KentuckyHB 6922026 Regular SessionHouseWALLET

AN ACT relating to data privacy.

Sponsored By: Josh Branscum (Republican)

Signed by Governor

Attorney GeneralConsumer ProtectionData ProtectionEconomic DevelopmentEffective Dates, DelayedInformation TechnologyTechnologyTelecommunications

Your PRIA Score

Score Hidden

Personalized for You

How does this bill affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this bill and every other piece of legislation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Bill Overview

Analyzed Economic Effects

7 provisions identified: 6 benefits, 0 costs, 1 mixed.

Clear privacy notices and easy requests

Beginning July 1, 2027, companies that serve Kentucky residents must give a clear privacy notice. It must list what data they process, why, how to use your rights, and how to appeal a decision. Companies must also offer secure, reliable ways to send requests. They cannot make you create a new account to use your rights.

Collect less data and keep it secure

Beginning July 1, 2027, companies may collect only the personal data that is adequate, relevant, and reasonably needed for stated purposes. They cannot use your data for new, incompatible purposes without your consent. They must keep reasonable administrative, technical, and physical security based on the type and amount of data.

Consent for sensitive and children data

Beginning July 1, 2027, companies must get your consent before processing sensitive data. Sensitive data includes race, religion, health diagnoses, sexual orientation, and citizenship or immigration status. It also includes genetic or biometric data used to identify you, data from a known child, and precise location. Precise location means within 1,750 feet. For known‑child data, processing must follow COPPA rules.

Consent needed for smart TV tracking

Beginning July 1, 2027, companies must get your consent before collecting automatic content recognition (ACR) data from smart TVs or smart monitors. The law defines ACR as data made by real‑time audio or video fingerprinting. It excludes data from the company’s own services, features you asked for, and terms‑of‑service enforcement. The law also defines what counts as a smart monitor, and it does not include voice assistants or mobile phones.

No discrimination or contract waivers

Beginning July 1, 2027, companies cannot process data in ways that break anti‑discrimination laws. They cannot deny service, charge more, or lower quality because you used your privacy rights. They may offer different prices for voluntary loyalty, rewards, premium features, discounts, or club cards. Any contract term that tries to waive your privacy rights is void.

Protections apply to Kentucky residents

Starting July 1, 2027, a consumer is a Kentucky resident acting in a personal capacity. These privacy protections do not cover activity in a work or business role.

Control data sales and targeted ads

Beginning July 1, 2027, companies that sell your data or use it for targeted ads must clearly say so and show how you can opt out. The law also defines a “sale” as giving personal data to a third party for money, and it lists exceptions like sharing with processors, affiliates, or to provide a service you asked for.

Sponsors & Cosponsors

Sponsor

Josh Branscum
Republican • House

Cosponsors

Steve Bratcher
Republican • House
William Lawrence
Republican • House

Roll Call Votes

All Roll Calls

Yes: 218 • No: 0

Senate vote • 3/31/2026

3rd reading, passed

Yes: 38 • No: 0

House vote • 3/31/2026

passed

Yes: 88 • No: 0

House vote • 3/13/2026