Law / United States / Kentucky
Kentucky Consumer Data Protection Act, publicly available information exclusion
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 8 months, effective 1 January 2026.
A personal data rule binding private bodies.
As of 6 September 2026.
What it requires
- Personal data that is lawfully made available through a government record, or that you have a reasonable basis to believe is lawfully made available to the public through widely distributed media, by the consumer, or by someone the consumer disclosed it to, falls outside the KCDPA's definition of personal data, unless the consumer restricted it to a specific audience.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Kentucky Consumer Data Protection Act (KCDPA), in force since January 1, 2026, defines personal data as information linked or reasonably linkable to an identified or identifiable natural person, and expressly excludes de-identified data and publicly available information from that definition.
Publicly available information means information lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it, unless the consumer has restricted it to a specific audience.
This places most scraped public personal data outside the KCDPA's coverage at the definitional level, the same approach Virginia's parallel statute takes.
The Act applies only to a person conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that controls or processes the personal data of 100,000 or more consumers a year, or of 25,000 or more while deriving over half of gross revenue from selling personal data, and it expressly excludes a city, state agency, or other political subdivision.
The Act's consumer rights, controller and processor duties, and Attorney General enforcement are personal-data duties rather than scraping law.
When LexLint raises it
crawls_webtrains_models