The Kentucky Consumer Data Protection Act: HB 15, the 2025 Health Amendments and the First Lawsuit

Enactment, Codification and the Sources Read

The General Assembly passed House Bill 15 in the 2024 regular session. The legislature's bill record shows a 92-0 House vote, a 35-0 Senate vote with two floor amendments, and the governor's signature on April 4, 2024 as Acts chapter 72. The enrolled chapter creates ten new sections of KRS Chapter 367, names them the Kentucky Consumer Data Protection Act in Section 11, and sets January 1, 2026 as the effective date in Section 12.

The Reviser of Statutes codified those sections as KRS 367.3611 through 367.3629. Every section quoted below was read from its codified page on the Legislative Research Commission site. A reviser's note on the definitions section records that the definitions were renumbered alphabetically during codification, with no change to their words. Two later acts amend the chapter, and each is described where it applies.

Who KRS 367.3613 Reaches

The application section covers persons that "conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth" and that, during a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving "over fifty percent (50%) of gross revenue from the sale of personal data." No revenue floor applies on its own.

A consumer is a Kentucky resident "acting only in an individual context," excluding commercial and employment roles. A sale is limited to an exchange "for monetary consideration by the controller to a third party," so transfers for other kinds of value fall outside the definition by its terms. Profiling is "any form of automated processing" used to evaluate or predict personal aspects such as economic situation, health, reliability or movements.

Subsection (2) removes seven kinds of organization from the Act altogether: cities, state agencies and political subdivisions; financial institutions, their affiliates and Gramm-Leach-Bliley data; HIPAA covered entities and business associates; every nonprofit organization; every institution of higher education; certain insurance-fraud and first-responder support entities recognized under KRS 304.47-060(1)(e); and small telephone utilities, Tier III CMRS providers and municipally owned utilities that do not sell or share personal data with any third party.

Exemptions, Including What HB 473 Added in 2025

Before the Act applied to anyone, the 2025 General Assembly amended it. House Bill 473 became 2025 Ky. Acts ch. 13, signed March 15, 2025. The bill record's summary of the enacted version says it amends KRS 367.3613 "to exempt information collected by a health care provider that maintains protected health information in accordance with HIPAA and information included in a limited data set as described in 45 C.F.R. sec. 164.514(e)." The codified section now carries those two items as paragraphs (3)(i) and (3)(j), and its history line credits the 2025 act.

The chapter's text confirms the change: the paragraphs that were (3)(j) through (3)(p) in 2024 are relettered (3)(l) through (3)(r), and the bracketed deletion in subsection (2)(g) removes the word "processor" from the utility exemption, so the condition now reads "does not sell or share personal data with any third-party." A health care provider is defined broadly in KRS 367.3611, covering licensed facilities and practitioners under more than a dozen KRS chapters and their current and former employers, officers and agents.

The rest of subsection (3) exempts protected health information, health records, Part 2 substance-use records, human-subjects research data, quality-improvement and patient-safety work product, HIPAA de-identified information, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data, employment and benefits data, data processed by a utility or its holding company system, and data used under the Combat Methamphetamine Epidemic Act. Subsection (4) deems a controller compliant with any parental-consent obligation if it meets COPPA's verifiable parental consent requirements.

Consumer Rights and the Response Clock

KRS 367.3615(2) lists five rights: confirmation and access (subject to a trade-secret limit), correction, deletion of data "provided by or obtained about the consumer," a portable copy of data the consumer previously provided where processing is automated, and an opt-out of targeted advertising, sale, or profiling "in furtherance of decisions that produce legal or similarly significant effects." A parent or legal guardian may invoke them for a child.

Under subsection (3), the controller responds within 45 days, extendable once by 45 more days if the consumer is told within the first period. A refusal must explain itself and give appeal instructions within 45 days. Two responses a year are free; a request that is "excessive, repetitive, technically infeasible, or manifestly unfounded" may draw a reasonable fee or a refusal, and the controller carries the burden of showing which. Data obtained from third parties can be handled under a deletion request either by keeping a suppression record or by opting the consumer out of non-exempt processing.

