Kentucky Consumer Data Protection Act (KCDPA) Reference Guide

The KCDPA applies to a person conducting business in Kentucky or producing products or services targeted to residents that, during a calendar year, controls or processes personal data of at least 100,000 consumers. The alternative route is at least 25,000 consumers plus more than 50% of gross revenue from personal-data sales. KRS 367.3613: applicability thresholds

The statute excludes multiple entities and data categories, including specified governmental, financial, health, nonprofit and higher-education contexts. “Consumer” means a Kentucky resident acting in an individual context, not a commercial or employment context. KRS 367.3611: definitions KRS 367.3613: exemptions

Analytics visits can help estimate operational reach, but they do not establish the number of statutory consumers or the percentage of gross revenue derived from sales.

A Kentucky consumer may confirm processing, access personal data, correct inaccuracies, delete eligible data, obtain a portable copy and opt out of targeted advertising, sale and profiling used for decisions with legal or similarly significant effects. A controller generally has 45 days to respond, may take one justified 45-day extension, and must answer an appeal within 60 days. KRS 367.3615: consumer rights and timing

Controllers must limit collection to what is adequate, relevant and reasonably necessary, maintain reasonable security, give a reasonably accessible privacy notice, provide secure request methods and obtain consent before processing sensitive data. Known-child data is addressed through COPPA requirements. KRS 367.3617: controller duties

Kentucky defines sale as an exchange of personal data for monetary consideration, with exclusions for processors, affiliates, consumer-directed disclosures and other listed circumstances. Targeted advertising is a separate category with its own exclusions. A marketing request can therefore require targeted-advertising review even if it is not a statutory sale. KRS 367.3611: sale and targeted-advertising definitions

Create an inventory of every client-side and server-side destination, the data sent, the recipient and the stated purpose. Then compare that inventory with the behavior observed after the site’s Kentucky opt-out route is used.

The current KCDPA requires a secure and reliable way for consumers to exercise statutory rights, but it does not expressly mandate recognition of a universal GPC browser signal as every Kentucky opt-out. Other state laws or a company’s shared privacy architecture may still make GPC operationally relevant. KRS 367.3615: exercise of rights KRS 367.3617: request methods and notice

Test consent rejection and GPC in separate browser sessions, then compare the results. Kentucky-specific evidence should also include the website’s direct consumer opt-out path and the resulting behavior of classified advertising, sale and profiling flows.

The Kentucky Attorney General has exclusive enforcement authority. Before initiating an action, the Attorney General must provide written notice identifying alleged violations and allow 30 days to cure. A controller that timely cures and provides the required assurance avoids an action for damages on the noticed violation; a continued violation can carry up to $7,500 per violation. The KCDPA itself creates no private right of action. KRS 367.3627: enforcement and cure

Counsel determines whether the organization and a particular use fall within the KCDPA. Product, marketing and engineering teams then translate those decisions into controls that reach consent tooling, hard-coded scripts, tag managers and downstream systems.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Qualified privacy counsel should address applicability, exemptions, legal classifications, notices, contracts, rights procedures, assessments, sensitive data and organizational governance.

This guide relies on the Kentucky General Assembly’s current statute pages and the Kentucky Attorney General’s Office of Data Privacy. The July 1, 2027 amendment is identified separately so a future requirement is not presented as current law.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exemptions, classification, notices, requests, sensitive data, contracts and governance.