---
jurisdiction: "Kansas"
slug: kansas
countryCode: US
snapshotAsOf: "2026-06-12"
lastReviewed: "2026-06-11"
canonicalUrl: https://openagreements.org/legal/privacy/kansas
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/legal/privacy/kansas · **Snapshot as of:** 2026-06-12 · License: CC BY 4.0 · © UseJunior

# Kansas Consumer Privacy Law[^about]

Kansas has no comprehensive consumer-privacy statute. The operative framework is the 2006 data-breach notification law (K.S.A. 50-7a01 and 50-7a02) plus the Kansas Consumer Protection Act, with a federal and sectoral overlay supplying the rest of a privacy program.


## At a glance

| Question | Kansas |
| --- | --- |
| **Summary** | Kansas has not enacted a comprehensive consumer-privacy law, so there are no general data-rights, notice-at-collection, consent, or processor-contract duties under state law. The operative statutes are the 2006 data-breach notification law — a twice-gated, identity-theft-keyed notice duty with no fixed day-count — and the Kansas Consumer Protection Act, whose deception and unconscionability rules are what make a published privacy policy enforceable against the business that wrote it. Everything else rides the federal and sectoral overlay, so build to FTC Act § 5, GLBA, HIPAA, and COPPA and the program will be easier to adapt if Kansas later enacts an omnibus law. |
| **Main law** | Kansas data-breach notification statute, K.S.A. 50-7a01 and 50-7a02, plus the Kansas Consumer Protection Act, K.S.A. 50-623 et seq. — Kansas has no comprehensive consumer-privacy law |
| **Privacy policy required?** | No Kansas statute mandates a consumer privacy policy or fixes its contents; a policy that misstates actual practices is reachable as a deceptive act under the KCPA and FTC Act § 5, and GLBA, HIPAA, and COPPA supply notice duties where they apply |
| **Who does it cover?** | The breach statute reaches any person that conducts business in Kansas and owns or licenses computerized personal information of Kansas residents; the KCPA reaches any supplier in consumer transactions — no revenue or consumer-volume thresholds |
| **Can consumers sue?** | The breach statute creates no express private remedy; the KCPA gives an aggrieved consumer an individual action for damages or a civil penalty, whichever is greater, with damages class actions sharply limited |
| **Who enforces it?** | Kansas Attorney General (the insurance commissioner has sole authority over breach violations by licensed insurers) |

## Which privacy laws apply to your business in Kansas? {#which-privacy-laws-apply}

**Short answer.** There is no comprehensive Kansas consumer-privacy law. The operative state framework is two-part: the 2006 data-breach notification statute, which applies to any person that conducts business in Kansas — or any government unit — that owns or licenses computerized data including personal information [^stat-7a02-scope], and the Kansas Consumer Protection Act (KCPA), which is construed liberally to protect consumers from suppliers who commit deceptive and unconscionable practices [^stat-623-purpose]. Neither statute carries a revenue or consumer-volume threshold.

Because there is no omnibus statute, Kansas residents have no general state-law rights to access, delete, correct, or port their personal data, no right to opt out of sale or targeted advertising, and no recognized universal opt-out signal; businesses face no state notice-at-collection, consent, data-protection-assessment, or processor-contract duties. The KCPA's scope definitions decide who is exposed to the rules that do exist. A consumer is unusually broad for a consumer-protection statute — it includes an individual, husband and wife, sole proprietor, or family partnership acting for personal, family, household, business, or agricultural purposes [^stat-624-consumer] — while corporations and LLCs fall outside it. A supplier is anyone who, in the ordinary course of business, solicits, engages in, or enforces consumer transactions, whether or not dealing directly with the consumer [^stat-624-supplier]. And a consumer transaction is a disposition of property or services for value within Kansas — expressly excluding insurance contracts regulated under state law [^stat-624-transaction].

A handful of narrower Kansas and federal sectoral laws may still apply depending on the business model and data involved. The rest of a Kansas-facing privacy program rides the federal overlay: FTC Act § 5 reaches deceptive or unfair privacy practices, GLBA governs financial institutions, HIPAA governs covered health entities, and COPPA governs services directed to children under 13.

