Kentucky Consumer Data Protection Act (H.B. 15, 2024 Ky. Acts ch. 72; KRS 367.3611 to 367.3629): profiling opt-out and data protection impact assessments

Summary

Kentucky's comprehensive consumer privacy law, enacted as H.B. 15 (2024 Ky. Acts ch. 72) and codified at KRS 367.3611 to 367.3629, took effect on January 1, 2026. It applies to persons doing business in Kentucky or targeting its residents that control or process personal data of at least 100,000 consumers a year, or of at least 25,000 consumers while deriving over half of gross revenue from selling personal data. State agencies and cities, financial institutions and their affiliates and data subject to Title V of the Gramm-Leach-Bliley Act, HIPAA-covered entities and nonprofits are excluded. Consumers may opt out of processing for targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Controllers must conduct and document a data protection impact assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or disparate impact, financial, physical or reputational injury, or offensive intrusion, among other activities. The Attorney General has exclusive enforcement authority, must give 30 days' written notice and an opportunity to cure, and may seek up to $7,500 for each continued violation; there is no private right of action. A 2026 amendment (H.B. 692, 2026 Ky. Acts ch. 118) adds a consent requirement for automatic content recognition data, effective July 1, 2027.

Key dates

1. April 4, 2024Enacted
2. January 1, 2026Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. This Act may be cited as the Kentucky Consumer Data Protection Act.

   Supports: Name

   This Act takes effect January 1, 2026.

   Supports: Effective date

   Opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Profiling opt-out

   The processing of personal data for the purposes of profiling, where the profiling presents a reasonably foreseeable risk of: 1. Unfair or deceptive treatment of consumers or disparate impact on consumers;

   Supports: Impact assessment duty for risky profiling

   Financial institutions, their affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act, 15 U.S.C. sec. 6801 et seq.;

   Supports: GLBA exclusion

   the Attorney General may initiate an action and seek damages for up to seven thousand five hundred dollars ($7,500) for each continued violation

   Supports: Penalty

   The Attorney General shall have exclusive authority to enforce violations of Sections 1 to 10 of this Act.

   Supports: Attorney General enforcement

   Signed by Governor April 4, 2024.

   Supports: Signing date

   2024 Kentucky Acts, chapter 72 (H.B. 15) Kentucky Legislative Research Commission Primary source

2. signed by Governor (Acts Ch. 72)

   Supports: Acts chapter

   House Bill 15 (2024 Regular Session) record Kentucky General Assembly Primary source

3. As used in KRS 367.3611 to 367.3629:

   Supports: Codified location

   Section 3. This Act takes effect July 1, 2027.

   Supports: 2026 amendment effective date

   2026 Kentucky Acts, chapter 118 (H.B. 692) Kentucky Legislative Research Commission Primary source