Appeals run under subsection (4). The controller decides within 60 days in writing and, on denial, provides "an online mechanism, if available, or other method" for complaining to the Attorney General. KRS 367.3617(5) bars requiring a new account to exercise a right. Nothing in the chapter requires a controller to honor a browser-based or global opt-out signal, and the chapter contains no rulemaking grant.

Sensitive Data, Consent and the 2027 Smart TV Provision

Sensitive data under KRS 367.3611 covers personal data indicating racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to identify a specific person; data collected from a known child; and precise geolocation within 1,750 feet. KRS 367.3617(1)(e) bars processing it without the consumer's consent, or for a known child's data, outside COPPA.

House Bill 692, 2026 Ky. Acts ch. 118, was signed April 13, 2026 and takes effect July 1, 2027. The future version of KRS 367.3611 adds a separate definition of "automatic content recognition data," meaning viewing-history data collected through technology in a smart television or smart monitor that identifies displayed content by audio or video fingerprinting or watermark detection. It does not add that term to the sensitive-data list. The future KRS 367.3617(1)(f) instead imposes its own duty: a controller shall "not collect automatic content recognition data without a consumer's consent."

Data Protection Impact Assessments and the June 1, 2026 Start

KRS 367.3621 uses the label "data protection impact assessment" for the same five triggers found in most statutes of this family: targeted advertising, sale, risky profiling, sensitive data, and processing presenting "a heightened risk of harm." The 2025 act changed one word. The 2024 text described a foreseeable risk of "disparate impact on consumers"; the codified text, after HB 473, reads "unlawful, disparate impact on consumers." The bill record calls this a technical change.

Assessments must weigh benefits to the controller, consumer, other stakeholders and the public against risks as mitigated by safeguards. The Attorney General may obtain one through an investigative demand; assessments are exempt from the Open Records Act at KRS 61.870 to 61.884, and disclosure waives neither attorney-client privilege nor work product. Subsection (8) limits the duty to processing activities "created or generated on or after June 1, 2026," five months after the rest of the Act took effect.

Attorney General Enforcement and the Cure Period

KRS 367.3627(1) makes the Attorney General's authority exclusive and adds the investigative powers of KRS Chapter 15. Subsection (2) requires 30 days' written notice identifying the provisions allegedly violated. If the controller or processor cures within that time and gives "an express written statement that the alleged violations have been cured and that no further violations shall occur," then "no action for damages under subsection (3)" may be brought. The cure has no sunset date in the codified text, and its bar is framed in terms of an action for damages.

Subsection (3) authorizes damages of up to $7,500 "for each continued violation" after the cure period or a broken written statement, and subsection (5) allows recovery of investigative expenses, costs and attorney's fees. Subsection (4) rules out a private right of action under the chapter "or any other law." Under KRS 367.3629, all civil penalties go into the consumer privacy fund, which the Attorney General's office administers and spends on enforcing the Act, with balances carried forward rather than lapsing. The office's Office of Data Privacy page says the unit "was created to enforce" the KCDPA and links an online complaint form.

On January 8, 2026, the Attorney General announced a suit against Character Technologies, Inc. and its two founders in Franklin Circuit Court. The filed complaint, stamped case No. 26-CI-00029, pleads Count III as a violation of the KCDPA seeking "Declaratory and Prospective Relief." Count III alleges that collecting minors' data without verifiable parental consent or adequate disclosures "will violate the KCDPA upon its effective date" and asks the court to declare that the conduct, "if continued," will violate the Act. The other counts rest on the Consumer Protection Act and other state law. No ruling on Count III was located as of October 26, 2026, and no other action under the KCDPA was found on the office's site.

Frequently Asked Questions