Key Facts
Overview
Kentucky's KCDPA closely follows the Virginia VCDPA template, with a permanent 30-day cure period and standard applicability thresholds. It takes effect January 1, 2026, with data protection impact assessments applying to processing from June 2026. HB 473 (March 2025) refined healthcare and DPIA provisions.
What This Means for Your Website
- Opt-in consent is required for sensitive data of Kentucky visitors
- Consumer rights include access, correction, deletion, portability, and opt-out
- A permanent 30-day cure period applies
- No requirement to honor GPC/UOOM signals
- Data protection impact assessments apply from June 1, 2026
Key Requirements
The Kentucky AG enforces the KCDPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days. The VCDPA template provides a familiar framework for businesses already complying with Virginia law.
How ConsentStack Handles This
ConsentStack detects Kentucky visitors and applies the KCDPA opt-out model with opt-in for sensitive data when the law takes effect in January 2026.
Penalties
Up to $7,500 per violation.
Key Requirements
- Opt-in consent for sensitive data
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments from June 2026
- Privacy notice with required disclosures
- Data minimization obligations
Notable Provisions
- Virginia VCDPA template
- Permanent 30-day cure period
- No UOOM requirement
- DPIAs from June 2026
- HB 473 (March 2025) refined healthcare and DPIA provisions
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, unless doing so would require the controller to reveal a trade secret.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you.
Where processing is automated, obtain a copy of the personal data you previously provided in a portable and, where technically practicable, readily usable format you can transmit to another controller.
Opt out of the processing of your personal data for targeted advertising.
Opt out of the sale of your personal data, meaning its exchange for monetary consideration to a third party.
Opt out of automated profiling used for decisions with legal or similarly significant effects, meaning decisions on financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services or access to basic necessities.
Appeal a controller's refusal to act on your request, within a reasonable period after you receive the decision, through a process that is conspicuously available and similar to the request process.
If your appeal is denied, the controller must give you an online mechanism, if available, or another method to contact the Kentucky Attorney General and submit a complaint.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services, charging different prices or providing a different quality, though bona fide loyalty, rewards, premium features, discount or club card programs are allowed.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with KCDPA
ConsentStack helps you implement Opt-out consent for Kentucky, United States automatically.