Keypoint: Kentucky is the fifteenth state to pass consumer data privacy legislation with a bill that largely tracks the Virginia Consumer Data Protection Act.

On March 27, 2024, the Kentucky legislature passed the Kentucky Consumer Data Protection Act (HB 15). The bill unanimously passed the House on February 20. The Senate passed the bill on March 11, but with two minor floor amendments. On March 27, the House unanimously concurred in the Senate floor amendments. The bill now heads to Kentucky Governor Andy Beshear. Assuming the bill becomes law, Kentucky will become the fifteenth state to enact consumer data privacy legislation.

The Kentucky bill largely tracks the Virginia Consumer Data Protection Act (VCDPA) but without this year’s VCDPA amendments relating to children’s data. For entities already complying with other non-California privacy laws, the Kentucky bill will not require any additional compliance burdens. The bill does contain small variations from the VCDPA, which we discuss below.

As with prior bills, we have added the Kentucky bill to our chart providing a detailed comparison of laws enacted to date.