A failed 2026 app-store privacy measure is a watch item, but it creates no current Kansas obligations. Similar app-store or minor-safety language could be reintroduced in a later session.

## What must your Kansas privacy policy contain? {#privacy-policy-contents}

**Short answer.** No Kansas statute requires a general consumer privacy policy or fixes what it must say. The constraint that does the work is truthfulness. The KCPA forbids a supplier from engaging in any deceptive act or practice in connection with a consumer transaction [^stat-626-deceptive], and its enumerated deceptive acts include the willful use of falsehood or ambiguity as to a material fact and the willful failure to state — or the willful concealment of — a material fact [^stat-626-omission]. A published privacy policy the business does not follow is the natural target of those rules, and the same conduct is independently a deceptive practice under Section 5 of the FTC Act [^fed-ftc5-deceptive].

In practice the Kansas drafting question is not what must be included but does the policy match actual practice. Beyond deception, the KCPA separately bans unconscionable acts and practices, and it reaches conduct before, during, or after the transaction [^stat-627-unconscionable] — one-sided data practices buried in terms the consumer cannot reasonably protect against are the privacy-flavored fit. Use the KCPA text as the state-law check rather than assuming Kansas has a privacy-policy template.

Where a sectoral regime applies, that regime supplies the contents instead. A financial institution may not share nonpublic personal information with nonaffiliated third parties unless it has first given the consumer a GLBA-compliant privacy notice [^fed-glba-notice]. A HIPAA covered entity must give individuals a notice of the uses and disclosures of their protected health information and of their rights and the entity's duties [^fed-hipaa-notice]. COPPA prohibits an operator of a website or online service directed to children under 13 from collecting children's personal information in violation of the FTC's notice and parental-consent regulations [^fed-coppa-notice]. For everyone else, follow best practice — describe the categories of data collected, the purposes, the third parties you share with, and how users exercise any choices you offer — and then honor it, because in Kansas the enforceable obligation is consistency between the statement and the conduct. For any Kansas business selling beyond the state, other states' comprehensive privacy laws are the practical driver of what the policy ends up containing.

## What must your contracts with vendors say? {#vendor-contracts}

**Short answer.** Kansas imposes no general data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for ordinary commercial contracts. The one Kansas vendor duty is breach-notice flow-up: an entity that maintains computerized personal information it does not own or license must notify the owner or licensee of the information after discovering a breach, if the personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person [^stat-7a02-vendor-notice].

That flow-up duty is worth writing into the contract anyway: the statute does not set a deadline for the vendor's notice to you, so a well-drafted agreement converts the statutory duty into a fixed notification window with cooperation obligations, since it is your business — as the data owner — that then carries the consumer-notice duty to Kansas residents. Where a federal or sectoral regime is in scope, it supplies the rest of the contracting obligations. The GLBA Safeguards Rule requires financial institutions to oversee service providers — selecting providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically reassessing the providers [^fed-glba-safeguards]. HIPAA requires a written business-associate contract establishing the permitted uses and disclosures of protected health information before a covered entity shares it [^fed-hipaa-baa].

Outside those verticals, carry the same protections forward as best practice even though no Kansas statute compels them: processing limited to documented instructions, confidentiality, reasonable security, breach notification back to your business on a contractual clock, and return or deletion of data at the end of the engagement.

## When must you notify people of a data breach in Kansas? {#breach-notification}

**Short answer.** After a two-step determination, and then quickly but with no fixed day-count. When a business becomes aware of a security breach it must conduct a good-faith, reasonable, and prompt investigation into the likelihood that personal information has been or will be misused; if the investigation determines that misuse has occurred or is reasonably likely to occur, it must notify the affected Kansas residents as soon as possible, in the most expedient time possible and without unreasonable delay [^stat-7a02-notice-trigger]. The duty is also gated at the definition: a security breach means the unauthorized access and acquisition of unencrypted or unredacted computerized data that compromises personal information and that causes — or that the business reasonably believes has caused or will cause — identity theft to a Kansas consumer [^stat-7a01-breach-def]. If notice goes to more than 1,000 consumers at one time, the business must also notify the nationwide consumer reporting agencies without unreasonable delay [^stat-7a02-cra].

