Kentucky
For Kentucky, law name and abbreviation is Kentucky Consumer Data Protection Act (KCDPA); effective date is January 1, 2026; consumer volume threshold is One hundred thousand (100,000) consumers; revenue-from-data-sales threshold is Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data; threshold combination logic is OR — control or process personal data of at least either threshold, recorded from its source on 2026-08-12.
- State
- Kentucky our reading
- Law name and abbreviation
- Kentucky Consumer Data Protection Act (KCDPA)
- Effective date
- January 1, 2026
- Consumer volume threshold
- One hundred thousand (100,000) consumers verified
- Revenue-from-data-sales threshold
- Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data verified
- Threshold combination logic
- OR — control or process personal data of at least either threshold verified
- Key exemptions
- City, state agency, or political subdivision; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; small telephone utilities and Tier III CMRS providers
- Enforcement mechanism
- Attorney General; 30-day cure period (non-expiring); no private right of action
- Statute citation
- KRS §§ 367.3611 to 367.3629
- Notes
- Kentucky's 30-day cure period does not expire, making it one of the most business-friendly enforcement provisions. Kentucky follows the Virginia model closely. Small telephone utilities and municipal utilities that do not sell or share data are also exempt.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
KRS 367.3611 to 367.3629 apply to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers; or (b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data.
— apps.legislature.ky.gov, retrieved 2026-08-12
Source
- apps.legislature.ky.govhttps://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648