Law note · Kentucky
Kentucky Consumer Data Protection Act, Attorney General enforcement
The Kentucky Attorney General has exclusive authority to enforce KCDPA. Before suing, the Attorney General must give a controller or processor 30 days' written notice; curing the violation and confirming the cure in writing bars an action, and this 30-day cure period is permanent, unlike New Hampshire's and Rhode Island's time-limited or absent versions. An uncured, continuing violation is subject to damages of up to $7,500 per violation, and the statute creates no private right of action.
What it asks of an app
- Expect KCDPA violations to be enforced exclusively by the Kentucky Attorney General, never by a private plaintiff.
- Cure a noticed violation and confirm the cure in writing within 30 days of Attorney General notice to avoid damages of up to $7,500 per continued violation.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Kentucky statute text, KRS chapter 367, Kentucky Legislature website