I will be posting an analysis at a later date.

HB 24

“Creates new sections of KRS Chapter 367 to establish consumer rights relating to personal data, including the rights to confirm whether data is being processed, to delete personal data provided by the consumer, to obtain a copy of the consumer’s personal data that was previously provided, and to opt out of targeted advertising and the sale of data; define terms; set forth the types of data and the persons or entities to which the statutory provisions do and do not apply; set forth requirements for persons or entities that control and process consumer data; establish that the Attorney General has exclusive authority to enforce the consumer data privacy rights; create a consumer privacy fund in the State Treasury to be administered by the Office of the Attorney General; EFFECTIVE January 1, 2026.”

HB 201

“Create new sections of KRS Chapter 367 to define terms; require a private entity to develop a written policy and retention schedule for the biometric identifiers it collects; create restrictions on the collection, capture, purchase, or trade of biometric identifiers; require disclosure of biometric identifier information per individual request; create a civil cause of action; clarify statutory construction; provide that the Act may be cited as the Biometric Identifiers Privacy Act.”

HB 45

“Create a new section of KRS Chapter 189 to define terms related to automated license plate readers; establish limitations on use and sale of data captured by automated license plate readers; create a new section of KRS Chapter 183 to define terms and establish limitations on the use of an unmanned aircraft system; create a new section of KRS Chapter 411 to establish a cause of action for the unauthorized use of an unmanned aircraft system; create a new section of KRS Chapter 413 to establish a statute of limitations for an action filed for the unauthorized use of an unmanned aircraft system; create a new section of KRS Chapter 411 to define terms and establish limitations on “deep fakes”; create a new section of KRS Chapter 413 to establish a statute of limitations for an action filed for the unlawful dissemination of a deep fake; create a new section of KRS Chapter 411 to define terms and establish limitations on the introduction of identification devices on or within the human body; create a new section of KRS Chapter 413 to establish a statute of limitations for an action filed for introduction of an identification device; create a new section of KRS Chapter 519 to establish a criminal penalty for illegally disseminating a deep fake; amend KRS 508.152, relating to the unlawful use of tracking devices, to include the installation of a tracking device on the person or property of another without their consent and exempt parental tracking of minors from the prohibition.”

SB 15

“Create new sections of KRS Chapter 367 to define terms; set the parameters for applicability of this Act; define various consumer rights related to data collection; require a data controller to comply with a consumer request to exercise those rights; require controllers to establish a process for consumers to appeal a controller’s refusal to act on a consumer’s request to exercise a right; set forth requirements for persons or entities that control or process personal data; require persons who control data to conduct data protection impact assessments; establish that the Attorney General has exclusive authority to enforce this Act and shall provide a controller or processor 30 days’ written notice identifying the specific provisions that were violated; provide that if a controller or processor does not cure a violation within 30 days, the Attorney General may initiate an action and seek damages for up to $7,500 for each violation; create a consumer privacy fund in the State Treasury to be administered by the Office of the Attorney General and direct that all civil penalties collected with regard to enforcement actions be deposited in the fund; amend KRS 367.240 to conform; provide that the Act may be cited as the Kentucky Consumer Data Protection Act; EFFECTIVE January 1, 2026.”