Kentucky Consumer Data Protection Act
Kentucky Consumer Data Protection Act (HB 15, 2024)
Kentucky · 2024 Ky. Acts (HB 15); KRS ch. 367
- Status
- In effect
- Took effect
- January 1, 2026
- Applies to
- Controllers/processors meeting thresholds doing business in or targeting Kentucky
- Enforced by
- Kentucky Attorney General (exclusive)
Kentucky's privacy law took effect January 1, 2026, giving residents rights to access, correct, delete, and copy their personal data, and to opt out of data sales and targeted advertising. Businesses need opt-in consent for sensitive data including biometrics.
Who is protected: Kentucky consumers
Legal detail
KY HB 15 (2024), eff. Jan. 1, 2026; VCDPA-modeled; 100,000-consumer or 25,000/50%-revenue thresholds; data protection assessments required from June 1, 2026; AG-exclusive enforcement, 30-day cure, up to $7,500 per continued violation.
Key facts
| Jurisdiction | Kentucky |
|---|---|
| Level | State |
| Strength | Limited |
| Enacted | April 4, 2024 |
| Citation | 2024 Ky. Acts (HB 15); KRS ch. 367 |
| Private right of action | No, agency enforcement only |
| Penalties | Up to $7,500 per continued violation after 30-day cure |
| Topics | consumer data privacy · consumer protection · automated decision-making · data retention |
| Bill text | 24RS HB 15 — Kentucky Legislature |
More AI rules in Kentucky
- Kentucky Beshear data center executive order (2026) · In effect
- Kentucky SB 4 (AI Governance) · In effect
- Kentucky HB 207 (computer-generated CSAM) · In effect
- Commonwealth Office of Technology Enterprise Policy CIO-126: · In effect
- Kentucky HB 58 ALPR limits and 90-day retention (2026) · In effect
- KY AG v. Character.AI chatbot suit (2026) · Blocked / in litigation
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare companies · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.