Kentucky CDPA requirements
Kentucky's law took effect January 1, 2026 and is another Virginia-model statute: a 100,000-consumer threshold (25,000 with majority revenue from data sales), opt-outs of targeted advertising, sale, and profiling, opt-in consent for sensitive data, and data protection assessments for higher-risk processing. There is no universal opt-out signal requirement and no private right of action. The Attorney General enforces, with a permanent 30-day cure period and penalties of up to $7,500 per violation. Kentucky, Indiana, and Rhode Island all went live on the same day, and Oklahoma and Louisiana follow on January 1, 2027, which makes each new year a natural checkpoint to verify that the opt-out flows on every property behave the way the privacy notice says they do.
Kentucky CDPA articles and analysis
IAB Multi-State Privacy Agreement (MSPA) Update 2026: What Advertisers Need to Know
A report out of Carnegie Mellon’s School of Public Policy found that “87% (216 million of 248 million) of the population in the United States...
Read More
U.S. Privacy Laws (and Key Provisions) That Take Effect or Become Enforceable in 2026
2026 is a turning point in U.S. privacy regulation: multiple new comprehensive state laws go live, enforcement provisions activate, and novel mechanisms (like the California...
Read More
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.