Kentucky Consumer Data Protection Act Checklist

The Kentucky Consumer Data Protection Act took effect on January 1, 2026, and for most websites the hard part isn't legal interpretation. It's knowing what your own pages send, and to whom, because your privacy notice is a set of claims about your tags and the statute expects those claims to be true.

A note before the checklist: this is engineering guidance, not legal advice, and Baclion is not a law firm. Whether the act applies to your organization, how to classify your vendors, and what your notice must say are questions for your counsel. What follows is the evidence counsel will ask for, and the fixes that usually follow.

Check whether the act reaches you

The act applies to businesses that operate in Kentucky or target products or services to Kentucky residents and that, in a calendar year, control or process the personal data of at least 100,000 Kentucky consumers. The threshold drops to 25,000 consumers for businesses that get more than half of their gross revenue from selling personal data. "Consumer" means a Kentucky resident acting as an individual, not in a commercial or employment role.

There are entity-level exemptions, including government bodies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofits, and higher-education institutions, plus a long list of exempt data types.

Two engineering points matter here. First, "processing" includes collection, and "personal data" means information linked or reasonably linkable to an identifiable person, so analytics identifiers and advertising cookies belong in the conversation. Second, your analytics can estimate Kentucky visitors, but visitors are not consumers. Agree with counsel on how to count before anyone quotes a number.

Enforcement belongs to the Attorney General alone, and there is no private right of action. Before suing, the Attorney General must send written notice, and the business then has 30 days to cure. That's a short window for a team that doesn't already know what its tags do, which is the best argument for building the inventory now.

Inventory every tag and what it sends

Start with every source of third-party code: tag manager containers (export them), scripts hard-coded in templates, CMS plugins, embedded iframes, and server-side integrations that forward form data to a CRM or email platform. Then load your key templates in a clean browser profile, once with consent declined and once with it accepted, and record what leaves the page. This console snippet lists third-party requests and the parameter names they carry:

const site = location.hostname.split('.').slice(-2).join('.');
const rows = performance.getEntriesByType('resource')
  .map((entry) => new URL(entry.name))
  .filter((url) => !url.hostname.endsWith(site))
  .map((url) => ({
    host: url.hostname,
    path: url.pathname,
    params: [...url.searchParams.keys()].join(', '),
  }));
console.table(rows);

Then read the payloads. These findings surprise people most often:

Full page URLs with query strings, carrying search terms, order numbers, or an email address someone put in a link.
Hashed email addresses sent by an advertising pixel's "advanced matching" feature.
Form field values captured by session-replay tools that weren't configured to mask them.
Page paths and titles that reveal sensitive context, such as a condition-specific appointment page.
Precise location from a store locator, which the statute treats as sensitive data.

Record each tag in one row:

Tag	Fires on	Before consent?	Data sent	Purpose	In the notice?
Analytics	All pages	Yes	URL, client ID, device	Measurement	Yes
Ad pixel	All pages	Yes	URL; hashed email at checkout	Retargeting	No
Session replay	Checkout	After consent	Clicks; inputs unmasked	Debugging	Partly
Chat widget	All pages	Yes	URL, transcript	Support	No

Map where the data goes, in the statute's terms

Counsel will apply the statute's definitions to each destination. Your job is to supply the facts each one turns on.

Processor or third party? A processor handles data on your instructions. A vendor that uses your visitors' data for its own purposes is likely something else. Note what each contract and each vendor's documentation say about how the data is used.
Sale? The act defines a sale as exchanging personal data with a third party for monetary consideration, with exclusions such as disclosures to processors.
Targeted advertising? The definition covers ads selected using data from a consumer's activity over time across nonaffiliated websites or apps. It excludes ads based on activity on your own sites, contextual ads, and processing solely to measure ad performance. A cross-site retargeting pixel and an on-site "recommended for you" block land on different sides of that line.
Sensitive data? The act lists categories including health diagnosis, racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, biometric or genetic data used for identification, data collected from a known child, and precise geolocation. Processing sensitive data requires consent.

Draw the result on one page: browser, your servers, and every vendor, with the data elements written on each arrow. It's the most useful artifact in the whole project.

