetic identifiers, precise geolocation, known child data <13).

Periodic update · new data 2026-09-28

Lawful Processing & Special Data

The KCDPA is understood to require opt-in consent for processing sensitive data, aligning it with the approach taken by Colorado, Connecticut, and Virginia. The statute defines 'sale' narrowly, limited to transfers involving monetary consideration, which is a materially narrower scope than some peer states that capture non-monetary exchanges of personal data as well. This narrower definition affects which processing activities trigger sale-related disclosure and opt-out obligations under the Act.

This reading rests on a single T3 secondary source rather than an independently retrieved statutory citation, so it is presented as probable rather than confirmed. The consent architecture for sensitive data specifically, as opposed to general personal data processing, appears to track the opt-in model rather than an opt-out model, which is the more protective of the two common approaches used across the 2026 wave of state privacy statutes.

Outlook

Independent verification of the exact statutory language governing sensitive-data consent and the 'sale' definition, ideally against the enrolled bill text or KRS citations directly, would move this module's claims from probable to confirmed in a future cycle.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Lawful Processing & Special Data

The KCDPA requires controllers to obtain opt-in consent before processing sensitive data, a category that includes health diagnoses, biometric data, precise geolocation data, and children's data. This is Confirmed and has been in force since the Act's January 1, 2026 effective date. The opt-in requirement for these categories is the Act's principal lawful-basis mechanism for higher-risk data types, standing in contrast to the general opt-out model that governs ordinary personal-data processing and targeted advertising under the Act.

Outlook

No near-term change to the sensitive-data opt-in requirement itself has been identified; the item to watch is whether the Attorney General's office issues interpretive guidance on the scope of any of the four enumerated sensitive-data categories.

Periodic update · new data 2026-09-14

Lawful Processing & Special Data

House Bill 473, signed March 15, 2025, amended the KCDPA's data protection impact assessment trigger by adding an element of unlawfulness to the disparate-impact-on-consumers risk factor that requires a DPIA for profiling purposes. This is a targeted tightening of when profiling-related processing crosses into DPIA-triggering territory: rather than any disparate impact alone being sufficient, the amended standard appears to require that the disparate impact itself carry an element of unlawfulness before the DPIA obligation attaches.

This amendment sits within Kentucky's broader special-data and lawful-processing architecture, which otherwise follows the standard comprehensive-state-privacy template for consent thresholds and processing bases. No additional special-category-data provisions were identified as amended this cycle beyond this DPIA-trigger change.

Outlook

The amended trigger's practical effect will depend on how Kentucky courts or the Attorney General's office interpret unlawfulness in the disparate-impact context; this interpretive question remains open and has not yet been tested in enforcement, including the pending Character Technologies matter.

Sources and claims (4)

ProbableKentucky Attorney General's Office — The KCDPA does not enumerate GDPR-style Article 6 lawful bases; instead it structures processing permissions around consumer consent for sensitive data and opt-out rights for targeted advertising, sale, and certain profiling.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Controllers may not process a consumer's sensitive data without first obtaining the consumer's consent under the KCDPA.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The KCDPA defines 'sensitive data' to include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for personal identification, precise geolocation data, and data collected from a known child under 13.observed 2026-08-05
ProbableIAPP — Comprehensive state privacy laws coming into effect alongside the KCDPA in 2026, including Kentucky's, include requirements for processing deidentified or pseudonymous data.observed 2026-08-05

#

All core rights and the response-deadline framework are confirmed directly from Tier-1 ag.ky.gov sources.

Primary frameworkKCDPA, KRS 367.3611 et seq.

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — GreenAll core rights and the response-deadline framework are confirmed directly from Tier-1 ag.ky.gov sources.

Sub-modules (5)

Access RightGreen

Consumers may confirm processing and access their data (trade secrets excluded).

Claims (1):

Kentucky consumers have the right to confirm whether a controller is processing their personal data and to access their collected personal data, without revealing trade secrets.

Rectification And ErasureGreen

Consumers may correct inaccuracies and delete personal data.

Claims (1):

Kentucky consumers have the right to correct inaccuracies in their personal data and to delete personal data provided by or obtained about them.

Restriction And ObjectionGreen

Consumers may opt out of targeted advertising, sale, and significant-effect profiling.

Claims (1):

Kentucky consumers have the right to opt out of the processing of their personal data for targeted advertising, sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects.

Data PortabilityGreen

Consumers may obtain a portable copy of their data to the extent feasible.

Claims (1):

Kentucky consumers have the right to obtain a portable copy of their personal data to the extent technically feasible, without revealing trade secrets.

Deadlines And Response WindowsGreen

Controllers must respond within 45 days, free of charge, up to twice annually per consumer.

Claims (1):

Controllers must respond to KCDPA consumer requests free of charge, up to twice annually per consumer, and must respond within forty-five days.

Key findings (9)

Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file
Full Virginia-model rights bundle, 45-day response window. — source on file

Category narrative45 words

The KCDPA grants Kentucky consumers a standard Virginia-model rights bundle: confirmation of processing, access, correction, deletion, portability, and opt-out of targeted advertising/sale/certain profiling. Controllers must respond within 45 days, free of charge, up to twice annually, and must provide an appeal mechanism for denied requests.

Periodic update · new data 2026-09-28

Data Subject Rights

Kentucky data controllers are understood to be required to respond to consumer rights requests within 45 days of receipt, a deadline consistent with the broader 2026 wave of state comprehensive privacy statutes taking effect around the same period. Controllers must also establish an appeals process for consumers whose rights requests are denied, giving consumers a route to challenge a controller's refusal short of Attorney General enforcement, since the KCDPA does not create a private right of action.

This 45-day response window and the appeals-process requirement are drawn from a single T3 secondary source rather than independently retrieved statutory text this cycle, so the claim is presented at probable rather than confirmed confidence. No information was reached this cycle on the specific mechanics of the appeals process itself, such as internal versus external review, or on any extension provisions analogous to those found in some peer-state statutes.

Outlook

Future confirmation of the appeals-process mechanics, and independent verification of the 45-day window against the enrolled statutory text, would strengthen this module's evidentiary basis beyond the current single-source reading.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Data Subject Rights

The KCDPA establishes a standard VCDPA-model rights bundle, in force since January 1, 2026: the rights to confirm whether a controller is processing a consumer's personal data, to correct inaccuracies, to delete personal data, to obtain a copy of personal data in a portable format, and to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects. This bundle is Confirmed and represents the core of the Act's consumer-facing structure.

Outlook

No pending change to this rights bundle has been identified this cycle; the item to watch is whether the Attorney General's office publishes guidance clarifying the mechanics of exercising any of these rights, such as verification procedures or response timelines.

