# Kentucky — US state consumer data privacy laws: applicability thresholds by state

For Kentucky, law name and abbreviation is Kentucky Consumer Data Protection Act (KCDPA); effective date is January 1, 2026; consumer volume threshold is One hundred thousand (100,000) consumers; revenue-from-data-sales threshold is Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data; threshold combination logic is OR — control or process personal data of at least either threshold, recorded from its source on 2026-08-12.

- **State:** Kentucky _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Kentucky Consumer Data Protection Act (KCDPA)
- **Effective date:** January 1, 2026
- **Consumer volume threshold:** One hundred thousand (100,000) consumers _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — control or process personal data of at least either threshold _(verified: appears in the quote below)_
- **Key exemptions:** City, state agency, or political subdivision; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; small telephone utilities and Tier III CMRS providers
- **Enforcement mechanism:** Attorney General; 30-day cure period (non-expiring); no private right of action
- **Statute citation:** KRS §§ 367.3611 to 367.3629
- **Notes:** Kentucky's 30-day cure period does not expire, making it one of the most business-friendly enforcement provisions. Kentucky follows the Virginia model closely. Small telephone utilities and municipal utilities that do not sell or share data are also exempt.

## What the source says

> KRS 367.3611 to 367.3629 apply to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers; or (b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data.

## Source

- https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).