Blog

Kentucky Consumer Privacy Act joins US privacy landscape

The state follows New Jersey and New Hampshire in passing comprehensive privacy legislation in 2024

Alexis Kateifides
Director, Regulatory Intelligence
April 8, 2024

Who does the Act apply to?
What are the key requirements?
Next steps and how to prepare

On April 4, 2024, the Kentucky Consumer Privacy Act (KCPA) was signed into law by the Governor of Kentucky. The law becomes the third passed in the United States in 2024 following New Jersey and New Hampshire and will take effect on January 1, 2026.

The KCPA will introduce the requirement for Data Protection Impact Assessments (DPIAs) for certain processing activities as well as a range of consumer rights, and opt-in consent for processing sensitive data, among other things. Continue reading this blog to learn more about some of the key requirements of the KCPA.

Who does the Kentucky Consumer Privacy Act (KCPA) apply to?

The KCPA will apply to businesses that operate in Kentucky or that produce products or services that are targeted to residents of Kentucky. For the KCPA to be applicable, businesses must also meet an application threshold where, during a calendar year, they control or process personal data of at least:

100,000 consumers

25,000 consumers and derive over 50% of gross revenue from the sale of personal data

There are a range of organizational exemptions to the KCPA which must be considered. The law will not apply to entities including, but not limited to:

City, state agency or any political subdivision of Kentucky
Financial institutions, their affiliates, or data subject to the Gramm-Leach-Bliley Act (GLBA)
Covered entities or business associates pursuant to the Health Insurance Portability and Accountability Act (HIPAA)

Non-profit organizations
Institutions of higher education

What are the key requirements of the KCPA?

The KCPA mirrors many requirements found across existing state privacy laws in the US. The law includes a range of consumer rights, conditions for valid consent including opt-in consent for sensitive data, and rules for performing DPIAs.

Consumer rights

As with most modern privacy laws, the KCPA offers consumers a wide range of rights to exercise in relation to their personal information. In the case of a child, a parent or guardian can exercise these rights on their behalf.

The rights outlined by the KCPA include:

The right to confirm processing
The right to access
The right to correction
The right to deletion
The right to data portability
The right to opt out of:
- The sale of personal data
- Profiling
- Targeted advertising

Organizations will have 45 days to respond to a consumer rights request with the possibility of a 45-day extension where reasonable. Organizations will also have 45 days to inform consumers of a declined request as well as the justification for declining the request.

Consent

Under the KCPA, consent is defined as “a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.” This can be given via a written statement, electronic means, or another unambiguous affirmative action.

Furthermore, processing sensitive data – which includes, but not limited to, information relating to racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status – operates on an opt-in basis, meaning that organizations must obtain consent from the individual prior to processing.

Privacy notices

Organizations will be required to provide consumers with “a reasonably accessible, clear, and meaningful privacy notice”. Such disclosures should include information describing:

The categories of personal data
The purpose for processing
How consumers can exercise their rights
How a consumer can appeal an organization’s decision to refuse a consumer rights request
The categories of personal data shared with third parties
The categories of third parties

Data Protection Impact Assessments

Under the KCPA, organizations will be required to conduct and document DPIAs for specific processing activities. These include:

Processing for targeted advertising
The sale of personal data
Processing for profiling, where the profiling presents a reasonably foreseeable risk of:
- Unfair or deceptive treatment of consumers
- Financial, physical, or reputational injury to consumers
- Intrusions on the private affairs or concerns of consumers
Processing sensitive data
Processing that presents a heightened risk of harm to consumers

Like other US state privacy laws, a DPIA under the KCPA should identify and weigh the benefits of the processing against the potential risks to the consumer. Additionally, a single Data Protection Impact Assessment (DPIA) can fulfill this requirement for a group of similar processing activities. This is true if these activities include comparable assessments conducted in accordance with other laws and if those assessments have a scope and effect that are reasonably equivalent. The data protection assessment requirement will only apply to processing activities created on or after June 1, 2026.

Enforcement and penalties

The Kentucky Attorney General will have the sole authority to enforce violations of the KCPA and will provide organizations a 30-day cure period to remedy violations of the law. Failure to remedy violations within 30 days can result in monetary penalties of up to $7,500 per violation. Money accrued via such penalties will be deposited into a Consumer Privacy Fund. There is no private right of action.

Next steps and how to prepare for the KCPA

The Kentucky Consumer Privacy Act will take effect on January 1, 2026, giving organizations a little under two years to prepare for its requirements. Ensuring your consumer rights request processes and privacy notices align with the obligations of the KCPA will be a good starting place for organizations needing to comply with the law. Furthermore, ensuring your data protection assessment processes match the KCPA’s requirements ahead of June 1, 2026 can be seen as a best practice although not an immediate priority.

Learn more about how the OneTrust Privacy & Data Governance cloud can help you to get your privacy program up to speed with the KCPA.

Blog

Kentucky Consumer Privacy Act joins US privacy landscape

Table of contents

Who does the Kentucky Consumer Privacy Act (KCPA) apply to?

What are the key requirements of the KCPA?

Consumer rights

Consent

Privacy notices

Data Protection Impact Assessments

Enforcement and penalties

Next steps and how to prepare for the KCPA

You may also like

Privacy Management

2024 to 2025: Preparing for the next wave of privacy regulations

Prepare for 2025's privacy changes with this recap webinar on 2024's regulations and explore upcoming laws, trends, and compliance strategies.

January 23, 2025

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Consent & Preferences

Mastering US opt-out requirements: A practical guide for marketers

Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.

October 22, 2024

Privacy Automation

Global regulatory update: Recent privacy developments and compliance trends

Join us for a webinar on the latest updates and emerging trends in global privacy regulations.

September 12, 2024

Privacy Management

Preparing for child data protection laws in the US

Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.

August 07, 2024

Privacy Management

The road to 50 states: Rhode Island joins the US privacy landscape with a new law

Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.

July 16, 2024

Privacy Management

Preparing for the future of privacy in healthcare: Going beyond HIPAA compliance

Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.

July 11, 2024

Privacy Management

The road to 50 states: Minnesota and Vermont join the US privacy landscape

In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.

June 17, 2024

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

Comparing US state privacy law requirements

Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.

May 14, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023

Privacy Management

December's deadline: Ensuring compliance with Utah's privacy regulation