Kentucky Consumer Data Protection Act Signed Into Law

On April 4, 2024, Kentucky Governor Andy Beshear signed the Kentucky Consumer Data Protection Act (the "KCDPA" or "Act"), which takes effect January 1, 2026. The KCDPA maps in large part to the Virginia Consumer Data Protection Act. Of note, the Act does not require controllers to enable opt-outs through universal opt-out mechanisms, and the Act's provision allowing 30 days to cure alleged violations will not sunset.

We highlight additional key aspects of the Act below.

Application Thresholds

The KCDPA applies to persons who conduct business in Kentucky or produce products or services that are targeted to residents of Kentucky and who during a calendar year either: (1) control or process personal data of at least 100,000 consumers; or (2) process the personal data of 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.