Kansas's trigger is unusually narrow — twice gated. Most states key the notice duty to acquisition of personal information alone; Kansas requires both access and acquisition, ties the very existence of a breach to actual or reasonably believed identity theft, and then adds the misuse-investigation gate on top. The conservative operational posture is to run the investigation promptly and document the misuse determination either way, because the statute gives no safe harbor for guessing wrong. The data elements are also a short list: personal information means a consumer's first name or first initial and last name linked to an unencrypted, unredacted Social Security number, driver's license or state ID number, or financial-account or payment-card number with any code permitting account access [^stat-7a01-pi-def] — no medical, biometric, or online-credential elements, and encryption or redaction takes the data out of scope entirely.

The mechanics are flexible by national standards. Notice may be written or electronic, and substitute notice is allowed where the cost of notice would exceed $100,000, the affected class exceeds 5,000 consumers, or the business lacks sufficient contact information [^stat-7a01-substitute]; when used, substitute notice means email where available, conspicuous website posting, and notification to major statewide media [^stat-7a01-substitute-methods]. Notice may be delayed at a law-enforcement agency's request if the agency determines that notice will impede a criminal investigation [^stat-7a02-law-delay]. Notably, the statute requires no notification to the Kansas Attorney General at any threshold — an outlier among state breach laws — so the only regulator-adjacent notice is the consumer-reporting-agency duty above. Two compliance safe harbors close the loop: a business that follows its own consistent notification procedures under an information-security policy is deemed compliant, and so is a regulated entity that follows the breach procedures of its primary or functional state or federal regulator [^stat-7a02-safe-harbors] — though for licensed insurers, enforcement of this section belongs solely to the insurance commissioner rather than the Attorney General.

## Can a consumer sue your business in Kansas over privacy? {#consumer-lawsuit}

**Short answer.** It depends on the statute. The breach-notification law creates no express private remedy — it empowers the Attorney General to bring an action in law or equity, while providing that the section is not exclusive and does not relieve a business from complying with all other applicable law [^stat-7a02-ag-action]. The KCPA, by contrast, carries a real private right of action: an aggrieved consumer may recover, in an individual action but not in a class action, damages or a civil penalty, whichever is greater [^stat-634-individual].

The KCPA's class-action architecture is the detail that shapes real exposure. Consumers may bring a class action for declaratory or injunctive relief and ancillary remedies — but not damages — against any violating practice [^stat-634-class-injunctive]. A damages class action is available only in a narrower band: where the act or practice violates the specifically proscribed deceptive, unconscionable, or door-to-door provisions, was declared unlawful by a published final judgment ten days before the transactions at issue, or was prohibited by a prior consent judgment binding the supplier [^stat-634-class-damages]. Because the deceptive-acts and unconscionable-acts sections are within that per-se band, a privacy-policy misrepresentation theory could in principle support a damages class; the exposure is structural rather than established. The KCPA also has two-way fee-shifting: a prevailing consumer can recover reasonable attorney fees where the supplier committed a violation, and a supplier can recover fees where the consumer maintained a groundless action.

Whether a breach-notification failure could itself be repackaged as a private KCPA claim is an open question — the breach statute names only public enforcers, but its non-exclusivity sentence preserves other law. One scope question to keep in view for online services: the KCPA hinges on a consumer transaction, defined as a disposition of property or services for value within Kansas [^q5-stat-624-transaction]. That makes no-cash, ad-supported services a harder fit than paid services.

## Who enforces Kansas privacy law, and what are the penalties? {#enforcement-penalties}

**Short answer.** The Kansas Attorney General, with one carve-out: for breach-notification violations by an insurance company licensed in Kansas, the insurance commissioner has the sole enforcement authority [^stat-7a02-enforcement-split]. Under the KCPA, any violation exposes the business to a civil penalty of up to $10,000 per violation, recoverable by the aggrieved consumer, the Attorney General, or a county or district attorney [^stat-636-penalty] — and a continuing practice not tied to a specific transaction counts as a separate violation each day it exists [^stat-636-daily].

