Kentucky Privacy & Accessibility Laws

Kentucky enacted the Kentucky Consumer Data Protection Act (KCDPA) in April 2024, making it one of the newer states with comprehensive consumer privacy legislation. The law takes effect January 1, 2026. Kentucky state agencies must also ensure their digital services are accessible to individuals with disabilities.

Kentucky Consumer Data Protection Act (KCDPA)

The KCDPA establishes privacy rights for Kentucky consumers and obligations for businesses that process personal data.

Who Must Comply?

The KCDPA applies to entities that conduct business in Kentucky or target Kentucky residents AND:

Threshold	Requirement
Data Volume	Control or process personal data of 100,000+ Kentucky consumers
Revenue + Data	Derive more than 50% of gross revenue from selling personal data AND process data of 25,000+ consumers

Consumer Rights Under KCDPA

Right	Description
Right to Know	Confirm whether a controller is processing personal data and access that data
Right to Correct	Correct inaccuracies in personal data
Right to Delete	Delete personal data provided by or obtained about the consumer
Right to Portability	Obtain a copy of personal data in a portable format
Right to Opt-Out	Opt out of targeted advertising, sale of personal data, and profiling

Sensitive Data Categories

The KCDPA requires opt-in consent for processing sensitive data, including:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data for identification
• Personal data of known children
• Precise geolocation data

Accessibility Requirements

Kentucky government agencies must ensure digital accessibility for all residents:

State Government Obligations

• Kentucky state agencies must comply with ADA Title II for all public-facing digital content
• Commonwealth Office of Technology provides accessibility guidance
• State websites must follow WCAG 2.1 Level AA guidelines
• Educational institutions must ensure accessible digital learning materials
• State IT procurement requires vendor accessibility compliance

Private Sector Considerations

• Businesses with physical locations in Kentucky are subject to ADA Title III
• Website accessibility claims can be brought under federal ADA
• Healthcare providers must ensure accessible patient portals
• Financial institutions must provide accessible online banking services

Enforcement

KCDPA Penalties

Violation Type	Maximum Penalty
Per violation (after cure period)	$7,500 per violation
Consumer Protection Act violation	Additional penalties under Kentucky Consumer Protection Act
Injunctive relief	Court may order business practices to cease

Business Obligations

Obligation	Description
Privacy Notice	Clear notice of data categories, purposes, rights, and third-party sharing
Data Minimization	Limit collection to what is reasonably necessary for disclosed purposes
Purpose Limitation	Process data only for purposes disclosed to consumers
Security	Implement appropriate technical and organizational security measures
Sensitive Data Consent	Obtain opt-in consent before processing sensitive personal data
Request Response	Respond to consumer requests within 45 days (may extend 45 days)
Data Processing Agreements	Establish contracts with processors that handle personal data

Consumer Rights

Kentucky residents have comprehensive privacy rights under the KCDPA:

• Right to Access: Confirm processing and access personal data
• Right to Correct: Correct inaccurate personal data
• Right to Delete: Request deletion of personal data
• Right to Portability: Receive data in portable format
• Right to Opt-Out: Opt out of targeted advertising, sales, and profiling
• Right to Non-Discrimination: Cannot be penalized for exercising rights
• Right to Appeal: Appeal controller's decision on consumer requests

Related Resources

• US Privacy Laws Overview
• State Privacy Law Comparison
• ADA Title II Requirements
• All State Laws
• Privacy Compliance Guide
• Report a Violation