State assemblies are far from finished when it comes to passing privacy legislation. In March 2024, Kentucky became the 16th state to create its own comprehensive privacy law (if you count Florida's very narrow law).
The Kentucky Consumer Data Privacy Act (KCDPA) takes a cautious approach to privacy regulation, largely copying and pasting provisions from the Virginia Consumer Data Protection Act (prior to that law's amendments regarding minors’ data).
Here are the KCDPA's major features and how it could affect businesses.
The Kentucky privacy law goes into effect on January 1, 2026.
The Kentucky Consumer Data Privacy Act applies to any person or organization that does business in the state of Kentucky or targets its products or services toward state residents, and meets at least one of the following requirements:
The KCDPA has many of the same exemptions as other laws, including for government bodies and entities already regulated by federal laws such as the GLBA or HIPAA. It has also a new exemption for data covered by the federal Combat Methamphetamine Epidemic Act.
The KCDPA gives consumers the following rights.
Unlike many of the more recent state privacy laws, the KCDPA has no provisions requiring the recognition of universal opt-out mechanisms (UOOMs), such as Global Privacy Control, on their websites.
Personal data is “any information that is linked or reasonably linkable to an identified or identifiable individual.” Deidentified data or publicly available information is excluded from this definition.
Personal data is more than just names and email addresses, though, and can cover anything from IP addresses to internet cookies to shopping habits.
The KCDPA requires organizations to perform data protection assessments for certain types of processing activities that present a “heightened risk of harm” to consumers. This includes:
The statute provides for damages of up to $7,500 per violation. The Attorney General's Office must give businesses 30 days to cure any alleged violations.
The KCDPA does not grant a private right of action to consumers, meaning they cannot sue an organization over violations. Only the Kentucky Attorney General’s Office has authority to enforce the law.
The pace of state privacy legislation is picking up, with many more states likely to pass their own laws in the near future. With each new law, compliance becomes a little more complicated to manage, especially for businesses without in-house privacy experts.
TrueVault US helps businesses of all sizes get compliant with privacy laws from across the country with one streamlined platform. Built by attorneys, TrueVault US is a software solution that guides you at every step of the way, from onboarding vendors to responding to consumer privacy requests.
To learn more about how TrueVault US can help your business, contact our team today.
Disclaimer: This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.
Our attorney-designed software will step-by-step guide you through the compliance process from start to finish.
Request a Demo201 Mission Street, 12th Floor
San Francisco, CA 94105
Email: hello@truevault.com
2022 © All Rights Reserved. Privacy Policy | Terms of Use | California Privacy Notice