Kentucky Consumer Data Protection Act (CDPA) enacted via House Bill 15 (HB 15) signed by Governor 4 April 2024 + codified at KRS Chapter 367 Sections 1-10 + effective 1 January 2026. Kentucky becomes the 17th (approximately) US state to enact a comprehensive consumer privacy law + 4th state of 2024 enactments + follows VCDPA Virginia template common to majority of US state laws. (1) Statutory Framework: (a) HB 15 enacted 2024 Regular Session of Kentucky General Assembly; (b) Senate Bill 15 (SB 15) parallel version; (c) Signed by Governor Andy Beshear 4 April 2024; (d) Codified at Kentucky Revised Statutes (KRS) Chapter 367 (Consumer Protection); (e) Effective 1 January 2026; (f) Attorney General sole enforcement authority - NO PRIVATE RIGHT OF ACTION. (2) Section 1 Applicability and Thresholds: (a) Applies to legal entities (controllers and processors) that conduct business in Kentucky OR produce products/services targeted to Kentucky consumers; AND (b) Meet one of two thresholds during a calendar year - (i) Control or process personal data of at least 100,000 Kentucky consumers; OR (ii) Control or process personal data of at least 25,000 Kentucky consumers AND derive over 50% of gross revenue from sale of personal data; (c) Note - 100K threshold higher than some states (Virginia 100K, Connecticut 100K, but lower than California's CCPA $25M revenue threshold). (3) Section 2 Definitions Key Terms: (a) Affiliate - 50% common ownership/control or common branding; (b) Authenticate - reasonable means verifying consumer identity for rights requests; (c) Biometric Data - automatic measurements of biological characteristics (fingerprint + voiceprint + eye retinas + irises) EXCLUDING physical/digital photographs + audio/video recordings unless used for identification (HIPAA exempt); (d) Child - under 13 (consistent with COPPA); (e) Consent - clear affirmative act + specific + informed + unambiguous; (f) Consumer - natural person residing in Kentucky in individual or household context (NOT in commercial/employment context); (g) Controller - person determining purposes and means of processing; (h) Decisions that produce legal or similarly significant effects - financial + lending + housing + insurance + education enrollment + criminal justice + employment + healthcare access + essential goods or services; (i) Personal Data - information linked or reasonably linkable to identified or identifiable natural person + EXCLUDES de-identified + publicly available + employee/B2B context; (j) Processor - person processing on behalf of controller; (k) Sale of Personal Data - exchange for monetary or other valuable consideration to third party + EXCLUDES disclosure to processor + affiliate transfer + disclosure to controller for product/service requested + disclosure to consumer-directed third party + as part of business merger/asset sale; (l) Sensitive Data - racial/ethnic origin + religious beliefs + mental/physical health diagnosis + sexual orientation + citizenship/immigration status + genetic/biometric data + children's data + precise geolocation data (within 1,750 feet). (4) Section 1 Exemptions: (a) Government entities; (b) Higher education institutions; (c) Non-profit organizations (subject to certain conditions); (d) GLBA-covered financial institutions; (e) HIPAA-covered entities; (f) Information processed for HIPAA purposes; (g) FERPA-covered student records; (h) Driver's Privacy Protection Act; (i) FCRA Fair Credit Reporting Act; (j) ADPPA/HIPAA/Other federal sectoral law preemption considerations; (k) Employment context data; (l) B2B commercial transaction context. (5) Attorney General Enforcement Framework: (a) Attorney General sole authority - NO PRIVATE RIGHT OF ACTION; (b) Cure Period - 30 days written notice + opportunity to cure violation; (c) After cure period - civil penalties up to USD 7,500 per violation; (d) Aggregation of violations possible; (e) Injunctive relief available; (f) Attorneys' fees recoverable for AG; (g) Cure period sunsets after specified period (similar to VCDPA's cure period sunset). (6) US State Privacy Law Context (2026 Landscape): (a) California (CCPA + CPRA) - distinct private right of action for breach + 2020/2023; (b) Virginia (VCDPA) - 2023 template Kentucky follows; (c) Colorado (CPA) - 2023 + Universal Opt-Out Mandate; (d) Connecticut (CTDPA) - 2023; (e) Utah (UCPA) - 2023 narrower; (f) Iowa (ICDPA) - 1 Jan 2025 + 90-day cure; (g) Indiana - 2026; (h) Tennessee + Texas + Florida + Oregon + Montana + Delaware + New Jersey + New Hampshire + Maryland + Minnesota + Nebraska + Rhode Island + others including Kentucky from 1 Jan 2026; (i) Compliance complexity escalating for multi-state operations. (7) Constitutional Anchor: (a) Kentucky Constitution Bill of Rights Section 1 right to enjoy and defend lives and liberties + Section 10 protection against unreasonable searches/seizures; (b) US Constitution Fourth + Fourteenth Amendments. (8) Federal Coordination: (a) HIPAA + GLBA + COPPA + FCRA + FERPA + DPPA federal sectoral preemption; (b) FTC Act enforcement intersection; (c) Pending ADPPA American Data Privacy and Protection Act federal preemption considerations; (d) Section 5 FTC consumer protection. (9) Sectoral Coordination: (a) Banking (KY Department of Financial Institutions + GLBA); (b) Insurance (KY Department of Insurance); (c) Telecom (KY Public Service Commission); (d) Health (KY Cabinet for Health and Family Services + HIPAA); (e) Education (KY Department of Education + FERPA). (10) Implementation Considerations: (a) 1 January 2026 effective date provides ~21 months from enactment; (b) Multi-state privacy program adaptation; (c) Universal Opt-Out Mechanism implementation; (d) Vendor + processor contract updates; (e) Privacy Notice updates; (f) DPA template adoption. Coordinates with VCDPA Virginia (template) + Indiana CDPA + Iowa ICDPA + Tennessee TIPA + Utah UCPA + Connecticut CTDPA + Colorado CPA + CCPA/CPRA California + Delaware DPDPA + Maryland MODPA + Minnesota MCDPA + Nebraska Data Privacy Act + New Hampshire SB 255 + New Jersey + Oregon + Texas + Montana + Florida + Rhode Island + ADPPA federal proposal + HIPAA + GLBA + COPPA + FCRA + FERPA + DPPA + FTC Section 5 + Kentucky Constitution + US Constitution. Kentucky CDPA Scope + Thresholds + HB 15 + KRS Chapter 367 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.