Periodic update · new data 2026-09-14

Data Subject Rights

Effective January 1, 2026, Kentucky residents gained the standard package of comprehensive-state-privacy-law rights: access, correction, deletion, and the ability to obtain a copy of one's personal data. Consumers also gained opt-out rights covering targeted advertising, the sale of personal data, and certain forms of profiling. These rights track the now-familiar model-act structure adopted across a majority of states with comprehensive privacy statutes.

Notably, the KCDPA does not require controllers to honor universal opt-out mechanisms, a materially weaker adtech-adjacent posture than California's CPRA framework, which does mandate recognition of such signals. This means a Kentucky consumer's opt-out preference expressed through a browser-level or platform-level universal signal is not guaranteed to be honored by a controller absent some other legal basis compelling recognition of that signal.

Outlook

Watch for whether a future legislative session brings Kentucky's opt-out-signal requirements closer to the California model, particularly as more states move toward mandating recognition of universal opt-out mechanisms; no such move was identified in Kentucky's 2025 or 2026 legislative sessions covered this cycle.

Sources and claims (5)

ConfirmedKentucky Attorney General's Office — Kentucky consumers have the right to confirm whether a controller is processing their personal data and to access their collected personal data, without revealing trade secrets.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Kentucky consumers have the right to correct inaccuracies in their personal data and to delete personal data provided by or obtained about them.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Kentucky consumers have the right to opt out of the processing of their personal data for targeted advertising, sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Kentucky consumers have the right to obtain a portable copy of their personal data to the extent technically feasible, without revealing trade secrets.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Controllers must respond to KCDPA consumer requests free of charge, up to twice annually per consumer, and must respond within forty-five days.observed 2026-08-05

#

Core duties (DPIA, contracts, breach notification) are Tier-1/Tier-3 confirmed; DPO, ROPA and retention/disposal sub-modules carry no direct evidence.

Primary frameworkKCDPA, KRS 367.3611 et seq.; KRS 365.732 (breach notification)

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — AmberCore duties (DPIA, contracts, breach notification) are Tier-1/Tier-3 confirmed; DPO, ROPA and retention/disposal sub-modules carry no direct evidence.

Sub-modules (7)

Accountability And DpiaAmber

DPIAs are required in specified circumstances; HB473 (effective June 1, 2026) narrows the profiling-related trigger to disparate-impact cases and adds a HIPAA-data carve-out.

Claims (2):

The KCDPA requires controllers to conduct Data Protection Impact Assessments in specified circumstances, including profiling that presents a reasonably foreseeable risk of unfair or disparate impact on consumers.
House Bill 473, signed into law March 15, 2025, amends the KCDPA to narrow the DPIA trigger for profiling to cases involving disparate impact and exempts certain HIPAA-regulated health information, effective June 1, 2026.

Dpo RequirementsRed

No DPO-appointment or independence requirement was located for the KCDPA.

Absence provenance: unavailable. Searched: Kentucky Consumer Data Protection Act data protection officer requirement.

Ropa RequirementsRed

No records-of-processing-activity obligation was located for the KCDPA.

Absence provenance: unavailable. Searched: KCDPA records of processing activities requirement.

Joint Controller ArrangementsGreen

The KCDPA mandates specific contractual terms between controllers and processors.

Claims (1):

The KCDPA requires that specific contractual terms be included in agreements between controllers and processors.

Security MeasuresAmber

The KCDPA imposes general data-security obligations on controllers and processors, though granular technical/organisational-measure detail was not independently retrieved from primary statutory text.

Claims (1):

The KCDPA imposes obligations on controllers and processors related to data security, as part of its consent, disclosure, and security framework.

Breach NotificationAmber

Kentucky's standalone breach-notification statute (KRS 365.732) requires notice to affected residents and, above a 1,000-resident threshold, to nationwide credit bureaus; enforcement-authority attribution under that statute is itself ambiguous per secondary sources.

Claims (2):

Kentucky's data breach notification statute, KRS 365.732, requires notification to affected Kentucky residents, and where a breach affects more than 1,000 Kentucky residents, notification to consumer reporting agencies and nationwide credit bureaus.
The KCDPA separately contains certain requirements relevant to breach notification, though KRS 365.732 does not explicitly grant the Attorney General enforcement authority over breach-notification violations.

Retention And DisposalRed

No explicit statutory retention-limitation or disposal-duty provision was located for the KCDPA.

Absence provenance: unavailable. Searched: KCDPA data retention limitation disposal requirement.

Key findings (9)

DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file
DPIA/contract/breach duties confirmed; DPO/ROPA/retention gaps; HB473 date bifurcation corrected. — source on file

Category narrative44 words

Controllers/processors face DPIA obligations (narrowed by HB473, effective June 1, 2026), mandatory controller-processor contract terms, general security and breach-notification duties (KRS 365.732, plus KCDPA breach-adjacent provisions), but no explicit DPO-appointment or ROPA requirement, and no explicit statutory retention/disposal duty, was located in available sources.

Periodic update · new data 2026-09-28

Controller/Processor Duties

Kentucky controllers must perform and document a data protection impact assessment for processing activities generated on or after 1 June 2026 that involve sensitive data, targeted advertising, profiling, or the sale of personal data. This DPIA obligation phases in several months ahead of the Act's general 1 January 2026 effective date reaching full operational maturity, creating a distinct compliance milestone within the same calendar year the statute took effect. The Attorney General's Office of Data Privacy may demand a copy of a controller's DPIA during the course of an investigation, giving the assessment both an internal governance function and a potential regulatory-disclosure function.

This DPIA requirement is confirmed at a higher confidence level than several of Kentucky's other controller obligations, reflecting more direct sourcing on this specific point. The obligation applies to a defined set of higher-risk processing activities rather than to all processing generally, consistent with the risk-based DPIA model used across most comprehensive US state privacy statutes.

Outlook

The 1 June 2026 DPIA phase-in date is the key near-term milestone for this module; how controllers document compliance in practice, and whether the Attorney General exercises the demand power during any early investigations, are the developments most likely to generate future signal.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Controller/Processor Duties

Data protection impact assessment requirements under the KCDPA apply prospectively, to processing activities initiated on or after June 1, 2026, per the 2025 HB473 amendment. This is a Probable-confidence finding: the exact amendment text was not independently retrieved from primary Acts text this cycle, though the prospective-application date and its DPIA subject matter are consistently reported across secondary sourcing. The practical effect is a bifurcated compliance timeline: processing activities that began before June 1, 2026 are not retroactively subject to DPIA obligations, while any processing initiated on or after that date must satisfy the assessment requirement going forward.

