Section 4(4)(a) of Kentucky CDPA establishes the heightened consent requirement for sensitive data processing. (1) Section 2 Sensitive Data Definition - 8 Categories: (a) Racial or ethnic origin; (b) Religious beliefs; (c) Mental or physical health diagnosis; (d) Sexual orientation; (e) Citizenship or immigration status; (f) Genetic or biometric data processed for identification purposes; (g) Children's data (data of consumers known to be under 13); (h) Precise geolocation data - within 1,750 feet (approximately 1/3 mile - critical for location tracking + connected vehicles + retail analytics). (2) Section 4(4) Heightened Consent Standard: (a) Affirmative consent required BEFORE processing sensitive data; (b) Clear affirmative act + specific + informed + unambiguous; (c) Written or electronic equivalent; (d) Withdrawable at any time; (e) Documented + audit trail; (f) Reaffirmation for new purposes; (g) Pre-ticked boxes + silence + inactivity do NOT constitute consent. (3) Genetic Data Specific: (a) Heritability affecting family members; (b) Bioethics considerations; (c) Genetic testing services + ancestry; (d) Health insurance + GINA Genetic Information Nondiscrimination Act intersection; (e) DNA forensic considerations; (f) Pharmacogenomics. (4) Biometric Data Specific (Identification Purpose): (a) Used for identification of specific individual; (b) Excludes physical/digital photographs unless for ID; (c) Excludes audio/video unless for ID; (d) HIPAA + healthcare exception; (e) Fingerprint + facial recognition + voice + iris + retina; (f) Behavioural biometrics; (g) Mobile device biometrics; (h) Banking biometric authentication. (5) Children's Data Specific (Under 13): (a) COPPA Children's Online Privacy Protection Act intersection; (b) Verifiable parental consent required; (c) FTC COPPA Safe Harbor programs; (d) NO direct marketing to children; (e) NO targeted advertising to children; (f) NO profiling of children for decisions; (g) Education sector + FERPA considerations; (h) Children's Code emerging; (i) Age verification mechanisms. (6) Mental/Physical Health Diagnosis: (a) Distinguished from general wellness data; (b) Mental health + substance abuse + reproductive health + chronic conditions + disability; (c) Telemedicine + digital therapeutics + mental health apps; (d) HIPAA exempt for HIPAA-covered entities + business associates; (e) FDA Software as Medical Device (SaMD) considerations; (f) Insurance + ADA discrimination considerations. (7) Religious Beliefs: (a) Religious affiliation + practice + belief; (b) Religious dietary + clothing + ritual observance; (c) Religious community membership; (d) First Amendment + Religious Freedom Restoration Act considerations. (8) Sexual Orientation: (a) LGBTQ+ status disclosure; (b) Workplace + housing + service discrimination concerns; (c) Title VII employment intersection; (d) State LGBTQ+ protections vary; (e) Sensitive context - dating apps + healthcare + employment. (9) Citizenship/Immigration Status: (a) Native + Naturalized US citizen + LPR Lawful Permanent Resident + visa status + asylum/refugee + undocumented; (b) Employment + housing discrimination concerns; (c) Immigration enforcement + cooperation considerations; (d) Sanctuary city considerations; (e) E-Verify + I-9 employment context. (10) Precise Geolocation (1,750 ft): (a) GPS + cell tower triangulation + Wi-Fi positioning + Bluetooth beacon; (b) Mobile app location + advertising; (c) Connected vehicle + telematics; (d) Retail analytics + customer tracking; (e) Behavioral profiling; (f) Surveillance concerns. (11) Sensitive Data Processing Practices: (a) Data classification + tagging; (b) Access control + role-based + need-to-know; (c) Encryption + segregation + masking; (d) Audit logging + monitoring; (e) Vendor due diligence + processor obligations; (f) Privacy Impact Assessment (Section 6 DPA); (g) Data subject rights enhanced for sensitive data. (12) Penalties for Sensitive Data Violations: (a) Section 9 AG enforcement; (b) 30-day cure period; (c) Civil penalty up to USD 7,500 per violation; (d) Aggregation possible (multiple consumers + multiple categories); (e) Class-action-like exposure absent (no PRA). Coordinates with VCDPA Virginia + Indiana CDPA + Iowa ICDPA + Connecticut CTDPA + Colorado CPA + Utah UCPA + CCPA/CPRA California + Tennessee TIPA + COPPA Children's Online Privacy Protection Act + GINA Genetic Information Nondiscrimination Act + HIPAA + Title VII + ADA + FERPA + FTC Health Breach Notification Rule + State LGBTQ+ Protections + Religious Freedom Restoration Act + First Amendment + Immigration laws. Kentucky CDPA Sensitive Data + Section 4(4) + 8 Categories applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.