The law for AI, agents, crawlers, and personal data
Law / Kansas
Kansas
Kansas has required age verification for adult websites since 2024, backed by both attorney general enforcement and a private right of action. An app store accountability bill requiring age verification and parental consent for app downloads by minors passed the Senate in February 2026 and cleared a House committee in March 2026 but died without a House floor vote. No social media minor-access law or design code law has advanced past introduction.
Kansas has no comprehensive consumer personal-data statute.
Its privacy law is sectoral: the Kansas Breach Notification Act (K.S.A. 50-7a01 to 50-7a02) requires notice to affected residents without a fixed numeric deadline and to the Attorney General, with no biometric element in its personal information definition; the Student Data Privacy Act (K.S.A. 72-6312 to 72-6320) requires a school district to obtain written parental or adult-student consent before collecting a K-12 student's biometric data and layers its own immediate breach-notice duty for student data; and a genetic-testing insurance-underwriting statute (K.S.A. 40-2259) bars health-benefit insurers from conditioning coverage or rates on a genetic test result.
No provision creates a private right of action; enforcement runs to the Attorney General (and, for insurers, the insurance commissioner) or, for student data, the Attorney General or a district attorney seeking injunctive relief. Kansas has not adopted the NAIC Insurance Data Security Model Law.
Each one links to its LexLint note, which carries what it requires and what it flags on.
Commercial websites where material harmful to minors appears on 25 percent or more of the webpages viewed in a calendar month must verify that Kansas visitors are 18 or older before granting access.
Note and primary source →Would require app store providers to verify a user's age category at account creation, link minor accounts to a parent account, and require parental consent before minors can download apps. The bill passed the Senate in February 2026 and was reported favorably as amended by a House committee on March 18, 2026, but died without a House floor vote.
Note and primary source →A person conducting business in Kansas, or a government, governmental subdivision, or agency that owns or licenses computerized personal information, must conduct a good-faith, reasonable, and prompt investigation on learning of a suspected breach and, if misuse occurred or is reasonably likely, give notice to the affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay.
The codified text sets no fixed numeric deadline, despite secondary-source claims of a 45-day figure, which does not appear anywhere in K.S.A. 50-7a02. Personal information is a name combined with a Social Security number, driver's license or state ID number, or financial account or card number with access credentials, and excludes publicly available government-record information; it does not reach biometric identifiers.
Notice to each nationwide consumer reporting agency is required when more than 1,000 consumers are affected at one time. Enacted 2006 (L. 2006, ch. 149, sec. 4); no separate effective date beyond that original enactment is recorded here.
What it asks of an app →Layers a narrower, immediate breach-notice duty on top of the general Kansas Breach Notification Act: any entity with access to student data must immediately notify the affected student or the student's parent or guardian of a breach or unauthorized disclosure of student data, with no numeric threshold or deadline given beyond "immediately".
What it asks of an app →The Kansas Attorney General may bring an action in law or equity to address a violation of the Breach Notification Act, except that a violation by an insurance company is enforced solely by the Insurance Commissioner. No provision creates a private right of action, and no clause deems a violation an unfair trade practice under the Kansas Consumer Protection Act, K.S.A. 50-626, which is a freestanding backstop with no textual link to this Act.
What it asks of an app →The Attorney General or any district attorney may enforce K.S.A. 72-6312 through 72-6319 by bringing an action in a court of competent jurisdiction and may seek injunctive relief against any educational agency, its employee or agent, or any other entity in possession of student data. Government enforcement only, injunctive relief, no damages provision, and no private right of action.
What it asks of an app →Bars a health-benefit insurer from requiring, requesting, or using an individual's genetic test results to condition coverage, set rates, or adjust premiums. The restriction does not apply to a life, disability-income, or long-term-care insurer, though even those insurers face a narrower after-acquired-use restriction. This is an insurance-underwriting nondiscrimination statute, not a data-processing or retention duty, and it does not define sensitive data as a category.
What it asks of an app →No school district may collect biometric data from a student, or use a device or mechanism to assess a student's physiological or emotional state, without the written consent of an adult student or the parent or legal guardian of a minor student, K.S.A. 72-6315.
What it asks of an app →The Student Data Privacy Act defines biometric data, K.S.A. 72-6313(b), as one or more measurable biological or behavioral characteristics usable for automated recognition of an individual, such as fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting.
The definition never mentions a photograph, video, or audio recording in either an inclusion or exclusion clause; there is no clause imposing a recording-derived exclusion and none clawing one back, so whether an identifier derived from a recording is covered cannot be determined from this text and is not recorded as either true or false.
What it asks of an app →This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.