State Privacy Laws: Kentucky

Overview

The Kentucky Consumer Data Protection Act (KCDPA) establishes consumer privacy rights for Kentucky residents and sets compliance obligations for businesses that meet certain processing thresholds. Similar to other comprehensive state privacy laws, the KCDPA applies to personal data collected in an individual or household context and does not extend to employment-related or business-to-business data.

Key Dates

• Signed into law: April 4, 2024
• Effective date: January 1, 2026

Thresholds

The KCDPA applies to “controllers,” defined to mean persons or businesses that:

• control or process personal data of at least 100,000 Kentucky consumers; or
• control or process personal data of at least 25,000 Kentucky consumers and derive over 50% of their gross revenue from the sale of personal data.

Consumer Rights

• The right to confirm whether certain businesses collecting personal data (“controllers”) are processing their personal data.
• The right to access their collected personal data (without revealing trade secrets).
• The right to correct inaccuracies in their personal data.
• The right to delete their personal data.
• The right to obtain a portable copy of their personal data to the extent feasible (without revealing trade secrets).
• The right to opt out of processing of their personal data for the purposes of targeted advertising, the sale of their personal data, or profiling.
• The right to protect their sensitive data from processing without their personal consent.

Sensitive Data

The law defines sensitive data to include personal data revealing:

• Racial or ethnic origin
• Religious beliefs
• A mental or physical health condition or diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data used for personal identification
• Personal data of a known child
• Precise geolocation data

Penalties

Up to $7,500 per violation.

Configure Your Consent Banner for KCDPA

Regions are used to customize the behavior and experience based on an individual user’s location. As an example, this allows you to provide different experiences to users based on regional differences (like GDPR in the EU vs. KCDPA in Kentucky). When a user visits your site, we will automatically determine their location and will match them to the most granular region rule that you have setup in Concord. This can go down to the state/province level, which allows for different experiences for different laws (like KCDPA in Kentucky).

Recommended Consent Settings

Based on the current laws, we recommend the following regional settings:

• Consent Mode: Implied
• Blocking Mode: Strict
• Google Consent Mode V2: Basic
• Consent Duration: 12 months
• Enable Limit Sensitive Information: Enabled
• Enable Do Not Sell Consent: Enabled
• Enable Global Privacy Control: Enabled

For step-by-step instruction on how to configure your consent banner for different geographical regions within the Concord app, see our help document Configure Your Consent Banner for Different Geographical Regions.