Is Kentucky's Consumer Data Protection Act in Effect in 2026?

Yes. Kentucky's Consumer Data Protection Act (CDPA) took effect on January 1, 2026, codified at KRS 367.3611 through KRS 367.3629, and it now governs how businesses handle Kentucky residents' personal data for advertising purposes.

Signed in 2024, Effective in 2026

Kentucky's governor signed the CDPA into law on April 4, 2024, giving businesses a roughly 21-month runway before the compliance date arrived. That's a shorter gap than some other states built into their own rollout timelines, which pushed two-plus years between enactment and enforcement to let larger national advertisers update their systems.

Who the Law Covers

The CDPA applies to entities conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that control or process personal data of at least 100,000 consumers, or control or process data of 25,000 consumers while deriving over 50% of gross revenue from selling personal data. That second threshold catches smaller data brokers and ad-tech vendors that the 100,000-consumer bar alone would miss, even though their overall customer base is modest.

What Marketers Need to Change

Kentucky residents can now opt out of targeted advertising and the sale of their personal data to third parties. The law also classifies race, religion, immigration status, genetic data, biometric data, health diagnoses, and sexual orientation as sensitive data, which generally requires opt-in consent before use rather than just an opt-out option — a meaningfully higher bar than ordinary personal data gets under the statute, and one that affects any health, finance, or demographic-based ad targeting.

The Cure Period Gives Room to Fix Mistakes

Unlike some newer state privacy laws that dropped their cure periods entirely, Kentucky's CDPA includes a 30-day window to fix a violation after notice before the Attorney General can pursue penalties. That gives marketing and legal teams a practical grace period if an opt-out mechanism breaks or a consent flag doesn't propagate correctly across a CRM or ad platform integration.

One Notable Exemption

Data a company processes or maintains purely in its role as an employer is exempt from the Act. That carve-out matters for internal HR and recruiting marketing but doesn't extend to a company's consumer-facing advertising or sales data, so recruitment marketing teams shouldn't assume the exemption covers candidate-facing ad campaigns too.

Where Kentucky Fits Among 2026 State Laws

Kentucky joins Rhode Island as one of the earlier 2024-enacted state privacy laws to actually reach its effective date in 2026, ahead of the Alabama, Louisiana, and Vermont statutes that don't take effect until 2027 or 2028. If you're sequencing a multi-state compliance rollout, Kentucky and Rhode Island belong at the front of that queue rather than treated as future work.

Bottom Line

Kentucky's CDPA is live now, not pending — confirm your opt-out flow for targeted advertising covers Kentucky residents and that any sensitive-category data collection already runs on opt-in consent rather than opt-out.

Sources: Bricker Graydon, "The Kentucky Consumer Data Protection Act Goes into Effect on January 1, 2026"; Davis Wright Tremaine state privacy law tracker, Kentucky entry; statutory text at KRS 367.3611-367.3629.