Vote Smart's Synopsis:

Vote to pass a bill that establishes protections for consumer data privacy in the state of Kentucky.

Highlights:

• Establishes protections for consumer data privacy in the state of Kentucky, including, but not limited to (Sec. 1-10):

• Granting consumers the rights of access, deletion, portability, and correction; and

• Allowing consumers to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects.

• Specifies that the provisions of this bill shall apply to controllers and processors that conduct business in Kentucky or produce products or services that are targeted to Kentucky residents, and that, during a calendar year either (Sec. 1-10):

• Control or process the personal data of at least 100,000 consumers; or 

• Control or process data of at least 25,000 consumers and derive more than 50% of their gross revenue from selling personal data.

• Defines “sensitive data” as personal data that indicates racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to identify unique individuals, personal data collected from a known child, and precise geolocation data (Sec. 1-10).

• Requires Data Protection Impact Assessments (DPIAs) for processing activities involving targeted advertising, personal data sales, profiling (in limited circumstances), processing of sensitive data, or would otherwise present a heightened risk of harm to consumers (Sec. 1-10).

• Specifies that the Kentucky Attorney General will have exclusive authority to enforce the provisions in this bill and the statute would also grant controllers and processors with a 30-day right to cure that does not have a sunset date (Sec. 1-10)

• Specifies that the provisions of this bill shall take effect January 1, 2026 (Sec. 12).

Full Bill Text

Vote Smart's Synopsis:

Vote to pass a bill that establishes protections for consumer data privacy in the state of Kentucky.

Highlights:

• Establishes protections for consumer data privacy in the state of Kentucky, including, but not limited to (Sec. 1-10):

• Granting consumers the rights of access, deletion, portability, and correction; and

• Allowing consumers to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects.

• Specifies that the provisions of this bill shall apply to controllers and processors that conduct business in Kentucky or produce products or services that are targeted to Kentucky residents, and that, during a calendar year either (Sec. 1-10):

• Control or process the personal data of at least 100,000 consumers; or 

• Control or process data of at least 25,000 consumers and derive more than 50% of their gross revenue from selling personal data.

• Defines “sensitive data” as personal data that indicates racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to identify unique individuals, personal data collected from a known child, and precise geolocation data (Sec. 1-10).

• Requires Data Protection Impact Assessments (DPIAs) for processing activities involving targeted advertising, personal data sales, profiling (in limited circumstances), processing of sensitive data, or would otherwise present a heightened risk of harm to consumers (Sec. 1-10).

• Specifies that the Kentucky Attorney General will have exclusive authority to enforce the provisions in this bill and the statute would also grant controllers and processors with a 30-day right to cure that does not have a sunset date (Sec. 1-10)

• Specifies that the provisions of this bill shall take effect January 1, 2026 (Sec. 12).

Full Bill Text