The penalty mechanics reward early correction. A supplier that willfully violates a court order issued under the KCPA forfeits up to $20,000 per violation on top of other penalties [^stat-636-willful], and the per-day accrual rule means a non-compliant practice left running — an inaccurate privacy policy, an undisclosed data practice — compounds rather than sits still. The KCPA has no pre-suit cure period: there is no statutory notice-and-cure mechanism a business can invoke before the Attorney General or a consumer files. The breach statute, for its part, sets no civil-penalty schedule at all — the Attorney General proceeds in law or equity for whatever relief is appropriate, which in practice means injunctions, consent terms, and equitable monetary relief shaped case by case.

Enforcement posture follows the statutes rather than a standalone privacy agency. County and district attorneys share KCPA enforcement, with recovered penalties flowing to the county where the proceedings were brought. For licensed insurers, the commissioner's exclusive breach-enforcement lane is the Kansas-specific privacy enforcement rule to build into incident-response routing.

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org) · Maintained by [UseJunior](https://usejunior.com). Last reviewed 2026-06-11. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Kansas. This article synthesizes Kansas primary law and is not legal advice from a Kansas-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.

[^stat-7a02-scope]: **K.S.A. 50-7a02** — "A person that conducts business in this state, or a government, governmental subdivision or agency that owns or licenses computerized data that includes personal information shall, when it becomes aware of any breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused." *K.S.A. 50-7a02(a).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-623-purpose]: **K.S.A. 50-623** — "This act shall be construed liberally to promote the following policies: (a) To simplify, clarify and modernize the law governing consumer transactions; (b) to protect consumers from suppliers who commit deceptive and unconscionable practices;" *K.S.A. 50-623.* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0023.html>

[^stat-624-consumer]: **K.S.A. 50-624 (consumer)** — "‘Consumer’ means an individual, husband and wife, sole proprietor, or family partnership who seeks or acquires property or services for personal, family, household, business or agricultural purposes." *K.S.A. 50-624(b).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0024.html>

[^stat-624-supplier]: **K.S.A. 50-624 (supplier)** — "‘Supplier’ means a manufacturer, distributor, dealer, seller, lessor, assignor, or other person who, in the ordinary course of business, solicits, engages in or enforces consumer transactions, whether or not dealing directly with the consumer." *K.S.A. 50-624(l).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0024.html>

[^stat-624-transaction]: **K.S.A. 50-624 (consumer transaction)** — "‘Consumer transaction’ means a sale, lease, assignment or other disposition for value of property or services within this state, except insurance contracts regulated under state law, to a consumer; or a solicitation by a supplier with respect to any of these dispositions." *K.S.A. 50-624(c).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0024.html>

[^stat-626-deceptive]: **K.S.A. 50-626** — "No supplier shall engage in any deceptive act or practice in connection with a consumer transaction." *K.S.A. 50-626(a).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0026.html>

[^stat-626-omission]: **K.S.A. 50-626(b)** — "(2) the willful use, in any oral or written representation, of exaggeration, falsehood, innuendo or ambiguity as to a material fact; (3) the willful failure to state a material fact, or the willful concealment, suppression or omission of a material fact;" *K.S.A. 50-626(b)(2)–(3).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0026.html>

[^fed-ftc5-deceptive]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>

[^stat-627-unconscionable]: **K.S.A. 50-627** — "No supplier shall engage in any unconscionable act or practice in connection with a consumer transaction. An unconscionable act or practice violates this act whether it occurs before, during or after the transaction." *K.S.A. 50-627(a).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0027.html>

[^fed-glba-notice]: **GLBA privacy notice** — "Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title." *15 U.S.C. § 6802(a).* <https://www.law.cornell.edu/uscode/text/15/6802#:~:text=Except%20as%20otherwise%20provided%20in,section%206803%20of%20this%20title.>

