Your Kentucky consumer data rights
In effect
The Kentucky Consumer Data Protection Act gives Kentucky residents rights over the personal data that covered businesses collect about them. It has been in effect since January 1, 2026.
- Who or what it protects
- Kentucky residents, in their dealings with businesses that process the personal data of at least 100,000 Kentucky consumers, or of at least 25,000 while earning half of their gross revenue from selling personal data. Cities, state agencies and political subdivisions, nonprofits and colleges and universities are among those exempt, and some data, such as health information covered by HIPAA, is exempt.
- What you can do
- You can confirm whether a business processes your personal data and see it, correct it, delete data you provided or that it obtained about you, and get a copy you can take elsewhere. You can opt out of targeted advertising, the sale of your data, and profiling used for decisions with legal or similarly significant effects. A business needs your consent to process sensitive data. Follow the instructions in the company's privacy notice. It must respond within 45 days, which it can extend by 45 days, and you get two free responses a year. If it declines, you can appeal; it has 60 days to answer, and if it denies the appeal it must give you a way to contact the Attorney General. You can file a complaint with the Attorney General's Office of Data Privacy.
- Limits and eligibility
- There is no private right to sue under this law; only the Attorney General enforces it, after giving the business 30 days to fix a violation.
- Who oversees it
- Kentucky Attorney General, Office of Data Privacy
- The law
- Kentucky Consumer Data Protection Act
More official places to go
Checked against the official sources on October 6, 2026. Links last checked November 1, 2026.