Outlook

The item to watch is confirmation of the exact HB473 amendment language against primary Kentucky Acts text, and whether the Attorney General's office issues any interpretive guidance clarifying what counts as "processing initiated on or after" the June 1, 2026 threshold for activities that straddle the date.

Periodic update · new data 2026-09-14

Controller/Processor Duties

Kentucky controllers must implement reasonable administrative, technical and physical security measures appropriate to the data being processed and the associated risks, a standard baseline security duty consistent with the comprehensive-state-privacy model. The more consequential development this cycle concerns the data protection impact assessment requirement: per House Bill 473's 2025 amendments, the DPIA obligation applies prospectively to processing activities initiated or generated on or after June 1, 2026. As of that date, this duty transitions from an enacted-but-not-yet-effective obligation into a fully in-force one, meaning Kentucky controllers undertaking qualifying processing after that date must have conducted the assessment.

This prospective-application structure, only processing initiated on or after the trigger date is covered, means that legacy processing activities predating June 1, 2026 fall outside the DPIA requirement even if they continue to run, unless they are materially modified in a way that constitutes new initiation.

Outlook

Controllers with processing activities spanning the June 1, 2026 threshold should watch for any Attorney General guidance clarifying what constitutes a materially modified or newly initiated processing activity for purposes of DPIA applicability, as this boundary was not addressed in the statutory text identified this cycle.

Sources and claims (6)

ProbableDataGuidance — The KCDPA requires controllers to conduct Data Protection Impact Assessments in specified circumstances, including profiling that presents a reasonably foreseeable risk of unfair or disparate impact on consumers.observed 2026-08-05
ConfirmedDataGuidance — House Bill 473, signed into law March 15, 2025, amends the KCDPA to narrow the DPIA trigger for profiling to cases involving disparate impact and exempts certain HIPAA-regulated health information, effective June 1, 2026.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The KCDPA requires that specific contractual terms be included in agreements between controllers and processors.observed 2026-08-05
ProbableDataGuidance — The KCDPA imposes obligations on controllers and processors related to data security, as part of its consent, disclosure, and security framework.observed 2026-08-05
ConfirmedDataGuidance — Kentucky's data breach notification statute, KRS 365.732, requires notification to affected Kentucky residents, and where a breach affects more than 1,000 Kentucky residents, notification to consumer reporting agencies and nationwide credit bureaus.observed 2026-08-05
ProbableDataGuidance — The KCDPA separately contains certain requirements relevant to breach notification, though KRS 365.732 does not explicitly grant the Attorney General enforcement authority over breach-notification violations.observed 2026-08-05

#

Genuine regulatory gap: US state consumer-privacy statutes, including the KCDPA, do not contain a transfer-mechanism/adequacy/localisation regime.

Traffic-light rationale — Not assessedGenuine regulatory gap: US state consumer-privacy statutes, including the KCDPA, do not contain a transfer-mechanism/adequacy/localisation regime.

Sub-modules (6)

Transfer MechanismsRed

No KCDPA or other Kentucky-specific cross-border transfer mechanism was located.

Absence provenance: unavailable. Searched: Kentucky Consumer Data Protection Act cross-border data transfer mechanism.

Adequacy ReceivedRed

Not applicable; the US federal system, and Kentucky specifically, is not a recipient of foreign adequacy determinations at sub-federal level.

Absence provenance: unavailable. Searched: Kentucky adequacy decision received.

Adequacy GrantedRed

Kentucky, as a US state, has no independent authority to grant adequacy decisions to other regimes.

Absence provenance: unavailable. Searched: Kentucky adequacy decision granted.

Sccs And BcrsRed

No SCC/BCR uptake regime exists under the KCDPA.

Absence provenance: unavailable. Searched: KCDPA standard contractual clauses binding corporate rules.

Transfer Impact AssessmentRed

No transfer-impact-assessment obligation was located under the KCDPA.

Absence provenance: unavailable. Searched: KCDPA transfer impact assessment requirement.

Data LocalisationRed

No data-localisation mandate was located under the KCDPA.

Absence provenance: unavailable. Searched: Kentucky data localisation requirement consumer data.

Key findings (9)

No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file
No transfer/adequacy/localisation regime; structural US state-law gap. — source on file

Category narrative75 words

No cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was located for the KCDPA or any other Kentucky state instrument. This is consistent with the general pattern of US state comprehensive consumer-privacy laws, which do not operate an adequacy or SCC framework analogous to GDPR Chapter V; cross-border data flows involving Kentucky-collected personal data are governed only indirectly, via federal sectoral regimes (e.g., export-control, CFIUS) that fall outside DP consumer-level scope.

#

Health and insurance overlays are reasonably well evidenced; the financial-sector exemption is inferred from a general US multi-state pattern rather than direct KCDPA statutory text, and telecoms/education sub-modules carry no direct evidence.

Primary frameworkKCDPA sectoral exemptions; Kentucky Insurance Data Security Act (KRS Ch. 304, Subtit. 3); federal HIPAA/GLBA overlays

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — AmberHealth and insurance overlays are reasonably well evidenced; the financial-sector exemption is inferred from a general US multi-state pattern rather than direct KCDPA statutory text, and telecoms/education sub-modules carry no direct evidence.

Sub-modules (7)

Financial Sector OverlayAmber

GLBA-regulated financial institutions are presumed exempted at entity level under the general state-law pattern; KY-specific statutory text was not independently retrieved.

Claims (1):

Most U.S. state comprehensive consumer privacy laws, a category that includes Kentucky's KCDPA, fully exempt financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) from coverage, with only a handful of states (California, Connecticut, Minnesota, Montana, and Oregon) instead applying a narrower data-level GLBA carve-out.

Health Sector OverlayGreen

HIPAA-regulated PHI, health records, and patient-identifying information are exempt; HB473 (effective June 1, 2026) extends the exemption to HIPAA-covered-provider data including limited data sets.

Claims (2):

The KCDPA exempts protected health information regulated under HIPAA, health records, and patient-identifying information from its scope.
House Bill 473 (effective June 1, 2026) further exempts information collected by HIPAA-covered health care providers, including information included in a limited data set, from the KCDPA.

Telecoms And EprivacyRed

No telecoms- or ePrivacy-specific overlay statute was located for Kentucky.

Absence provenance: unavailable. Searched: Kentucky telecoms ePrivacy cookie law.

Employment DataAmber

The KCDPA's consumer definition excludes individuals acting in an employment context, effectively carving employment data out of general consumer-privacy coverage.

Credit And ScoringAmber

Kentucky's breach law requires notification to nationwide consumer reporting agencies/credit bureaus for large breaches, giving a credit-reporting dimension to the state's data-security regime.

