Kentucky Consumer Data Protection Act (2024 Ky. Acts, HB 15, creating new sections of KRS Chapter 367)
Below is what the official text of Kentucky Consumer Data Protection Act (2024 Ky. Acts, HB 15, creating new sections of KRS Chapter 367) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit US business with 150,000 people in Kentucky and $30 million revenue: Applies, or may apply: conditions to check.
- The same business with 8,000 people in Kentucky: Not triggered by these answers.
- A US business with no users in Kentucky: Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | Sections 1 to 10 of the Act apply to persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents and that meet the stated consumer-count or revenue thresholds.Official wording(1) Sections 1 to 10 of this Act apply to persons that conduct business in the 4 Commonwealth or produce products or services that are targeted to residents of 5 the Commonwealth and that during a calendar year control or process personal 6 data of at least: | apps.legislature.ky.gov read 2026-10-06 |
| When it applies to a business | Applies to persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents and that during a calendar year control or process personal data of at least 100,000 consumers, or at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data. Conditions to check: Business must conduct business in Kentucky or produce products or services targeted to Kentucky residents. Section 2(2) exempts cities, state agencies and political subdivisions, financial institutions and their affiliates or GLBA data, HIPAA covered entities and business associates, nonprofit organizations (defined narrowly in the Act as entities operating for religious, charitable, or educational purposes that provide no net earnings to officers, employees or shareholders, so not every nonprofit), institutions of higher education, and certain insurance-fraud organizations, small telephone utilities and others. Other data exemptions (health data, employee data) exist in the same section. Official wording(a) One hundred thousand (100,000) consumers; or 8 (b) Twenty-five thousand (25,000) consumers and derive over fifty percent 9 (50%) of gross revenue from the sale of personal data. | apps.legislature.ky.gov read 2026-10-06 |
| In force from | 2026-01-01 Section 12 of the Act: the Act takes effect January 1, 2026. Official wordingSection 12. This Act takes effect January 1, 2026. | apps.legislature.ky.gov read 2026-10-06 |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Not stated on the official pages we read. the text we read contains no provision requiring a data protection or privacy officer | — |
| Breach notification | Not stated on the official pages we read. separate breach-notification statute not read | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here