[^fed-hipaa-notice]: **HIPAA Notice of Privacy Practices** — "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information" *45 C.F.R. § 164.520(a)(1).* <https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information>

[^fed-coppa-notice]: **COPPA** — "It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b)." *15 U.S.C. § 6502(a)(1).* <https://www.law.cornell.edu/uscode/text/15/6502#:~:text=It%20is%20unlawful%20for%20an,regulations%20prescribed%20under%20subsection%20(b).>

[^stat-7a02-vendor-notice]: **K.S.A. 50-7a02(b)** — "An individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the data following discovery of a breach, if the personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person." *K.S.A. 50-7a02(b).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^fed-glba-safeguards]: **GLBA Safeguards Rule** — "Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) Requiring your service providers by contract to implement and maintain such safeguards; and (3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards." *16 C.F.R. § 314.4(f).* <https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Oversee%20service%20providers%2C%20by%3A%20(1),continued%20adequacy%20of%20their%20safeguards.>

[^fed-hipaa-baa]: **HIPAA Business Associate Contracts** — "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate." *45 C.F.R. § 164.504(e)(2).* <https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,information%20by%20the%20business%20associate.>

[^stat-7a02-notice-trigger]: **K.S.A. 50-7a02(a)** — "If the investigation determines that the misuse of information has occurred or is reasonably likely to occur, the person or government, governmental subdivision or agency shall give notice as soon as possible to the affected Kansas resident. Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system." *K.S.A. 50-7a02(a).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-7a01-breach-def]: **K.S.A. 50-7a01(h)** — "‘Security breach’ means the unauthorized access and acquisition of unencrypted or unredacted computerized data that compromises the security, confidentiality or integrity of personal information maintained by an individual or a commercial entity and that causes, or such individual or entity reasonably believes has caused or will cause, identity theft to any consumer." *K.S.A. 50-7a01(h).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html>

[^stat-7a02-cra]: **K.S.A. 50-7a02(f)** — "In the event that a person discovers circumstances requiring notification pursuant to this section of more than 1,000 consumers at one time, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. § 1681a(p), of the timing, distribution and content of the notices." *K.S.A. 50-7a02(f).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-7a01-pi-def]: **K.S.A. 50-7a01(g)** — "‘Personal information’ means a consumer's first name or first initial and last name linked to any one or more of the following data elements that relate to the consumer, when the data elements are neither encrypted nor redacted: (1) Social security number; (2) driver's license number or state identification card number; or (3) financial account number, or credit or debit card number, alone or in combination with any required security code, access code or password that would permit access to a consumer's financial account." *K.S.A. 50-7a01(g).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html>

[^stat-7a01-substitute]: **K.S.A. 50-7a01(c)** — "substitute notice, if the individual or the commercial entity required to provide notice demonstrates that the cost of providing notice will exceed $100,000, or that the affected class of consumers to be notified exceeds 5,000, or that the individual or the commercial entity does not have sufficient contact information to provide notice." *K.S.A. 50-7a01(c)(3).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html>

[^stat-7a01-substitute-methods]: **K.S.A. 50-7a01(e)** — "‘Substitute notice’ means: (1) E-mail notice if the individual or the commercial entity has e-mail addresses for the affected class of consumers; (2) conspicuous posting of the notice on the web site page of the individual or the commercial entity if the individual or the commercial entity maintains a web site; and (3) notification to major statewide media." *K.S.A. 50-7a01(e).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html>

