Kentucky consumer data privacy act
Ky. Rev. Stat. §§ 367.3611 to 367.3639 · Read 2026-08-15
Enacted 2024-04-04 and applicable from 2026-01-01. Scope threshold as written: 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. Thirty day cure period that does not sunset in the text.
Identifier
- Identifier
- Ky. Rev. Stat. §§ 367.3611 to 367.3639
- Level
- State KY
- Status
- In force
- Adopted
- 2024-04-04
- Applies from
- 2026-01-01
- Supervisory bodies
- Kentucky AG
Named requirements
Applicability and thresholds
Ky. Rev. Stat. §§ 367.3611 to 367.3639
100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data.
Privacy notice
Ky. Rev. Stat. §§ 367.3611 to 367.3639
A reasonably accessible notice naming the categories processed, the purposes, the categories shared and how rights are exercised.
Consumer rights
Ky. Rev. Stat. §§ 367.3611 to 367.3639
Access, deletion, portability, correction and opt-out of targeted advertising, sale and certain profiling, with an appeal route.
Sensitive data
Ky. Rev. Stat. §§ 367.3611 to 367.3639
Consent, or in some states a strict necessity standard, before sensitive categories are processed.
Data protection assessment
Ky. Rev. Stat. §§ 367.3611 to 367.3639
A documented assessment for targeted advertising, sale, sensitive data and profiling that carries a heightened risk.
Processor contract
Ky. Rev. Stat. §§ 367.3611 to 367.3639
A written contract that sets instructions, confidentiality, deletion or return, and audit rights.
Enforcement
Ky. Rev. Stat. §§ 367.3611 to 367.3639
Enforced by the state authority. Thirty day cure period that does not sunset in the text.
Official source
EU acts on the same ground
- gdpr
Covers the same ground as the GDPR on notice, rights and processor contracts, with a narrower scope and no general lawful basis requirement.
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | Kentucky AG — Ky. Rev. Stat. §§ 367.3611 to 367.3639 |
| Publisher | Office of the Attorney General of Kentucky |
| Last read | 2026-08-15 |
| Interval | Every 30 days |
| Next re-read | 2026-09-14 |
| Status | Checked against the publisher |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-15 | Row read against the official publication | Office of the Attorney General of Kentucky |
| 2026-01-01 | Date of application according to the publisher | Office of the Attorney General of Kentucky |
| 2024-04-04 | Adopted under Ky. Rev. Stat. §§ 367.3611 to 367.3639 | Office of the Attorney General of Kentucky |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
Ky. Rev. Stat. §§ 367.3611 to 367.3639, Kentucky consumer data privacy act. ExploreWorld Legal, https://legal.exploreworldai.com/us/regler/kentucky-kcdpa (hämtad 2026-08-25, bevis sha256:34d3e8db1f5ce79d, bygge legal-2026-08-25).
- sha256:
- 34d3e8db1f5ce79d9d9fb4ecec13b7d4385e596237de108bd49eef94715b977b
- hämtad:
- 2026-08-25
- source_confidence:
- derived
- bygge:
- legal-2026-08-25
- officiell källa:
- https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=37519
Derived path to the publisher. The address is built from the identifier and lands in the publisher's own register. apps.legislature.ky.gov.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act