Make the privacy notice match the network log

The act requires a "reasonably accessible, clear, and meaningful" privacy notice that covers the categories of personal data you process, your purposes, how consumers can exercise their rights and appeal a decision, the categories of data you share with third parties, and the categories of those third parties. If you sell personal data or process it for targeted advertising, you must disclose that clearly and conspicuously, along with how to opt out.

Treat this as a diff. Every vendor category in your inventory should map to something in the notice, and every sentence in the notice should survive the network log. The common mismatches are a notice written before the chat widget arrived, a "we do not use advertising cookies" line beside a firing ad pixel, and a rights section whose request link returns a 404.

The statute doesn't define "reasonably accessible" in WCAG terms, and we won't pretend it does. Still, a notice published as a scanned PDF, or as text inside an image, is hard to defend as accessible to anyone using a screen reader. Use real HTML with headings, link it from every page, and read it on a phone.

Build request and opt-out paths that work for everyone

Consumers can ask to confirm and access their data, correct it, delete it, get a portable copy, and opt out of targeted advertising, sale, and certain profiling. You must offer one or more secure and reliable ways to submit those requests, describe them in the notice, and not require anyone to create a new account to use them. The statute also sets deadlines for responses and for appeals. Put them in whatever system tracks the requests, so nobody counts days by hand.

A request form that a screen reader user can't complete is a rights mechanism that doesn't work for some of your consumers. The basics:

<form action="/privacy/requests" method="post">
  <fieldset>
    <legend>What would you like us to do?</legend>
    <label><input type="radio" name="request" value="access" required> Show me the personal data you hold</label>
    <label><input type="radio" name="request" value="correct"> Correct my personal data</label>
    <label><input type="radio" name="request" value="delete"> Delete my personal data</label>
    <label><input type="radio" name="request" value="opt-out"> Stop targeted advertising and sale of my data</label>
  </fieldset>
  <label for="request-email">Email address</label>
  <input id="request-email" name="email" type="email" autocomplete="email" required
         aria-describedby="request-email-hint">
  <p id="request-email-hint">We use this only to verify and answer your request.</p>
  <button type="submit">Send request</button>
  <p role="status" id="request-status"></p>
</form>

Skip puzzle CAPTCHAs, which shut out many people with disabilities; rate limits and a hidden honeypot field stop most spam without a test. Keep an email address or phone number as a second channel.

Opt-out mechanics are where engineering usually breaks. The preference gets saved, and the pixel fires anyway because it's hard-coded in a template or the tag manager trigger ignores the flag. Gate the loading itself:

const optedOut =
  localStorage.getItem('privacy.ads-opt-out') === 'true' ||
  navigator.globalPrivacyControl === true;

if (!optedOut) {
  loadScript(AD_PIXEL_SRC); // never reached after an opt-out
}

Then test it. Opt out, reload two templates, and confirm in the Network panel that nothing goes to the ad platforms, including through server-side forwarding. The act as passed in 2024 doesn't mention browser signals such as Global Privacy Control, so ask counsel whether to honor them. Several other states require it, and the cost is one line of the snippet above.

Track processors and assessment triggers

The act requires a binding contract with each processor that sets out processing instructions, the nature and purpose of the processing, the type of data, the duration, and both parties' rights and obligations. The contract must also cover confidentiality, deletion or return of data when the service ends, cooperation with reasonable assessments, and the same terms for any subcontractors. Engineering's contribution is a vendor register joined to the tag inventory: vendor, tag IDs, data received, contract on file, owner, and renewal date. A tag with no contract behind it is the first thing counsel will ask about.

The act also requires documented data protection assessments for processing for targeted advertising, sale of personal data, profiling that carries certain foreseeable risks, processing of sensitive data, and any processing with a heightened risk of harm. The assessment duty covers processing activities created on or after June 1, 2026, so new campaigns and new tags are the ones most likely to need one. The practical fix is procedural. Add a question to your tag request form ("Does this tag support targeted advertising, sell data, or touch sensitive data?") and open an assessment ticket whenever the answer is yes.

What to do this month

Export your tag manager containers, run the snippet above on your five busiest templates, and fill in the inventory table. Hand the result to counsel along with your current privacy notice. If you'd like help, our tag and script governance audit builds that inventory with consent timing for every tag, starting at $3,600. A digital estate audit finds the microsites and old landing pages whose tags nobody has looked at in years.

A website owner's technical checklist for Kentucky's privacy law