Claims (1):

Where a Kentucky data breach affects more than 1,000 residents, notification must also be made to nationwide consumer reporting agencies and credit bureaus.

EducationRed

No education-sector-specific data-privacy overlay statute was located for Kentucky.

Absence provenance: unavailable. Searched: Kentucky student data privacy law.

InsuranceAmber

Kentucky maintains a separate Insurance Data Security Act governing insurer data security independent of the KCDPA.

Claims (1):

Kentucky has a separate Insurance Data Security Act (new section of KRS Chapter 304, Subtitle 3) governing data security for the insurance sector, distinct from the KCDPA's general consumer-privacy framework.

Key findings (9)

HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file
HIPAA/GLBA overlays and separate Insurance Data Security Act. — source on file

Category narrative92 words

The KCDPA layers onto pre-existing Kentucky sectoral regimes. It exempts HIPAA-regulated health data (narrowed further by HB473 from June 1, 2026); financial institutions subject to GLBA are, per the general multi-state pattern, most likely fully exempted at the entity level (Kentucky is not among the five states that instead apply only a narrower GLBA data-level carve-out). A distinct Insurance Data Security Act (new KRS Chapter 304, Subtitle 3) governs insurer data security separately from the KCDPA. No telecoms/ePrivacy-specific, education-specific, or employment-specific overlay statute (beyond the KCDPA's employment-context consumer exclusion) was independently located.

Periodic update · new data 2026-09-28

Sectoral Watch

The KCDPA carries a HIPAA-aligned exemption that reduces the statute's overlap with healthcare-sector data processing, consistent with the pattern seen across most comprehensive US state privacy statutes, which generally exempt data already governed by HIPAA to avoid duplicative regulatory obligations for covered entities and business associates. This is a structural feature of the Act's scope rather than a new development, and the specific contours of the exemption, such as which categories of health-related data fall inside versus outside HIPAA's own coverage, were not independently detailed in the record reached this cycle.

No other sector-specific carve-out, exemption, or sectoral obligation was identified for Kentucky's privacy framework this cycle beyond the HIPAA-aligned exemption. This leaves the sectoral picture for Kentucky comparatively undeveloped relative to modules with more direct primary-source coverage, and the confidence attached to even the HIPAA-alignment point is uncertain rather than confirmed.

Outlook

Further detail on the precise scope of the HIPAA-aligned exemption, and identification of any additional sector-specific provisions (financial services, education, employment data) within the KCDPA, would be the natural next step to develop this module's coverage beyond its current thin evidentiary base.

1 earlier distinct update(s)

Periodic update · new data 2026-09-22

Sectoral Watch

The KCDPA exempts personal health information protected under the federal Health Insurance Portability and Accountability Act, as well as human-subjects research data, from its scope; this is a standard sectoral carve-out consistent with the Act's Confirmed exemption language. Separately, the Act's definition of "consumer" is limited to a Kentucky-resident natural person acting only in an individual or household context, expressly excluding activity undertaken in a commercial or employment context; this exclusion is Confirmed and means the KCDPA does not reach employee data processed by an employer in that employment relationship.

Outlook

No pending change to either the HIPAA/research-data exemption or the employment-context exclusion has been identified this cycle.

Sources and claims (5)

ProbableIAPP — Most U.S. state comprehensive consumer privacy laws, a category that includes Kentucky's KCDPA, fully exempt financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) from coverage, with only a handful of states (California, Connecticut, Minnesota, Montana, and Oregon) instead applying a narrower data-level GLBA carve-out.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The KCDPA exempts protected health information regulated under HIPAA, health records, and patient-identifying information from its scope.observed 2026-08-05
ConfirmedDataGuidance — House Bill 473 (effective June 1, 2026) further exempts information collected by HIPAA-covered health care providers, including information included in a limited data set, from the KCDPA.observed 2026-08-05
ConfirmedDataGuidance — Where a Kentucky data breach affects more than 1,000 residents, notification must also be made to nationwide consumer reporting agencies and credit bureaus.observed 2026-08-05
ProbableDataGuidance — Kentucky has a separate Insurance Data Security Act (new section of KRS Chapter 304, Subtitle 3) governing data security for the insurance sector, distinct from the KCDPA's general consumer-privacy framework.observed 2026-08-05

#

Core opt-out/notice duties are Tier-1 confirmed; dark-patterns and UOOM recognition status under the enacted law remain unconfirmed gaps.

Primary frameworkKCDPA, KRS 367.3611 et seq.

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — AmberCore opt-out/notice duties are Tier-1 confirmed; dark-patterns and UOOM recognition status under the enacted law remain unconfirmed gaps.

Sub-modules (6)

Cookies And TrackersRed

No cookie-specific consent regime distinct from the general targeted-advertising opt-out was located.

Absence provenance: unavailable. Searched: Kentucky cookie consent law.

Dark PatternsAmber

An earlier competing bill (SB 15) defined 'dark patterns' but was abandoned; it is unconfirmed whether the enacted KCDPA (HB15) carries an equivalent express prohibition.

Claims (1):

Kentucky's enacted KCDPA (HB 15) framework has not been confirmed to include an explicit statutory 'dark patterns' prohibition; an earlier competing bill (SB 15) that defined 'dark patterns' was abandoned and not enacted.

Opt Out SignalsAmber

Universal opt-out mechanism recognition (e.g., GPC) was proposed in the non-enacted SB 15; it is unconfirmed whether the enacted KCDPA recognizes such signals.

Claims (1):

It is unconfirmed whether the enacted KCDPA (HB 15) recognizes universal opt-out mechanisms (e.g., Global Privacy Control); universal opt-out recognition was a feature proposed in the competing, non-enacted SB 15.

Clean Rooms And DcrRed

No clean-room or data-collaboration-room rule was located under the KCDPA.

Absence provenance: unavailable. Searched: Kentucky Consumer Data Protection Act data clean room.

Cross Context AdvertisingGreen

Controllers must disclose in privacy notices whether they sell data or process it for targeted advertising, and how consumers can opt out.

Claims (1):

The KCDPA requires controllers to disclose in their privacy notice whether they sell personal data to third parties or process it for targeted advertising, and how consumers may exercise applicable opt-out rights.

Direct MarketingRed

No direct-marketing-specific suppression regime distinct from the general sale/targeted-advertising opt-out was located.

Absence provenance: unavailable. Searched: Kentucky direct marketing consent suppression law.

Key findings (9)

Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file
Opt-out/notice confirmed; dark-patterns/UOOM status under enacted law unconfirmed. — source on file

Category narrative64 words

The KCDPA's primary adtech-relevant lever is the opt-out right for targeted advertising and sale of personal data, paired with privacy-notice disclosure duties. Dark-patterns prohibition and universal opt-out mechanism (UOOM/GPC) recognition were features of the earlier, non-enacted competing bill (SB 15) rather than confirmed features of the enacted HB15/KCDPA; their status under the final law could not be independently confirmed. No clean-room/data-collaboration-room rule was located.

