Does Kentucky's Consumer Data Protection Act apply to your business?

Kentucky joined the group of states with a comprehensive privacy law when it passed House Bill 15 in 2024, and it takes effect on January 1, 2026. The applicability test follows the pattern most states use, so if you have mapped another state on the same model you already know the shape of the question. What matters is your Kentucky consumer count and, on the second branch, how much of your revenue comes from selling data.

Who the Kentucky Consumer Data Protection Act covers

Under KRS 367.3613, the act applies to a person that conducts business in Kentucky, or produces products or services targeted to Kentucky residents, and that during a calendar year controls or processes the personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data. Both branches count only Kentucky residents acting in a personal capacity, not employees or business contacts. There is no dollar revenue floor, so a smaller company that clears the consumer count is in.

How Kentucky compares to other states

The 100,000 and 25,000-plus-50-percent structure is the same one used by Virginia's VCDPA and Indiana's Consumer Data Protection Act. That makes Kentucky easy to slot into an existing analysis if you already track those states. It sits at the higher end of the threshold range, well above the 35,000-consumer laws in states like Connecticut and Delaware, so a business below the Kentucky line can still be covered elsewhere.

Who is carved out

KRS 367.3613 exempts whole categories of organization: cities, state agencies and political subdivisions, GLBA financial institutions and their affiliates, HIPAA covered entities and business associates, nonprofit organizations, and institutions of higher education. It also carves out certain insurance-fraud and first-responder organizations and some small utilities. These are entity-level exemptions, so a covered nonprofit sits outside the act even when it processes data on many people. The US state privacy laws hub lines Kentucky up against the other states so you can see where the thresholds differ.

Next step

Because Kentucky uses a consumer count rather than a revenue-size floor, the honest answer to "does it apply?" depends on numbers you may not track by state. The free 2-minute Obligation Scan checks the KRS 367.3613 test against your business and flags the notice, opt-out, and assessment duties that follow, so you can prepare for the January 1, 2026 start date rather than guess.