Kentucky Consumer Data Protection Act (KCDPA)

Kentucky's comprehensive privacy law, effective 1 January 2026. A 2026 amendment classifies automated content recognition data from smart TVs as sensitive data from 1 July 2027.

JurisdictionKentucky
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Kentucky Consumer Data Protection Act (KCDPA) establishes several key requirements for businesses:

  • Consumer Rights: The KCDPA grants Kentucky residents rights over their personal data, including:
  • Right to access and confirm data processing
  • Right to correct inaccuracies
  • Right to delete personal data
  • Right to data portability
  • Right to opt-out of targeted advertising, data sales, and profiling

Source: [Kentucky Legislature - KCDPA Text]

  • Data Minimization: Businesses must limit data collection to what is "adequate, relevant, and reasonably necessary" for the specified processing purposes.

Source: [Kentucky Attorney General - KCDPA Overview]

  • Data Protection Assessments: Controllers must conduct and document data protection impact assessments for certain high-risk processing activities.

Source: [Kentucky Secretary of State - KCDPA Regulations]

  • Security Measures: Businesses must implement reasonable administrative, technical, and physical data security practices to protect personal data.

Source: [Kentucky Office of the Attorney General - Data Security Guidelines]

Compliance Challenges

Organizations face several challenges in complying with the KCDPA:

  • Data Mapping and Inventory: Many businesses struggle to identify and categorize all personal data they process.

Source: [IAPP - KCDPA Compliance Challenges]

  • Consent Management: Implementing systems to obtain and manage consumer consent for data processing can be complex.

Source: [TrustArc - KCDPA Compliance Guide]

  • Technical Implementation: Updating systems to allow for data access, deletion, and portability requests can be technically challenging.

Source: [ISACA - KCDPA Technical Challenges]

Implementation Best Practices

To implement KCDPA requirements effectively:

  • Conduct a comprehensive data audit and mapping exercise
  • Implement a robust consent management platform
  • Develop clear processes for handling consumer rights requests
  • Regularly update privacy policies and notices

Source: [IAPP - KCDPA Implementation Guide]

Useful tools and resources:

Recent Updates

As of February 2025, there have been no significant amendments to the KCDPA since its enactment. However, businesses should monitor the Kentucky Legislature website for potential updates.

Key dates to remember:

  • Effective Date: January 1, 2025
  • Enforcement Date: July 1, 2025

Source: [Kentucky Secretary of State - KCDPA Timeline]

Related Regulations

The KCDPA interacts with several other privacy regulations:

  • California Consumer Privacy Act (CCPA): Similar consumer rights and business obligations

Source: [California Attorney General - CCPA]

  • General Data Protection Regulation (GDPR): Stricter requirements but similar principles

Source: [European Commission - GDPR]

  • Virginia Consumer Data Protection Act (VCDPA): Closely aligned with KCDPA requirements

Source: [Virginia Legislative Information System - VCDPA]

Industry Impact

The KCDPA will significantly impact various industries:

  • Retail: Must update data collection practices and provide opt-out mechanisms for targeted advertising
  • Healthcare: Need to reconcile KCDPA requirements with existing HIPAA compliance
  • Financial Services: Additional data protection measures on top of existing regulations

Source: [Deloitte - KCDPA Industry Impact Analysis]

Sources

Recent developments

  • — A 2026 amendment, effective July 1, 2027, classifies **automated content recognition (ACR) data from Smart TVs and smart monitors as sensitive data**, expanding KCDPA’s sensitive data scope and prompting media and ad‑tech companies to revisit consent and data handling practices.[8] (source)
  • — Legal analyses highlight that **data protection impact assessments (DPIAs) are required for higher‑risk processing activities initiated on or after June 1, 2026**, pushing organizations to implement formal risk assessment processes similar to those in Virginia and Colorado.[5] (source)
  • — Compliance guidance emphasizes that from June 1, 2026, controllers must conduct **data protection impact assessments** for specified high‑risk processing, underscoring operational changes around profiling, targeted advertising, and sensitive data processing under the KCDPA.[8] (source)
  • — Kentucky Attorney General announced the **first enforcement action** under the KCDPA against a company for alleged violations just eight days after the law took effect, signaling an active enforcement posture and putting businesses on notice to rapidly align practices with the statute.[8] (source)
  • — Kentucky Attorney General announced the **first enforcement action** under the KCDPA on January 8, 2026, only eight days after the law took effect, signaling an active enforcement posture and heightened compliance expectations for covered businesses.[7] (source)
  • — Kentucky Attorney General’s Office of Data Privacy published consumer-facing guidance as the **KCDPA took effect**, detailing residents’ rights (access, correction, deletion, portability, opt-outs for targeted advertising/sale/profiling) and complaint procedures, effectively operationalizing the law for both consumers and covered businesses.[6] (source)
  • — Legal advisory highlights that the **KCDPA became enforceable on January 1, 2026**, aligning Kentucky with other comprehensive state privacy regimes and noting implications for multi-state compliance programs, particularly for entities already subject to Indiana’s analogous law.[4] (source)
  • — The KCDPA **went into effect on January 1, 2026**, and the Attorney General’s Office of Data Privacy published consumer-facing guidance outlining Kentuckians’ rights (access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling) and the AG’s exclusive enforcement authority.[3] (source)
  • — Industry overviews note that as of January 1, 2026, the KCDPA applies to businesses processing data of at least 100,000 consumers or 25,000 consumers with more than 50% of revenue from data sales, and follows an **opt-out model** for most processing, driving alignment efforts with other state privacy regimes.[8] (source)
  • — Law firm update discusses the **“slow track” rollout** of the KCDPA ahead of its 2026 effective date, emphasizing scoping thresholds, consumer rights, anti-discrimination obligations, and the 30‑day cure period, and advising businesses to integrate Kentucky requirements into broader U.S. privacy compliance strategies.[5] (source)
  • — Privacy vendor commentary outlines **compliance expectations and operational impacts** of the KCDPA, focusing on privacy notice content, consumer request handling, opt-out mechanisms for targeted advertising and sale of data, and the per‑violation penalty structure that may drive industry investment in consent and preference management tools.[2] (source)
  • — Insight alert analyzes the KCDPA’s **controller and processor obligations**, including data protection contracts, privacy notice requirements, impact assessments, and exclusive AG enforcement with no private right of action, framing the law as part of the broader trend of business-friendly but increasingly stringent state privacy regimes.[1] (source)

Read the full guide to Kentucky Consumer Data Protection Act (KCDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates