Law note · Kentucky
Kentucky Consumer Data Protection Act, consumer rights
KCDPA gives a Kentucky consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling.
A controller must respond without undue delay and in all cases within 45 days of receipt, with one 45-day extension available when reasonably necessary, and must decide an appeal of a denial within 60 days, after which the consumer may complain to the Attorney General.
What it asks of an app
- Give a Kentucky consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Kentucky consumer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official Kentucky statute text, KRS chapter 367, Kentucky Legislature website