Kentucky Consumer Data Protection Act

state_law — US-KY
Effective: January 1, 2026 100 platforms tracked 13387 provisions indexed Enforced by: Kentucky Attorney General

Overview

The Kentucky Consumer Data Protection Act grants Kentucky residents rights to access, correct, delete, and obtain portable copies of their personal data, and to opt out of data sales, targeted advertising, and profiling. Controllers must provide transparent privacy notices, limit data collection to what is adequate and relevant, obtain consent for processing sensitive data, and conduct data protection assessments for targeted advertising, profiling, and processing activities that present heightened risk. The law applies to entities processing personal data of 100,000 or more Kentucky residents, or 25,000 or more residents while deriving over 50 percent of gross revenue from data sales.

Penalties

Enforced by Kentucky Attorney General under Consumer Protection Act. Civil penalties up to $7,500 per violation. No private right of action.

Key Articles & Sections

Platforms We Track Subject to

Recent Changes Related to

ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology

Provisions Governed by (13387 across 100 platforms)

User controls participation in sharing features 23andMe
Medium
User choice to store biological sample 23andMe
Medium
California identity verification required including residency confirmation Acorns
Medium
Personal data shared with third parties upon user instruction Acorns
Medium
Identity verification required to process privacy rights requests Acorns
Medium
California nondiscrimination right for exercising privacy rights Acorns
Medium
Customer right to limit affiliate marketing sharing Acorns
Medium
User Warrants Authority To Share Client Information Acorns
Medium
Personal information shared with corporate affiliates Acorns
Medium
Affiliate brand partners receive purchase data for rewards crediting Acorns
Medium
User right to deletion of personal information Acorns
Medium
User right to opt-out of personal information selling Acorns
Medium
Personal information may be transferred internationally Acorns
Medium
California right to opt-out of selling or sharing Acorns
Medium
California opt-out applies only to submitting browser and device Acorns
Medium
Session replay sensitive information automatically masked Acorns
Medium
Session replay data not shared with third parties Acorns
Medium
Affiliates share transaction and experience information Acorns
Medium
Acorns collects information from other companies Acorns
Medium
Aggregated or deidentified data disclosed to third parties Acorns
Medium
Early gifting shares name and transfer details with recipient Acorns
Medium
Acorns does not sell personal information under CCPA Acorns
Medium
Service providers contractually bound on personal information handling Acorns
Medium
California residents information not shared beyond state law Acorns
Medium
Acorns shares for own marketing purposes Acorns
Medium
User right to correction of inaccurate personal information Acorns
Medium
Vermont residents information sharing restricted to law or authorization Acorns
Medium
Federal law limits consumer sharing rights Acorns
Medium
California CCPA right to know about data practices Acorns
Medium
New customer sharing begins after 30 days Acorns
Medium

Showing 30 of 13387 provisions. View all →

Official Source

View official regulation text →

Get alerted when platforms change their policies — including -relevant provisions.

Subscribe to Monitor — $19/mo

Frequently Asked Questions

What does require?

Which platforms does apply to?

ConductAtlas tracks -relevant provisions across 100 platforms. Each platform's specific provisions are classified by severity and mapped to requirements.

How does ConductAtlas monitor compliance?

ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect obligations. Every change is archived with cryptographic verification.