Periodic update · new data 2026-09-28

AdTech & Commercial Privacy

The KCDPA does not require controllers or processors to recognize universal opt-out mechanisms, a notably narrower obligation than several peer states, including California and Colorado, which mandate recognition of browser- or device-level opt-out signals for targeted advertising and sale of personal data. Combined with the Act's narrow definition of 'sale', limited to transfers involving monetary consideration, this positions Kentucky's commercial-privacy obligations as comparatively lighter-touch within the current wave of state comprehensive privacy statutes.

This reading is drawn from a single lower-tier secondary source, so it is presented at probable rather than confirmed confidence, and the practical effect for AdTech vendors operating in Kentucky, specifically whether non-monetary data-sharing arrangements common in targeted-advertising ecosystems fall outside the 'sale' definition entirely, is a reasonable inference from the statutory language but not independently confirmed against primary text this cycle.

Outlook

Independent verification of the 'sale' definition and the absence of a universal opt-out requirement against the enrolled statutory text would strengthen confidence in this module's characterisation of Kentucky as a lighter-touch jurisdiction for commercial and AdTech privacy compliance.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

AdTech & Commercial Privacy

The KCDPA grants consumers a right to opt out of processing for purposes of targeted advertising, sale of personal data, or certain profiling, in force since January 1, 2026. Notably, and this is Confirmed, the Act does not require controllers to recognise or honour universal opt-out mechanisms, meaning Kentucky has not adopted the browser-signal or platform-level opt-out recognition requirement that some peer states have implemented. This places Kentucky's adtech compliance burden on the lighter end relative to states requiring universal opt-out signal honouring.

Outlook

The item to watch is whether a future legislative session moves to add a universal-opt-out-mechanism requirement, which would bring Kentucky's adtech compliance posture closer to states such as Colorado or California.

Periodic update · new data 2026-09-14

AdTech & Commercial Privacy

Kentucky's adtech posture under the KCDPA is notably lighter than peer states in one specific respect: the statute does not require controllers to honor universal opt-out mechanisms, unlike California's CPRA. This means Kentucky consumers lack the browser- or platform-level signal-based opt-out enforcement available to California residents, even though they retain individual opt-out rights for targeted advertising and data sales exercised through other channels.

Against that lighter baseline, House Bill 692, signed April 13, 2026, introduces a new and more specific tightening: a controller duty at KRS 367.3617(1)(f) prohibiting the collection of automatic content recognition data without consumer consent. This duty becomes effective July 1, 2027, a forward-dated obligation targeting a specific commercial-privacy practice, automatic content recognition, commonly associated with smart-television and connected-media data collection, rather than adtech broadly.

Outlook

As the July 1, 2027 effective date approaches, watch for implementing detail on what qualifies as automatic content recognition data and what form of consent will satisfy the new consent requirement; no such implementing guidance was identified this cycle, and the exact statutory citation for House Bill 692 within the session-law chapter numbering has not yet been independently retrieved.

Sources and claims (3)

ConfirmedKentucky Attorney General's Office — The KCDPA requires controllers to disclose in their privacy notice whether they sell personal data to third parties or process it for targeted advertising, and how consumers may exercise applicable opt-out rights.observed 2026-08-05
UncertainIAPP — Kentucky's enacted KCDPA (HB 15) framework has not been confirmed to include an explicit statutory 'dark patterns' prohibition; an earlier competing bill (SB 15) that defined 'dark patterns' was abandoned and not enacted.observed 2026-08-05
UncertainIAPP — It is unconfirmed whether the enacted KCDPA (HB 15) recognizes universal opt-out mechanisms (e.g., Global Privacy Control); universal opt-out recognition was a feature proposed in the competing, non-enacted SB 15.observed 2026-08-05

#

Profiling opt-out and biometric/genetic sensitive-data classification are Tier-1 confirmed; AI-risk-assessment and surveillance-carveout sub-modules rely on thinner secondary sourcing or carry no evidence.

Primary frameworkKCDPA (profiling opt-out) + Kentucky Senate Bill 4 (public-sector AI governance)

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — AmberProfiling opt-out and biometric/genetic sensitive-data classification are Tier-1 confirmed; AI-risk-assessment and surveillance-carveout sub-modules rely on thinner secondary sourcing or carry no evidence.

Sub-modules (6)

Profiling RestrictionsGreen

Consumers may opt out of profiling in furtherance of legal or similarly significant decisions.

Claims (1):

Kentucky consumers have a right under the KCDPA to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, functioning as the state's analogue to a GDPR Article 22-style automated-decision-making safeguard.

Automated Decision Making TransparencyAmber

DPIA obligations attach to disparate-impact profiling, providing a risk-assessment/transparency mechanism.

Claims (1):

The KCDPA's DPIA obligation is triggered, among other things, by profiling that presents a reasonably foreseeable risk of unfair or disparate impact on consumers, providing a risk-assessment mechanism for automated decision-making.

Ai Risk AssessmentsAmber

Senate Bill 4 establishes public-sector high-risk AI governance separate from the consumer-facing KCDPA; exact effective date unconfirmed.

Claims (1):

Kentucky's Senate Bill 4 establishes governance and risk-assessment requirements for high-risk artificial-intelligence systems used in the state's public sector, separate from and supplementing the KCDPA's consumer-facing framework.

Biometric RegimeGreen

Biometric data used for personal identification is 'sensitive data' requiring consent.

Claims (1):

Biometric data used for personal identification purposes is classified as 'sensitive data' under the KCDPA, requiring consumer consent prior to processing.

Genetic DataGreen

Genetic data is 'sensitive data' requiring consent.

Claims (1):

Genetic data is classified as 'sensitive data' under the KCDPA and may not be processed without the consumer's consent.

State Surveillance CarveoutsRed

No state-surveillance/national-security carve-out provision was located for the KCDPA.

Absence provenance: unavailable. Searched: Kentucky Consumer Data Protection Act national security exemption law enforcement.

