Kentucky Is Next State To Enact Comprehensive Privacy Law

On April 4, 2024, Kentucky's Governor signed the Kentucky Consumer Data Protection Act (the “Act”) making Kentucky the latest state to join the trend of states enacting a comprehensive privacy law. The Act will take effect on January 1, 2026 and is substantially similar to other state comprehensive privacy laws, including in particular, the Virginia Consumer Data Protection Act.

Applicability

The Act applies to persons or entities conducting business in Kentucky or producing products or services that are targeted to residents of Kentucky and that during a calendar year either:

1. control or process the personal data of at least 100,000 consumers; or
2. control or process the personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.