What Is the Kentucky Consumer Data Protection Act?
KCDPA applies to persons doing business in Kentucky or targeting Kentucky residents that meet either the 100,000-consumer branch or the 25,000-consumer-plus-more-than-50%-sale-revenue branch, subject to exemptions. Rights include access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and certain profiling. Controllers generally respond within 45 days, with a possible 45-day extension, and decide appeals within 60 days. The Attorney General has exclusive enforcement authority and must provide 30 days' written notice before an action; continued violations can carry damages up to $7,500 each. There is no private right of action.
At a glance
- Full name
- Kentucky Consumer Data Protection Act
- Short code
- KCDPA
- Effective date
- January 1, 2026
- Response reference
- 45 days in this snapshot
- Cure period
- 30 days in this snapshot
- Private right of action
- No
- Enforcement
- Kentucky Office of the Attorney General
- Penalty reference
- Up to $7,500 in damages for each continued violation under Ky. Rev. Stat. § 367.3627
- Statutory citation
- Ky. Rev. Stat. §§ 367.3611–367.3629.
Who KCDPA applies to
A business is covered if it meets the applicability thresholds set out in Ky. Rev. Stat. §§ 367.3611–367.3629.. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in Kentucky or targets Kentucky residents, AND
- Controls or processes personal data of 100,000+ Kentucky consumers in a calendar year, OR
- Controls or processes personal data of 25,000+ Kentucky consumers AND derives over 50% of gross revenue from the sale of personal data
Consumer rights under KCDPA
Access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling
45-day response, possible 45-day extension, and 60-day appeal decision
AG enforcement only; no private right of action
Notable features (vs. CCPA)
KCDPA provides access, correction, deletion, portability, and opt-out rights for targeted advertising, personal-data sales, and certain profiling. Its consumer definition excludes employment and commercial contexts, and the current provisions include entity and data exemptions such as HIPAA and GLBA. The cited provisions do not mandate a universal opt-out mechanism, and the Attorney General has exclusive enforcement authority.
Enforcement and penalty reference
Enforcing agency: Kentucky Office of the Attorney General
Penalty reference: Up to $7,500 in damages for each continued violation under Ky. Rev. Stat. § 367.3627
Cure period: Before initiating an action, the Attorney General must provide 30 days' written notice identifying the alleged provisions. If the controller or processor cures within that period and gives the required express written statement that the violations are cured and will not recur, no action for damages under the cited enforcement subsection may be initiated; this is separate from the consumer request response period.
Private right of action: KCDPA has no private right of action. Enforcement is exclusive to the Kentucky Office of the Attorney General.
Where to file a complaint: Kentucky Office of the Attorney General
How to exercise your KCDPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Kentucky residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Kentucky Office of the Attorney General complaint route at https://www.ag.ky.gov/Resources/Consumer-Resources. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a KCDPA privacy request, $9 one-time
FAQ
What does Kentucky's cure period do?+
Before an enforcement action, the Attorney General must give 30 days' written notice identifying the alleged provisions. If the controller or processor cures within that period and provides the required written statement that the violations are cured and will not recur, the statute limits an action for damages under its enforcement provision. This is separate from the 45-day consumer-request response period.
Official sources & citations
Compare with sibling state laws
KCDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: