Kentucky Consumer Data Protection Act ("KCDPA")
The Kentucky Consumer Data Protection Act (“KCDPA”) was passed by the Kentucky legislature on March 27, 2024, becoming the fifteenth state to enact consumer data privacy legislation. It limits the definition of "sale of personal data" to include only exchanges of personal data for monetary consideration, does not require that controllers recognize opt-out requests submitted via opt-out preference signals or global privacy controls, does not establish a private right of action or privacy-focused regulator, does not grant the Attorney General any rulemaking authority, and it does include a permanent 30-day cure period provision. The KCDPA is slated to take effect January 1, 2026.
