---
jurisdiction: "Kentucky"
slug: kentucky
countryCode: US
snapshotAsOf: "2026-06-12"
lastReviewed: "2026-06-06"
canonicalUrl: https://openagreements.org/legal/privacy/kentucky
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/legal/privacy/kentucky · **Snapshot as of:** 2026-06-12 · License: CC BY 4.0 · © UseJunior

# Kentucky Consumer Privacy Law (KCDPA)[^about]

The Kentucky Consumer Data Protection Act, effective January 1, 2026, gives Kentucky consumers rights over their personal data and imposes notice, contracting, and consent duties on controllers above defined thresholds — closely modeled on Virginia, it is enforced exclusively by the Attorney General with a permanent 30-day cure period and provides no private right of action.


## At a glance

| Question | Kentucky |
| --- | --- |
| **Summary** | If you meet the 100,000-consumer (or 25,000 plus majority-data-sale) threshold in Kentucky, the KCDPA requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Attorney General with a permanent 30-day cure period and no consumer lawsuits. |
| **Main law** | KRS 367.3611 to 367.3629 (Kentucky Consumer Data Protection Act), effective January 1, 2026 |
| **Privacy policy required?** | Yes — a reasonably accessible, clear, and meaningful notice with statutorily fixed contents |
| **Who does it cover?** | Persons doing business in Kentucky (or targeting residents) that control or process the data of 100,000+ consumers a year, or 25,000+ while deriving over 50% of gross revenue from selling data — no revenue floor; nonprofits and higher-education institutions exempt |
| **Can consumers sue?** | No — enforcement is exclusively the Attorney General's |
| **Who enforces it?** | Kentucky Attorney General (exclusive) |

## Does the Kentucky Consumer Data Protection Act apply to your business? {#does-kcdpa-apply}

**Short answer.** It turns on consumer volume, not revenue. The KCDPA applies to persons that do business in Kentucky or target its residents and that, in a calendar year, control or process the personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data [^stat-3613-apply].

Kentucky's law took effect January 1, 2026, later than most of the early movers, and it is closely patterned on Virginia — so this note reads much like Virginia, Colorado, Connecticut, and Texas. Like those, it sets no dollar revenue floor; it also exempts nonprofit organizations and institutions of higher education, along with state and local government and GLBA-, HIPAA-, and FCRA-regulated data. A consumer is a Kentucky resident acting only in an individual context, not an employee or business contact.

## What must your Kentucky privacy policy contain? {#privacy-policy-contents}

**Short answer.** A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose for processing, how consumers exercise their rights (including how to appeal), the categories of personal data shared with third parties, and the categories of those third parties [^stat-3617-notice].

For a template privacy policy, KRS 367.3617 is the content checklist. Kentucky also requires data minimization (collection limited to what is adequate, relevant, and reasonably necessary) and, where a controller sells personal data or processes it for targeted advertising, a clear and conspicuous disclosure of that activity and how to opt out. The notice the policy presents should match the data practices the controller actually carries out.

## What must your contracts with processors say? {#vendor-contracts}

**Short answer.** A contract between a controller and a processor must govern the processor's data processing on the controller's behalf — so a data processing agreement is a statutory requirement, not a best practice [^stat-3619-contract].

KRS 367.3619 then specifies the required terms: processing instructions, the nature and purpose of processing, the type of data and duration, a duty of confidentiality, deletion or return of data at the controller's direction, the information needed to demonstrate compliance, cooperation with reasonable assessments, and a requirement to bind subcontractors by written contract to the same obligations. A compliant template DPA tracks each of these.

## Do you need consent to process sensitive data? {#sensitive-data}

**Short answer.** Yes. A controller may not process a consumer's sensitive data without first obtaining consent, and for a known child it must instead follow the federal Children's Online Privacy Protection Act [^stat-3617-consent]. Sensitive data includes data indicating race or ethnicity, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify a person; data from a known child; and precise geolocation.

This is the opt-in model shared by Virginia, California, Colorado, and Texas — the opposite of Utah's notice-and-opt-out approach. Kentucky does not, however, require honoring a universal opt-out preference signal the way California, Colorado, and Connecticut do, so a Kentucky-only program can rely on its own opt-out mechanisms — though a multi-state template generally has to support universal signals to stay compliant elsewhere.

## Can a consumer sue your business under the KCDPA? {#consumer-lawsuit}

**Short answer.** No. The Attorney General has exclusive authority to enforce the KCDPA [^stat-3627-enforce], so there is no private right of action for consumers [^stat-3627-no-pra]. Before suing, the Attorney General must give 30 days' written notice of the specific alleged violations and a chance to cure [^stat-3627-cure].

Like Virginia, and unlike Colorado and Connecticut, Kentucky's 30-day cure period has not sunset — it remains a permanent, built-in off-ramp. A controller that cures within the window and certifies it in writing avoids the action; an uncured violation exposes it to damages of up to $7,500 per continued violation, plus the Attorney General's expenses and costs. The practical posture is still to build the notice, consent, and contracting controls up front, but a covered business that receives a notice has a genuine window to fix the issue.

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org) · Maintained by [UseJunior](https://usejunior.com). Last reviewed 2026-06-06. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Kentucky. This article synthesizes Kentucky primary law and is not legal advice from a Kentucky-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.

[^stat-3613-apply]: **KRS 367.3613** — "KRS 367.3611 to 367.3629 apply to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers; or (b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data." *KRS 367.3613(1).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648>

[^stat-3617-notice]: **KRS 367.3617** — "reasonably accessible, clear, and meaningful privacy notice that includes: (a) The categories of personal data processed by the controller; (b) The purpose for processing personal data;" *KRS 367.3617(3).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839>

[^stat-3619-contract]: **KRS 367.3619** — "A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller." *KRS 367.3619(2).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55840>

[^stat-3617-consent]: **KRS 367.3617** — "Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data collected from a known child, process the data in accordance with the federal Children's Online Privacy Protection Act, 15 U.S.C. sec. 6501 et seq." *KRS 367.3617(1)(e).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839>

[^stat-3627-enforce]: **KRS 367.3627** — "The Attorney General shall have exclusive authority to enforce violations of KRS 367.3611 to 367.3629." *KRS 367.3627(1).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844>

[^stat-3627-no-pra]: **KRS 367.3627** — "Nothing in KRS 367.3611 to 367.3629 or any other law, regulation, or the equivalent shall be construed as providing the basis for, or give rise to, a private right of action for violations of KRS 367.3611 to 367.3629." *KRS 367.3627(4).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844>

[^stat-3627-cure]: **KRS 367.3627** — "the Attorney General shall provide a controller or processor thirty (30) days' written notice identifying the specific provisions of KRS 367.3611 to 367.3629, the Attorney General alleges have been or are being violated." *KRS 367.3627(2).* <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844>
