Kentucky Data Removal Guide (2026)
Kentucky's Consumer Data Protection Act took effect January 2026. It provides covered consumers with access, correction, deletion, portability, and opt-out rights, subject to statutory definitions and exemptions.
Research status: published state guide pending fresh official-source re-verification.
This page is educational orientation, not legal advice. Scope, exemptions, deadlines, penalties, regulator powers and broker routes can change. Verify the current statute and state regulator guidance before relying on a right or deadline.
At a glance
- Comprehensive state privacy law
- Recorded: KCDPA
- Broker response deadline
- 45 days in this research snapshot for qualifying requests; extensions and exemptions may apply
- Enforcement
- Kentucky Office of the Attorney General
Kentucky Consumer Data Protection Act (KCDPA)
KCDPA applies to persons doing business in Kentucky or targeting Kentucky residents that meet either the 100,000-consumer branch or the 25,000-consumer-plus-more-than-50%-sale-revenue branch, subject to exemptions. Rights include access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and certain profiling. Controllers generally respond within 45 days, with a possible 45-day extension, and decide appeals within 60 days. The Attorney General has exclusive enforcement authority and must provide 30 days' written notice before an action; continued violations can carry damages up to $7,500 each. There is no private right of action.
Read the full KCDPAexplainer →Scope, thresholds, exceptions, cure rules, and enforcement details where documented.
What rights do Kentucky residents have?
- →Access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling
- →45-day response, possible 45-day extension, and 60-day appeal decision
- →AG enforcement only; no private right of action
Where does your data leak from in Kentucky?
The FTC explains that people-search sites may combine public records, public social profiles, and information from other brokers. The examples below are a research snapshot, not an exhaustive or person-specific source map for Kentucky:
- Kentucky CourtNet
- Jefferson, Fayette County property records
- Kentucky Transportation Cabinet driver records
Generate requests in under 60 seconds
Generate requests for 1009 US/global broker workflows for $9
What if a broker ignores your request?
If a qualifying request does not receive a response within the applicable window, review the current extension and exemption rules, then consider the Kentucky Office of the Attorney General complaint route. The authority's jurisdiction and available remedies vary.
File a complaint with Kentucky Office of the Attorney General ↗FAQ: Kentucky data removal
What does Kentucky's cure period do?+
Before an enforcement action, the Attorney General must give 30 days' written notice identifying the alleged provisions. If the controller or processor cures within that period and provides the required written statement that the violations are cured and will not recur, the statute limits an action for damages under its enforcement provision. This is separate from the 45-day consumer-request response period.