KentuckyHB 6922026 Regular SessionHouse

AN ACT relating to data privacy.

Sponsored By: Josh Branscum (Republican)

Signed by Governor

Attorney GeneralConsumer ProtectionData ProtectionEconomic DevelopmentEffective Dates, DelayedInformation TechnologyTechnologyTelecommunications

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

4 provisions identified: 4 benefits, 0 costs, 0 mixed.

Clear notices, opt-outs, and rights

You get a clear privacy notice that lists the data collected, why it is used, how to use your rights, and who it is shared with. If a company sells your data or uses it for targeted ads, it must say so and tell you how to opt out. Companies must offer at least one secure way to send rights requests and cannot force you to open a new account. They may not deny service, raise prices, or lower quality because you used these rights. Contract terms that try to waive these rights are void, and the rights apply to Kentucky residents acting as individuals beginning July 1, 2027.

Collect less data, boost security

Beginning July 1, 2027, companies must only collect data that is adequate, relevant, and reasonably needed for the purpose they told you. They cannot use your data for new, incompatible purposes without your consent. They must also protect your data with reasonable security steps.

Consent for sensitive personal data

You must give consent before companies process your sensitive data. Sensitive data includes race, religion, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify you, a known child’s data, and precise location within 1,750 feet. Biometric data includes fingerprints, voiceprints, retinas, or irises when used to identify you. Photos, video, or audio are not biometric unless used to identify you. These rules begin July 1, 2027.

Consent for smart TV tracking

Beginning July 1, 2027, companies must get your consent before collecting automatic content recognition (ACR) data. ACR data is information about what you watch, found by matching audio or video in real time. The rule applies to smart TVs and smart monitors. Voice assistants and mobile phones are not treated as smart monitors under this law.

Sponsors & Cosponsors

Sponsor

Josh Branscum
Republican • House

Cosponsors

Steve Bratcher
Republican • House
William Lawrence
Republican • House

Roll Call Votes

All Roll Calls

Yes: 218 • No: 0

House vote • 3/31/2026

passed

Yes: 88 • No: 0

Senate vote • 3/31/2026

3rd reading, passed

Yes: 38 • No: 0

House vote • 3/13/2026