Key findings (9)

Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file
Profiling opt-out and biometric/genetic sensitive-data rules confirmed; SB4 AI governance date unconfirmed. — source on file

Category narrative55 words

The KCDPA's profiling opt-out functions as Kentucky's closest analogue to a GDPR Article 22-style ADM safeguard, reinforced by a DPIA trigger for disparate-impact profiling risk. Separately, Senate Bill 4 addresses high-risk AI governance in the public sector. Biometric and genetic identifiers are treated as 'sensitive data' requiring consent. No state-surveillance carve-out provision was independently located.

no periodic updates on record for this sub-brief

Sources and claims (5)

ConfirmedKentucky Attorney General's Office — Kentucky consumers have a right under the KCDPA to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, functioning as the state's analogue to a GDPR Article 22-style automated-decision-making safeguard.observed 2026-08-05
ProbableDataGuidance — The KCDPA's DPIA obligation is triggered, among other things, by profiling that presents a reasonably foreseeable risk of unfair or disparate impact on consumers, providing a risk-assessment mechanism for automated decision-making.observed 2026-08-05
ProbableDataGuidance — Kentucky's Senate Bill 4 establishes governance and risk-assessment requirements for high-risk artificial-intelligence systems used in the state's public sector, separate from and supplementing the KCDPA's consumer-facing framework.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Biometric data used for personal identification purposes is classified as 'sensitive data' under the KCDPA, requiring consumer consent prior to processing.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — Genetic data is classified as 'sensitive data' under the KCDPA and may not be processed without the consumer's consent.observed 2026-08-05

#

The KCDPA's own under-13 sensitive-data protection is Tier-1 confirmed; the broader minors' online-safety bill landscape (Kids Code, HB12/227) rests on unconfirmed enactment status and is flagged as a gap.

Primary frameworkKCDPA (child sensitive-data provision); status of Kentucky Kids Code (HB633) and related minors' bills unconfirmed

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — AmberThe KCDPA's own under-13 sensitive-data protection is Tier-1 confirmed; the broader minors' online-safety bill landscape (Kids Code, HB12/227) rests on unconfirmed enactment status and is flagged as a gap.

Sub-modules (5)

Age VerificationAmber

House Bill 12 would introduce age-verification requirements for social-media account creation; enactment status unconfirmed.

Claims (1):

Kentucky's House Bill 12 seeks to enhance online protections for minors by regulating social media account creation and enforcing age verification.

Minor Profiling BansAmber

The Kentucky Kids Code (HB633) would impose stringent data-privacy requirements for online services aimed at minors; enactment status could not be confirmed.

Claims (1):

House Bill 633, the Kentucky Kids Code, would introduce stringent data-privacy requirements for online services targeting minors; as of the most recent tracked update, this bill's enactment status could not be independently confirmed from ag.ky.gov or verified legislative-history sources.

Education SettingsRed

No education-setting-specific children's-data provision was located.

Absence provenance: unavailable. Searched: Kentucky student data privacy education children.

Dependent AdultsRed

No dependent-adult / incapacitated-persons data-protection provision was located.

Absence provenance: unavailable. Searched: Kentucky dependent adult data privacy protection.

Key findings (9)

Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file
Under-13 sensitive-data rule confirmed; Kids Code/HB12/HB227 status unconfirmed. — source on file

Category narrative64 words

The KCDPA treats data from a known child under 13 as 'sensitive data' requiring consent, giving Kentucky a COPPA-aligned baseline. Beyond that, several bills targeting minors online (Kentucky Kids Code / HB633, HB12, HB227) and age-verification/social-media provisions were identified in secondary sources, but their enactment/effective-date status could not be independently confirmed from ag.ky.gov or verified legislative-history sources. No dependent-adult-specific or education-setting-specific provision was located.

Periodic update · new data 2026-09-14

Children & Vulnerable Groups

Kentucky's first-ever KCDPA enforcement action directly concerns children's data. The Attorney General filed suit on January 8, 2026 in Franklin Circuit Court against Character Technologies, Inc., alleging that the company's AI chatbot platform enabled minors to access the service without adequate age verification and unfairly exploited children's data, in violation of the KCDPA and other state consumer-protection statutes. The action arrived only eight days after the KCDPA's effective date, an unusually rapid enforcement debut that signals an aggressive early regulatory posture from the Attorney General's office specifically oriented toward children's-data harms in AI-platform contexts.

This is confirmed at high confidence and stands as the sole enforcement action identified under the KCDPA to date. No dedicated Kentucky statutory age-verification standard beyond what is alleged to have been inadequate in this case was identified this cycle; the case appears to proceed on a theory that existing KCDPA and general consumer-protection obligations were violated by insufficient age-verification practice, rather than under a distinct age-verification statute.

Outlook

The Franklin Circuit Court's eventual disposition of the Character Technologies matter will be an important early interpretive marker for how Kentucky's children's-data protections apply to generative-AI and chatbot platforms specifically, and for how aggressively the Attorney General intends to pursue similar matters going forward.

Sources and claims (3)

UncertainDataGuidance — Kentucky's House Bill 12 seeks to enhance online protections for minors by regulating social media account creation and enforcing age verification.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The KCDPA classifies personal data collected from a known child younger than 13 as 'sensitive data,' requiring consumer consent before processing, aligning with COPPA-style protections for young children.observed 2026-08-05
UncertainDataGuidance — House Bill 633, the Kentucky Kids Code, would introduce stringent data-privacy requirements for online services targeting minors; as of the most recent tracked update, this bill's enactment status could not be independently confirmed from ag.ky.gov or verified legislative-history sources.observed 2026-08-05

#

Enforcement powers, penalty caps, and recent enforcement activity are corroborated by primary AG court filings and Tier-1 AG guidance pages.

Primary frameworkKCDPA, KRS 367.3611 et seq.; Kentucky Consumer Protection Act, KRS 367.110 et seq.

Supervisory authorityKentucky Attorney General – Office of Data Privacy

Traffic-light rationale — GreenEnforcement powers, penalty caps, and recent enforcement activity are corroborated by primary AG court filings and Tier-1 AG guidance pages.

Sub-modules (6)

Regulator Powers And PenaltiesGreen

AG has exclusive KCDPA enforcement authority, a 30-day cure requirement, and can seek civil penalties up to $7,500 per uncured violation plus injunctive relief and fees.

Claims (1):

The Kentucky Attorney General's Office of Data Privacy has exclusive authority to enforce the KCDPA and may seek injunctive relief, civil penalties, and reasonable attorneys' fees and investigative costs; violators that fail to cure within 30 days of notice face civil penalties of up to $7,500 per violation.

Enforcement Activity IndexGreen

Recent AG enforcement activity includes suits against Temu (2025) and Character Technologies (2026), both brought under general consumer-protection authority rather than the KCDPA itself.

Claims (2):

In January 2026, the Kentucky Attorney General filed a parens patriae enforcement action against Character Technologies, Inc. alleging AI chatbot safety and data-protection violations.
In July 2025, the Kentucky Attorney General filed a lawsuit against Temu (PDD Holdings/Whaleco) under the Kentucky Consumer Protection Act alleging unlawful collection of sensitive personal information without consent, among other data-practice violations.

