Lexology May 20, 2024
Cozen O'Connor

On April 4, Governor Andy Beshear signed the Kentucky Consumer Data Protection Act (KCDPA), making Kentucky the fifteenth state to enact a comprehensive data privacy law. Set to go into effect on January 1, 2026, the KCDPA largely conforms to the majority of other recently enacted state data privacy laws. In particular, the law seems to have been modeled on a neighboring state: Virginia’s Consumer Data Protection Act (VCDPA). The KCDPA does, however, deviate from the majority approach in a few notable ways.

Kentucky’s applicability thresholds mirror those found in the VCDPA. The KCDPA applies to anyone who does business in Kentucky and controls or processes the personal data of either:

  1. at least 100,000 Kentucky consumers or
  2. 25,000 Kentucky...

Today's Sponsors


Today's Sponsor


Topics: Govt Agencies, Healthcare System, Privacy / Security, States
American privacy rights act on the move with significant amendments
Enforcing Respect for Patients
Sticky Situation: Vermont Governor Puts the Lid on Privacy Bill
Why we should listen to developers for AI privacy regulation
Microsoft’s Copilot+ AI PCs: Still a privacy disaster waiting to happen

Share This Article