Laws

Kentucky Consumer Data Protection Act (KCDPA): your rights and how to use them

Quick answer

If you live in Kentucky, the Kentucky Consumer Data Protection Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send your request through the method in the company's privacy notice: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Kentucky Attorney General.

“A controller shall comply with an authenticated consumer request to exercise the right to: ... Delete personal data provided by or obtained about the consumer;”

All privacy laws
Applies in
Kentucky
In force since
Companies must answer within
Without undue delay and within 45 days of receiving your request. The business can extend once by 45 more days if it's reasonably necessary and it tells you why within the first 45 days. Appeals get a written answer within 60 days. Free up to twice a year (KRS § 367.3615(3)-(4)).
Regulator
Kentucky Office of the Attorney General
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: apps.legislature.ky.gov, ag.ky.gov

Last verified against the official page:

How we research this Report an error

Kentucky residents acting as individuals or households, not in a work or business role. The law applies to businesses that operate in Kentucky or target Kentuckians and that, in a calendar year, handle personal data of at least 100,000 consumers, or at least 25,000 consumers while earning more than 50% of gross revenue from selling personal data. Government bodies, nonprofits, colleges and universities, financial institutions covered by the Gramm-Leach-Bliley Act and HIPAA covered entities are exempt, and so is health data covered by HIPAA.

Your rights

  • Confirm and access

    Ask a business whether it processes your personal data, and see that data, unless showing it would reveal a trade secret (KRS § 367.3615(2)(a)).

  • Correct

    Have inaccurate data fixed. The business can take into account what kind of data it is and why it holds it (KRS § 367.3615(2)(b)).

  • Delete

    Have a business delete data you gave it and data it got about you from somewhere else. If it got your data from a third party, it may instead keep a minimal record so the data stays deleted, or opt you out of processing for any purpose the law doesn't exempt (KRS § 367.3615(2)(c), (3)(e)).

  • Get a portable copy

    Where the processing is automated, get a copy of the data you gave the business in a portable, readily usable format (KRS § 367.3615(2)(d)).

  • Opt out

    Stop the business using your data for targeted advertising, selling it, or profiling you for decisions with legal or similarly significant effects (KRS § 367.3615(2)(e)).

  • Requests for a child

    A parent or legal guardian can use these rights on behalf of a child (KRS § 367.3615(1)).

  • Appeal

    Appeal a refusal. The business must answer in writing within 60 days and, if it still says no, give you a way to complain to the Attorney General (KRS § 367.3615(4)).

General information, not legal advice.

How to use it

  1. 1

    Find the request method in the privacy notice

    Covered businesses must describe a secure and reliable way to send a request in their privacy notice. Use that channel.

  2. 2

    Say which rights you want to use

    Name them plainly: access, correction, deletion, a copy, or an opt-out. A line like "Under the Kentucky Consumer Data Protection Act, please delete the personal data you hold about me" is enough to start. A parent or guardian can send the request for a child.

  3. 3

    Opt out with each business

    Kentucky's law doesn't require businesses to honor a browser opt-out signal such as Global Privacy Control. To stop targeted ads or the sale of your data, send an opt-out request to each business.

  4. 4

    Confirm your identity if asked

    If the business can't confirm the request is yours with commercially reasonable effort, it may ask you for more information.

  5. 5

    Wait up to 45 days

    The business has 45 days to respond, or 90 if it tells you within the first 45 days that it needs more time and why. If it refuses, it must explain why within 45 days and tell you how to appeal.

  6. 6

    Appeal if the business refuses

    Use the business's appeal process. It must decide in writing within 60 days.

  7. 7

    Complain to the Kentucky Attorney General

    If the appeal is denied, the business must give you a way to contact the Attorney General. The Attorney General's consumer data protection page is the place to start. You can't sue a business under this law yourself: the Attorney General is the only one who enforces it.

No answer in time? Complain to Kentucky Office of the Attorney General .

Who has to follow the KCDPA

The law covers businesses that operate in Kentucky or target Kentucky residents and that handle personal data of at least 100,000 consumers in a calendar year. A business with a smaller customer base is covered too if it handles data of at least 25,000 consumers and earns more than half its gross revenue from selling personal data.

Those numbers are higher than Delaware's or Maryland's, so a smaller local business may not be covered at all.

Sensitive data and children

A business needs your consent before it processes sensitive data about you. For a known child, it must handle sensitive data under the federal Children's Online Privacy Protection Act (COPPA).

What changes on July 1, 2027

An amendment passed in 2026 (2026 Ky. Acts ch. 118) takes effect on July 1, 2027. From then on, a business needs your consent before it collects automatic content recognition data. That's the viewing data a smart TV or smart monitor can record about what's on your screen.

Why a company can say no

Some organizations and some data sit outside the law. Cities, state agencies and other government bodies are exempt. So are nonprofits, colleges and universities, HIPAA covered entities and financial institutions covered by the Gramm-Leach-Bliley Act (GLBA), along with data subject to GLBA. Health data covered by HIPAA is exempt, and the law only protects you as an individual or household, not in a work or business role.

So if a company tells you it's a nonprofit, or that your data falls under GLBA or HIPAA, that's the likely reason it's declining. You can still appeal, and complain to the Attorney General if you think the refusal is wrong. Our guide on what to do when a company won't delete your account covers the next steps.

Where Serus fits

Kentucky's law works one company at a time, and there's no browser signal that opts you out everywhere at once. Serus finds the data brokers that operate where you live, sends the deletion and opt-out requests for you, and checks whether your data shows up again. The steps above are free if you'd rather do them yourself.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

When did Kentucky's privacy law take effect?

January 1, 2026.

Can I sue a company under the KCDPA?

No. The Attorney General has exclusive enforcement authority and the law doesn't create a private right of action.

Do companies get a chance to fix violations?

Yes. Before suing, the Attorney General must give the business 30 days' written notice. If it fixes the problem and says so in writing, no action for damages can follow. A business that keeps violating the law can face up to $7,500 per violation.

Does Kentucky require businesses to honor Global Privacy Control?

No. The law has no rule that makes businesses honor browser or device opt-out signals, so you opt out by sending a request to each business.

What changes in 2027?

From July 1, 2027, a business must have your consent before it collects automatic content recognition data, the viewing data that smart TVs and smart monitors can capture.

Can a business charge me for a request?

Not for up to two requests a year. It may charge a reasonable fee for, or refuse, requests that are manifestly unfounded, excessive, repetitive or technically infeasible.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.