KY HB 15 (2024) / KRS 367.390 et seq.
Applies to businesses processing data of 100,000+ Kentucky residents or 25,000+ deriving 50%+ revenue from data sales. Consumer rights: access, correct, delete, portability, opt-out of targeted advertising, data sales, and significant-effect profiling. Opt-in consent required for sensitive data. Data protection impact assessments for certain processing activities. AG has exclusive enforcement authority; 30-day cure period; $7,500 per violation.