Regulator Funding And CapacityRed

No specific funding/headcount data for the Office of Data Privacy was located.

Absence provenance: unavailable. Searched: Kentucky Office of Data Privacy budget staffing headcount.

Collective Redress And Class ActionsAmber

The Kentucky Consumer Protection Act, used separately from the KCDPA in recent AG suits, does not appear from available sources to provide a distinct private class-action mechanism beyond AG enforcement.

Claims (1):

Separately from the KCDPA, Kentucky's general Consumer Protection Act (KRS 367.110 et seq.) has been used by the Attorney General to bring data-practice-related enforcement actions (e.g., against Temu), but this statute likewise does not appear to provide a private class-action mechanism distinct from AG enforcement based on available sources.

Private Right Of ActionGreen

The KCDPA provides no private right of action; enforcement is exclusive to the Attorney General.

Claims (1):

The KCDPA does not provide Kentucky consumers with a private right of action; enforcement runs exclusively through the Attorney General's Office of Data Privacy.

Recent Developments 180DGreen

Within roughly the last 180 days: HB473's KCDPA amendments (HIPAA/DPIA narrowing) took effect June 1, 2026; HB692 (automatic content recognition / smart monitor consent amendment) was signed in 2026 for a July 1, 2027 effective date.

Claims (2):

House Bill 473, effective June 1, 2026, amended the KCDPA to exempt certain HIPAA-regulated health information and to narrow the profiling-related DPIA trigger to cases involving disparate impact.
House Bill 692, signed into law in 2026, amends the KCDPA to define 'automatic content recognition' and 'smart monitor' and to require consumer consent for data collection via such technologies, with an effective date of July 1, 2027.

Key findings (9)

Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file
Sole AG enforcement, no PRA, active enforcement (Temu, Character Technologies). — source on file

Category narrative96 words

Enforcement runs exclusively through the AG's Office of Data Privacy, with a non-sunsetting 30-day cure period and civil penalties up to $7,500 per uncured violation; there is no private right of action. The AG has also used its general Consumer Protection Act authority (not the KCDPA itself) to bring recent high-profile data-practice suits against Temu (July 2025) and Character Technologies (January 2026), evidencing active enforcement posture ahead of and following KCDPA's January 1, 2026 effective date. HB473 (effective June 1, 2026) and HB692 (signed 2026, effective July 1, 2027) represent recent legislative developments amending the KCDPA.

Periodic update · new data 2026-09-28

Enforcement & Redress

The KCDPA vests exclusive enforcement authority in the Kentucky Attorney General's Office of Data Privacy, which may seek injunctive relief, civil penalties, and reasonable attorneys' fees and investigative costs. Before bringing an enforcement action, the statute affords a permanent 30-day cure period, well corroborated across multiple concurring secondary sources and the Attorney General's own primary-source page, during which an alleged violator may remedy the violation. If the violation is not cured within that window, the Attorney General may bring an action seeking damages of up to $7,500 for each violation.

There is no private right of action under the KCDPA, meaning individual consumers cannot bring their own lawsuits for statutory violations; the Attorney General's office is the sole enforcement channel. No enforcement actions under the KCDPA were identified in the record reached this cycle, consistent with the Act's enforcement mechanism being educational in its early operational period rather than punitive, though this characterisation of an educational early posture rests on limited direct evidence and should be treated with appropriate caution.

Outlook

The practical operation of the 30-day cure period, and whether the Attorney General's office brings its first enforcement action under the Act, are the developments most likely to generate future signal for this module. The absence of a private right of action means enforcement-and-redress developments for Kentucky will continue to run exclusively through Attorney General activity rather than through litigation.

2 earlier distinct update(s)

Periodic update · new data 2026-09-22

Enforcement & Redress

The Kentucky Attorney General holds exclusive enforcement authority over the KCDPA and may pursue civil penalties of up to $7,500 per violation; this is Confirmed. The Act does not create a private right of action, meaning consumers cannot bring their own KCDPA claims and must rely entirely on Attorney General enforcement; this too is Confirmed and rests on primary Acts text. As of early January 2026, the Attorney General's Office of Data Privacy is understood to be prioritizing education and assistance over punitive enforcement measures, a Probable-confidence characterisation of enforcement posture rather than a settled enforcement-activity record. Taken together, Kentucky's enforcement architecture, exclusive AG authority, no private right of action, and an education-first early posture, is comparatively lenient relative to peer states with private rights of action or more aggressive early enforcement records.

Outlook

The item to watch is whether the Attorney General's office shifts from its current education-first posture toward active penalty assessment as the KCDPA's first full year of operation progresses, and whether any enforcement actions become publicly reported.

Periodic update · new data 2026-09-14

Enforcement & Redress

Enforcement of the KCDPA is vested exclusively in the Kentucky Attorney General; the statute provides no private right of action, meaning consumers cannot bring individual claims and all enforcement runs through the Attorney General's office. The statute authorizes civil penalties of up to 7,500 dollars per violation, paired with a permanent 30-day cure period that carries no sunset provision, meaning respondents retain the opportunity to cure an alleged violation within 30 days indefinitely into the future rather than that right expiring after some initial statutory window as occurs under certain other states' cure-period sunset clauses.

The statute's enforcement debut came remarkably quickly: the Attorney General filed suit against Character Technologies, Inc. on January 8, 2026, just eight days after the KCDPA took effect on January 1, 2026. This is the first enforcement action brought under the statute and establishes an early precedent for how quickly and assertively the Attorney General's office is prepared to act.

Outlook

Watch for whether the permanent cure period meaningfully blunts the practical force of the civil-penalty structure in future enforcement matters, and for whether the pace and aggressiveness demonstrated in the Character Technologies filing continues across subsequent enforcement actions.

