Kentucky’s Consumer Data Protection Act (KCDPA) took effect January 1, 2026. As the state’s inaugural comprehensive data privacy law, joining 19 others, it will significantly impact businesses that handle consumer information. Specifically, any business that collects 100,000 or more consumer data points, or collects at least 25,000 and derives 50% of its revenue from selling that data, must comply.

To ring in the 2026 new year, Kentucky will join the 19 other states that have enacted comprehensive state data privacy laws. The Kentucky Consumer Data Protection Act (“the Act”), going into effect January 1, 2026, applies to any person conducting business in Kentucky or anyone producing goods/services that are targeted to Kentucky residents and meet specific thresholds. A whole new group of consumer rights takes effect with the new law and noncompliance can produce new liability for businesses that run afoul of these provisions, so now is the time for all business owners to familiarize themselves with the new law.

What We Saw in 2024:

The Federal Trade Commission routinely develops, amends, and enforces various rules related to consumer protection including transparency and choice requirements, many of which involve consent, privacy, and data security.

The pandemic led people to work from home, connect from home, shop from home, and, for many, entrepreneur from home. With every passing day, people and businesses are more reliant on e-commerce and the internet in general, and, at the same time, people and businesses are more sophisticated about privacy issues. People are now accustomed to seeing cookies notices whenever they land on a website, and they are generally familiar with the idea that websites may be collecting data about them. Many consumers even know that they may have rights to control how a business manages that private information collected.