Kentucky Consumer Privacy Protection Act (KPPA)

Overview

The Kentucky Consumer Privacy Protection Act (KPPA), codified as KRS §367.401 through §367.445, was signed into law on April 4, 2024 (HB 15), and becomes effective January 1, 2026. Kentucky follows the Virginia/Connecticut model with five consumer rights, controller-processor framework, sensitive data opt-in consent, and AG-only enforcement.

Applicability (§367.405)

The KPPA applies to persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents AND during a calendar year:

1. Control or process personal data of at least 100,000 Kentucky consumers; OR
2. Control or process personal data of at least 25,000 Kentucky consumers AND derive more than 50% of gross revenue from the sale of personal data.