Sources and claims (7)

ConfirmedKentucky Attorney General's Office — The Kentucky Attorney General's Office of Data Privacy has exclusive authority to enforce the KCDPA and may seek injunctive relief, civil penalties, and reasonable attorneys' fees and investigative costs; violators that fail to cure within 30 days of notice face civil penalties of up to $7,500 per violation.observed 2026-08-05
ConfirmedKentucky Attorney General's Office / Franklin Circuit Court — In January 2026, the Kentucky Attorney General filed a parens patriae enforcement action against Character Technologies, Inc. alleging AI chatbot safety and data-protection violations.observed 2026-08-05
ConfirmedKentucky Attorney General's Office / Woodford Circuit Court — In July 2025, the Kentucky Attorney General filed a lawsuit against Temu (PDD Holdings/Whaleco) under the Kentucky Consumer Protection Act alleging unlawful collection of sensitive personal information without consent, among other data-practice violations.observed 2026-08-05
UncertainKentucky Attorney General's Office / Woodford Circuit Court — Separately from the KCDPA, Kentucky's general Consumer Protection Act (KRS 367.110 et seq.) has been used by the Attorney General to bring data-practice-related enforcement actions (e.g., against Temu), but this statute likewise does not appear to provide a private class-action mechanism distinct from AG enforcement based on available sources.observed 2026-08-05
ConfirmedKentucky Attorney General's Office — The KCDPA does not provide Kentucky consumers with a private right of action; enforcement runs exclusively through the Attorney General's Office of Data Privacy.observed 2026-08-05
ConfirmedDataGuidance — House Bill 473, effective June 1, 2026, amended the KCDPA to exempt certain HIPAA-regulated health information and to narrow the profiling-related DPIA trigger to cases involving disparate impact.observed 2026-08-05
ProbableDataGuidance — House Bill 692, signed into law in 2026, amends the KCDPA to define 'automatic content recognition' and 'smart monitor' and to require consumer consent for data collection via such technologies, with an effective date of July 1, 2027.observed 2026-08-05

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

No failing checks.

`schema_valid`	pass
`min_t1_per_instrument_met`	pass
`min_quoted_text_present`	waived — floor 0%
`translation_provenance_recorded`	n/a — no subject in this jurisdiction
`egress_verified`	pass
`source_tier_integrity_ok`	pass
`jurisdiction_source_floor_met`	pass
`tier_a_b_national_primary_pct`	36.84
`aggregator_only_jurisdiction_count`	0
`manual_override`

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Kentucky, USA
Field	Value
`trust.lawyer_review.status`	never_reviewed
`trust.lawyer_review.reviewer`	no reviewer on record
`trust.content_source`	ai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-02. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 43 claim(s) (43 category placement(s)), 30 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	access right
`Art. 14`	Data Subject Rights	access right
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	restriction and objection
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy received
`Art. 46`	Cross-Border & Adequacy	sccs and bcrs
`Art. 47`	Cross-Border & Adequacy	transfer mechanisms
`Art. 48`	Cross-Border & Adequacy	transfer mechanisms
`Art. 49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77`	Enforcement & Redress	regulator powers and penalties
`Art. 78`	Enforcement & Redress	regulator powers and penalties
`Art. 79`	Enforcement & Redress	collective redress and class actions
`Art. 80`	Enforcement & Redress	private right of action
`Art. 82`	Enforcement & Redress	private right of action
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	regulator powers and penalties

Self-audit

regulator_and_framework, data_subject_rights, and enforcement_and_redress rest primarily on Tier-1 ag.ky.gov guidance and primary court filings (Temu, Character Technologies complaints), giving high confidence. lawful_processing_and_special_data and algorithmic_biometric_and_surveillance_governance mix Tier-1 (sensitive-data definitions) with Tier-3 secondary commentary (DPIA/ADM framing). controller_processor_duties is partially confirmed (DPIA, contracts, breach law) but has genuine gaps on DPO/ROPA/retention. sectoral_watch and adtech_and_commercial_privacy rely more heavily on Tier-3/Tier-4 secondary sources and general multi-state pattern-matching (GLBA exemption, dark patterns, UOOM) rather than direct KCDPA statutory text. children_and_vulnerable_groups is confirmed for the under-13 sensitive-data rule but the broader minors' bill landscape (Kids Code HB633, HB12, HB227) has unconfirmed enactment status. cross_border_and_adequacy is a genuine, well-evidenced regulatory gap (no US state-level transfer/adequacy/localisation regime).

Unresolved questions (7):

Exact KCDPA statutory text (KRS 367.3611–367.3629) was not directly parsed; all thresholds/exemptions are drawn from AG-published summaries and secondary legal commentary rather than the codified text itself.
Whether the KCDPA's GLBA/financial-institution exemption is entity-level or data-level was not directly confirmed from KY statutory text.
Enactment/effective-date status of the Kentucky Kids Code (HB633), HB12 (social media age verification), and HB227 (addictive platforms) could not be confirmed.
Exact signing date and full provisions of HB692 (automatic content recognition / smart monitor) beyond its July 1, 2027 effective date were not confirmed.
Whether the KCDPA recognizes universal opt-out mechanisms (e.g., Global Privacy Control) or contains an explicit dark-patterns prohibition was not confirmed.
DPO-appointment, ROPA, and data-retention/disposal obligations under the KCDPA could not be confirmed or disconfirmed from available sources.
Exact effective date and full scope of Senate Bill 4 (public-sector AI governance) and the Kentucky Insurance Data Security Act were not independently confirmed.

Escalate to primary-source review: yes

Kentucky, USA

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 25 August 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Latest update · 22 September 2026

Regulatory Status

Outlook

Standing brief · as of 25 August 2026

Regulatory Status

Outlook

regulator_and_frameworkRegulator & Framework5 sub-modules5 claimsGreen▾#

Sub-modules (5)

Regulator And AuthorityGreen

Act And InstrumentsGreen

Material ScopeGreen

Territorial ScopeAmber

Regulator Registration And FilingRed

Key findings (9)

Regulator & Framework

Outlook

Regulator & Framework

Outlook

Regulator & Framework

Outlook

lawful_processing_and_special_dataLawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Sub-modules (4)

Lawful BasesAmber

Consent ThresholdsGreen

Special CategoriesGreen

Pseudonymisation And AnonymisationAmber

Key findings (9)

Lawful Processing & Special Data

Outlook

Lawful Processing & Special Data

Outlook

Lawful Processing & Special Data

Outlook

data_subject_rightsData Subject Rights5 sub-modules5 claimsGreen▾#

Sub-modules (5)

Access RightGreen

Rectification And ErasureGreen

Restriction And ObjectionGreen

Data PortabilityGreen

Deadlines And Response WindowsGreen

Key findings (9)

Data Subject Rights

Outlook

Data Subject Rights

Outlook

Data Subject Rights

Outlook

controller_processor_dutiesController/Processor Duties7 sub-modules6 claimsAmber▾#

Sub-modules (7)

Accountability And DpiaAmber

Dpo RequirementsRed

Ropa RequirementsRed

Joint Controller ArrangementsGreen

Security MeasuresAmber

Breach NotificationAmber

Retention And DisposalRed

Key findings (9)

Controller/Processor Duties

Outlook

Controller/Processor Duties

Outlook

Controller/Processor Duties

Outlook

cross_border_and_adequacyCross-Border & AdequacyCOVERAGE GAP6 sub-modulesNot assessed▾#

Sub-modules (6)

Transfer MechanismsRed

Adequacy ReceivedRed

Adequacy GrantedRed

#

#

#

#

#

#

#

#

#

#