[^stat-7a02-law-delay]: **K.S.A. 50-7a02(c)** — "Notice required by this section may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation. Notice required by this section shall be made in good faith, without unreasonable delay and as soon as possible after the law enforcement agency determines that notification will no longer impede the investigation." *K.S.A. 50-7a02(c).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-7a02-safe-harbors]: **K.S.A. 50-7a02(d)–(e)** — "Notwithstanding any other provision in this section, an individual or a commercial entity that maintains its own notification procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of this section, is deemed to be in compliance with the notice requirements of this section if the individual or the commercial entity notifies affected consumers in accordance with its policies in the event of a breach of security of the system. (e) An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this section." *K.S.A. 50-7a02(d)–(e).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-7a02-ag-action]: **K.S.A. 50-7a02(g)** — "For violations of this section, except as to insurance companies licensed to do business in this state, the attorney general is empowered to bring an action in law or equity to address violations of this section and for other relief that may be appropriate. The provisions of this section are not exclusive and do not relieve an individual or a commercial entity subject to this section from compliance with all other applicable provisions of law." *K.S.A. 50-7a02(g).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-634-individual]: **K.S.A. 50-634(b)** — "A consumer who is aggrieved by a violation of this act may recover, but not in a class action, damages or a civil penalty as provided in subsection (a) of K.S.A. 50-636 and amendments thereto, whichever is greater." *K.S.A. 50-634(b).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0034.html>

[^stat-634-class-injunctive]: **K.S.A. 50-634(c)** — "Whether a consumer seeks or is entitled to recover damages or has an adequate remedy at law, a consumer may bring a class action for declaratory judgment, an injunction and appropriate ancillary relief, except damages, against an act or practice that violates this act." *K.S.A. 50-634(c).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0034.html>

[^stat-634-class-damages]: **K.S.A. 50-634(d)** — "A consumer who suffers loss as a result of a violation of this act may bring a class action for the damages caused by an act or practice: (1) Violating any of the acts or practices specifically proscribed in K.S.A. 50-626, 50-627 and 50-640, and amendments thereto, or (2) declared to violate K.S.A. 50-626 or 50-627, and amendments thereto, by a final judgment of any district court or the supreme court of this state that was either officially reported or made available for public dissemination under subsection (a)(3) of K.S.A. 50-630 and amendments thereto by the attorney general 10 days before the consumer transactions on which the action is based, or (3) with respect to a supplier who agreed to it, was prohibited specifically by the terms of a consent judgment which became final before the consumer transactions on which the action is based." *K.S.A. 50-634(d).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0034.html>

[^q5-stat-624-transaction]: **K.S.A. 50-624 (consumer transaction)** — "‘Consumer transaction’ means a sale, lease, assignment or other disposition for value of property or services within this state, except insurance contracts regulated under state law, to a consumer; or a solicitation by a supplier with respect to any of these dispositions." *K.S.A. 50-624(c).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0024.html>

[^stat-7a02-enforcement-split]: **K.S.A. 50-7a02(g)–(h)** — "For violations of this section, except as to insurance companies licensed to do business in this state, the attorney general is empowered to bring an action in law or equity to address violations of this section and for other relief that may be appropriate. The provisions of this section are not exclusive and do not relieve an individual or a commercial entity subject to this section from compliance with all other applicable provisions of law. (h) For violations of this section by an insurance company licensed to do business in this state, the insurance commissioner shall have the sole authority to enforce the provisions of this section." *K.S.A. 50-7a02(g)–(h).* <https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html>

[^stat-636-penalty]: **K.S.A. 50-636(a)** — "The commission of any act or practice declared to be a violation of this act shall render the violator liable to the aggrieved consumer, or the state or a county as provided in subsection (c), for the payment of a civil penalty, recoverable in an individual action, including an action brought by the attorney general or county attorney or district attorney, in a sum set by the court of not more than $10,000 for each violation." *K.S.A. 50-636(a).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0036.html>

[^stat-636-daily]: **K.S.A. 50-636(d)** — "Any act or practice declared to be a violation of this act not identified to be in connection with a specific identifiable consumer transaction but which is continuing in nature shall be deemed a separate violation each day such act or practice exists." *K.S.A. 50-636(d).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0036.html>

[^stat-636-willful]: **K.S.A. 50-636(b)** — "Any supplier who willfully violates the terms of any court order issued pursuant to this act shall forfeit and pay a civil penalty of not more than $20,000 per violation, in addition to other penalties that may be imposed by the court, as the court shall deem necessary and proper." *K.S.A. 50-636(b).* <https://ksrevisor.gov/statutes/chapters/ch50/050_006_0036.html>
