Kentucky
Kentucky privacy law: new in 2026, with a 30-day safety net
Kentucky's Act switched on January 1, 2026. It does not require you to honor a browser opt-out signal, but it does require a working opt-out, a 45-day answer, and it gives you a permanent 30-day window to fix a violation before the Attorney General can act.
At a glance
- Applies if
- You conduct business in Kentucky or supply products or services targeted to Kentucky residents and, during a calendar year, you control or process personal data of at least 100,000 consumers; or at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data (§367.3613(1)). There is no standalone dollar-revenue floor.
- Opt-out signal
- No express requirement to honor Global Privacy Control or another universal preference signal. The Act instead requires designated, secure and reliable ways to submit requests (§367.3617(5)), with authentication rules at §367.3615(3)(d).
- Response deadline
- 45 days of receipt, extended once by 45 additional days when reasonably necessary with timely notice (§367.3615(3)(a)). An appeals process is required, with a decision within 60 days of receipt of an appeal (§367.3615(4)).
- Right to cure
- Permanent mandatory opportunity with no sunset: the Attorney General gives 30 days' written notice, and a timely cure plus an express written assurance prevents the specified damages action (§367.3627(2)).
- Max penalty
- Up to $7,500 for each continued violation — that is, after the cure period or after a broken written assurance. Enforced exclusively by the Attorney General, who may also recover expenses, costs, and attorney fees (§367.3627(1), (3)–(5)).
- Consumer rights
- access · correction · deletion · portability · opt out of sale · opt out of targeted advertising · opt out of profiling furthering decisions with legal or similarly significant effects · consent for sensitive data
Kentucky Consumer Data Protection Act, KRS §§367.3611–367.3629 — in force January 1, 2026.
Coverage is counted in people, not dollars
The 100,000-consumer test is met by reach, so a chain with Kentucky stores or an e-commerce brand shipping there can clear it without noticing. The alternative test — 25,000 consumers plus over 50 percent of gross revenue from selling personal data — catches businesses that monetize audiences (§367.3613(1)).
No signal mandate, but the opt-out still has to work
Kentucky does not require you to detect a browser-level opt-out signal. You still have to give consumers a real way to opt out of sale, targeted advertising, and qualifying profiling, through request methods that are secure and reliable (§367.3617(5); §367.3615(2)(a)–(e)). A link that leads to a dead page is still a broken mechanism.
What else Kentucky requires
Individuals acting in a commercial or employment context are outside the definition of consumer (§367.3611(7)).
- Privacy notices and disclosures for sale and targeted advertising (§367.3617(3)–(5)).
- Consent before processing sensitive data (§367.3617(1)(e)).
- Bona fide voluntary loyalty or rewards programs may offer different prices or service levels (§367.3617(1)(d)).
- Financial institutions and affiliates covered by GLBA are exempt as entities (§367.3613(2)(b)).
Where Kentucky sites usually break
A dealership has to work out whether its online lead forms sit inside a GLBA-exempt financing flow (§367.3613(2)(b)); retail and restaurant loyalty programs are not automatically prohibited but keep their notice and rights duties (§367.3617). E-commerce ad pixels and lead sales can trigger the targeted-advertising and sale opt-outs once the statutory definitions are met (§367.3615(2)(e)), while applicant screening generally falls outside consumer scope (§367.3611(7)).
Use the 30-day window on your own terms
Kentucky's cure right only helps if you find the problem before the Attorney General does: cure inside 30 days and give written assurance, and the damages action does not get started (§367.3627(2)). That is an argument for a monthly scan with a dated record, not an annual one.
Primary sources
- Kentucky Revised Statutes §367.3613 — applicability (KCDPA)
- Kentucky Revised Statutes §367.3615 — consumer rights and request handling (KCDPA)
- Kentucky Revised Statutes §367.3617 — controller duties (KCDPA)
- Kentucky Revised Statutes §367.3627 — enforcement and cure (KCDPA)
- Kentucky Revised Statutes §367.3611 — definitions (KCDPA)
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.