Kentucky

Created by 2025 Ky. Acts ch. 66 (Senate Bill 4) and effective March 24, 2025, the same emergency-clause Act that also directs Commonwealth-agency AI governance, KRS 117.322 lets a candidate for elected office whose appearance, action, or speech is altered through synthetic media in an electioneering communication seek an injunction or other equitable relief against the communication's sponsor requiring a disclosure that is clear and conspicuous and placed in or alongside the content so a user is likely to notice it, and lets a prevailing plaintiff recover attorney's fees and costs.

The medium disseminating the communication and its advertising sales representative are not liable except where they intentionally remove a required disclosure or, intending to deceive, alter content so that it becomes synthetic media, and an interactive computer service keeps its federal Communications Decency Act section 230 exemption. It is an affirmative defense that the communication already carries the required disclosure.

Failing to comply with a court's order to include the disclosure is punishable as a Class D felony under KRS 121.990(3). The section was amended again by 2026 Ky. Acts ch. 161, effective July 15, 2026.

An information holder must disclose a breach of the security of the system involving unencrypted personal information to any affected Kentucky resident in the most expedient time possible and without unreasonable delay, with consumer-reporting-agency notice required once more than 1,000 persons are affected at one time.

"Personally identifiable information" is limited to a name plus a Social Security, driver's license, or financial account number with access credentials, and does not reach biometric identifiers. No provision in the eight subsections read requires notice to the Kentucky Attorney General, and none establishes a private right of action; the codified text's own history note dates it to 2014 Ky. Acts ch. 84, sec. 1, effective July 15, 2014.

KCDPA applies to a person that conducts business in Kentucky, or produces a product or service targeted to Kentucky residents, and that during a calendar year controls or processes personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data.

It exempts city and state government, Gramm-Leach-Bliley Act (GLBA)-covered financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, higher-education institutions, certain insurance-fraud investigative organizations, and small telephone, CMRS, or municipal utilities that do not sell personal data. Controllers must limit collection to disclosed purposes and processors act on the controller's instructions under a written contract. The enacting session law is 2024 Ky. Acts ch. 72, sec. 1, not ch. 89.

KCDPA gives a Kentucky consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling.

A controller must respond without undue delay and in all cases within 45 days of receipt, with one 45-day extension available when reasonably necessary, and must decide an appeal of a denial within 60 days, after which the consumer may complain to the Attorney General.

The Kentucky Attorney General has exclusive authority to enforce KCDPA. Before suing, the Attorney General must give a controller or processor 30 days' written notice; curing the violation and confirming the cure in writing bars an action, and this 30-day cure period is permanent, unlike New Hampshire's and Rhode Island's time-limited or absent versions. An uncured, continuing violation is subject to damages of up to $7,500 per violation, and the statute creates no private right of action.

KCDPA classifies genetic or biometric data processed to uniquely identify a person as sensitive data, requiring opt-in consent under KRS 367.3617.

"Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; a photograph, video, or audio recording, or data generated from one, is excluded only until that data is generated to identify a specific individual or is health care information governed by Health Insurance Portability and Accountability Act (HIPAA), at which point the general exclusion lifts. A 2026 amendment effective July 1, 2027 leaves this definition's operative text unchanged.

Kentucky makes it unlawful to access, cause to be accessed, or attempt to access a computer, computer system, computer network, or any data or software on one, without the effective consent of the owner, and grades the offense in four degrees. Access made to defraud or to obtain money, property, or services is a Class C felony (first degree). Access without that purpose that causes loss or damage of $300 or more is a Class D felony (second degree).

Access causing loss or damage of less than $300 is a Class A misdemeanor (third degree). Access causing no loss or damage at all is still a Class B misdemeanor (fourth degree), so the statute does not require any resulting harm to establish criminal liability, only the absence of effective consent. Separately, knowingly receiving, concealing, or using data or property obtained through a first-degree violation is its own Class C felony (misuse of computer information).

Effective consent is defined at KRS 434.840 and is not effective when induced by deception or coercion or given by a person not authorized to act for the owner, so deceptively circumventing a login, paywall, or other access control falls within the statute regardless of which degree applies.

The statute's text does not expressly except ordinary, unauthenticated access to a publicly available page, and no Kentucky court decision construing the without-effective-consent standard as applied to automated collection of public web content has been located.

The Kentucky Consumer Data Protection Act (KCDPA), in force since January 1, 2026, defines personal data as information linked or reasonably linkable to an identified or identifiable natural person, and expressly excludes de-identified data and publicly available information from that definition.

Publicly available information means information lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it, unless the consumer has restricted it to a specific audience.

This places most scraped public personal data outside the KCDPA's coverage at the definitional level, the same approach Virginia's parallel statute takes.

The Act applies only to a person conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that controls or processes the personal data of 100,000 or more consumers a year, or of 25,000 or more while deriving over half of gross revenue from selling personal data, and it expressly excludes a city, state agency, or other political subdivision.

The Act's consumer rights, controller and processor duties, and Attorney General enforcement are personal-data duties rather than scraping law.

Commercial entities that knowingly publish or distribute matter harmful to minors on a website containing a substantial portion of such material must perform reasonable age verification of Kentucky users.