Kentucky Privacy Law (KCDPA): Compliance Guide
The Kentucky Consumer Data Protection Act (HB 15) took effect January 1, 2026, adding a familiar Virginia-style framework to the 2026 class of laws. It grants the standard five consumer rights and keeps the standard 100,000/25,000 thresholds — but breaks from recent trends in two telling ways: it does not require honoring Global Privacy Control, and it keeps a permanent cure period at the Attorney General's discretion instead of letting one sunset.
- Effective
- January 1, 2026
- GPC / universal opt-out
- Not required
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Kentucky Consumer Data Protection Act (HB 15)
Applicability
Who must comply with the KCDPA
The Kentucky Consumer Data Protection Act applies to businesses that meet the following criteria:
- Controls or processes the personal data of 100,000 or more Kentucky consumers, or
- Controls or processes the personal data of 25,000 or more Kentucky consumers and derives 50% or more of gross revenue from the sale of personal data
Consumer rights
What Kentucky consumers can demand
- Right to access personal data
- Right to correct inaccuracies
- Right to delete personal data
- Right to data portability
- Right to opt out of the sale of personal data, targeted advertising, and profiling
Opt-out mechanics
Kentucky opt-out & GPC requirements
Like every US state privacy law, the KCDPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Kentucky is “Your Privacy Choices”.
Global Privacy Control: Not required
Kentucky notably does not require honoring universal opt-out signals — unlike most laws effective in 2025 or later. The opt-out link is the required mechanism.
Enforcement
KCDPA penalties & enforcement
- Up to $7,500 per violation
Cure period: Permanent cure period, granted at the Attorney General's discretion.
State quirks
What makes Kentucky different
Kentucky is a throwback in the best sense for businesses. Every other comprehensive law effective since 2025 mandates universal opt-out signals — Kentucky declined. And where Colorado eliminated its cure period entirely and others let theirs expire, Kentucky's remains permanently available at the Attorney General's discretion. Otherwise the law is the standard framework: five consumer rights, $7,500 maximum per violation, and thresholds of 100,000 consumers, or 25,000 with 50% of revenue from data sales.
No GPC requirement
Unlike most laws effective in 2025 or later, Kentucky does not mandate honoring universal opt-out signals such as Global Privacy Control.
Permanent cure period
A cure period remains permanently available at the Attorney General's discretion rather than sunsetting on a fixed date.
Automation
How ConsentKit handles Kentucky
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Kentucky visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Kentucky visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Kentucky does not legally require honoring Global Privacy Control. ConsentKit applies automatic GPC honoring in the 12 states that mandate it; in Kentucky the opt-out link remains the visitor's control.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Kentucky visitor makes a choice.
Kentucky has no GPC mandate, but ConsentKit still renders the opt-out link instantly for Kentucky visitors and records every choice server-side for your audit trail.
FAQ
Kentucky KCDPA FAQ
When does Kentucky's KCDPA take effect?
January 1, 2026. It applies to businesses controlling or processing the personal data of 100,000 or more Kentucky consumers, or 25,000 or more while deriving 50% or more of gross revenue from selling personal data.
Does Kentucky require Global Privacy Control?
No — and that is notable. Most comprehensive laws effective in 2025 or later mandate universal opt-out signals; Kentucky does not. The “Your Privacy Choices” opt-out link remains the required mechanism.
Is there a cure period under the KCDPA?
Yes — a permanent one, granted at the Attorney General's discretion. Unlike states whose cure periods expired on fixed dates, Kentucky's does not sunset, though relying on discretion is still a risk.
What rights do Kentucky consumers have?
Kentucky consumers can access, correct, delete, and obtain a portable copy of their personal data, and can opt out of the sale of personal data, targeted advertising, and profiling. Violations carry up to $7,500 each.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the KCDPA.
Comply with Kentucky's KCDPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.