Kentucky data privacy and data broker removal
Kentucky has a comprehensive privacy law that gives you the right to access, delete, and control your personal data. Here's how those rights work in practice, and how to remove yourself from data brokers.
At a glance
- Comprehensive privacy law? Yes: Kentucky Consumer Data Protection Act (KCDPA)
- In effect since January 1, 2026
- Your core rights Access & Know, Correct, Delete, Data Portability +4 more
- Honors Global Privacy Control? No
- Data-broker registry? No
- Can you sue? (private right of action) No
- Enforced by Kentucky Attorney General
What Delist can do for you in Kentucky
Kentucky has a comprehensive privacy law, the Kentucky Consumer Data Protection Act (KCDPA), but it does not recognize authorized agents. We submit your requests on your behalf and say so in each one. A broker may decline and ask you to submit and verify directly; when that happens we tell you and show you exactly what to send.
Basis: KRS § 367.3611 et seq. (KCDPA). Reviewed September 1, 2026. How the three groups work: our authorized-agent framework.
Your rights in Kentucky
Kentucky residents are protected by the Kentucky Consumer Data Protection Act (KCDPA).
- Right to Access & Know: Request a copy of the personal information a company holds about you.
- Right to Correct: Request corrections to inaccurate personal information.
- Right to Delete: Ask a company to delete your personal information.
- Right to Data Portability: Get your data in a portable format you can take to another service.
- Right to Opt Out of Sale: Tell a company to stop selling your personal information.
- Right to Opt Out of Targeted Advertising: Stop companies from targeting you with ads based on your personal data.
- Right to Opt Out of Profiling: Stop companies from building a behavioral profile about you.
- Right to Appeal: Challenge a company's decision to deny your privacy request.
Does this cover the company that has my data?
The KCDPA covers companies doing business in Kentucky that, in a year, control or process the personal data of at least 100,000 Kentucky consumers, or at least 25,000 consumers while earning more than half their gross revenue from selling personal data. Most large data brokers meet one of these thresholds.
- The KCDPA took effect January 1, 2026.
- House Bill 473 (2025) expanded health-care exemptions and narrowed the profiling-assessment rules. Data-protection assessments apply to processing that begins on or after June 1, 2026.
- Kentucky created an Office of Data Privacy inside the Attorney General's office.
How to remove yourself from data brokers in Kentucky
Your state law gives you the right to request deletion. Exercising it everywhere your information shows up takes real effort. Here are the most effective steps, in order.
1. Enable Global Privacy Control
Global Privacy Control is a free browser setting that automatically tells every website you visit not to sell or share your data. It takes a couple of minutes to turn on and then works in the background on every site. Kentucky does not mandate it yet, but many companies honor it voluntarily because they already comply with California's law.
2. Submit direct opt-out requests
You can also opt out at each company directly. Look for the "Do not sell my personal information" link in the website footer, and submit access, deletion, or correction requests through each company's privacy policy page.
Under Kentucky's law, covered companies must respond within the deadline the statute sets. If they don't, you have grounds to file a complaint with the Kentucky Attorney General.
3. Keep the removals going
A broker may later ingest a new record from public records, data-sharing networks, or commercial databases. Re-listing timing varies by broker and source, so periodic checks matter.
Delist finds where your information is exposed, files removals on your behalf, and re-runs a full scan every month and re-files when a listing comes back. Start with a free scan to see what's out there.
Run a free scan →Kentucky's data broker law: what it means for you
Kentucky has no dedicated data-broker registry. Most national brokers are registered in California and honor opt-out requests from residents of any state, but without a Kentucky law requiring it, you have little recourse if a broker ignores you. Delist handles this across brokers in one place.
Other privacy protections in Kentucky
Beyond the comprehensive privacy law, Kentucky has a few other protections that may apply to you:
- Address-confidentiality protection for survivors of domestic violence.
- Data-protection assessments apply to processing that begins on or after June 1, 2026 (the House Bill 473 amendment).
- No Daniel's Law-style takedown statute for police, judges, or other public officials.
- Biometric data: Kentucky has no standalone biometric-privacy statute, but biometric data counts as sensitive data under the KCDPA, so companies need your consent to collect it.
How to file a privacy complaint in Kentucky
Kentucky Attorney General, Office of Consumer Protection: https://www.ag.ky.gov/Priorities/Consumer-Protection/
Most state agencies enforce privacy laws in the aggregate. They investigate patterns of violations rather than resolving individual disputes. Filing a complaint still matters: it creates a record that helps trigger enforcement actions.
Frequently asked questions
Does Kentucky have a data privacy law?
Yes. Kentucky residents are protected by the Kentucky Consumer Data Protection Act (KCDPA), which gives you rights to access, delete, and control your personal data.
Can I sue a company for violating my privacy in Kentucky?
Generally no. Privacy enforcement in Kentucky is handled by the Kentucky Attorney General. You cannot sue for most violations.
How do I opt out of data brokers in Kentucky?
Enable Global Privacy Control, submit direct opt-out requests to each broker, and consider a removal service to automate the process. Kentucky has no broker registry.
Does Kentucky require websites to honor Global Privacy Control?
Not yet mandated statewide, but many companies honor GPC voluntarily. Enable it in your browser settings. It costs nothing and signals your opt-out preference automatically.
Sources
This page is privacy-rights information, not legal advice. Privacy law changes frequently; verify current rules with your state privacy agency or a licensed attorney before acting. Last verified 2026-06-22. We re-check state privacy laws quarterly.