United States of America: Act amending Kentucky Revised Statutes on data privacy including data protection regulation was adopted by Kentucky General Assembly

On 31 March 2026, the Kentucky Senate passed the Bill amending Kentucky Revised Statutes on data privacy (HB 692) with Committee Substitute (1), and the Kentucky House of Representatives concurred, completing adoption of the Act amending Kentucky Revised Statutes on data privacy (HB 692). The Committee Substitute revised the definition of "automatic content recognition" into "automatic content recognition data," narrowing it to mean data about a consumer's content viewing history collected through technology identifying, in real time, the specific content displayed by analysing audio or video fingerprints through digital fingerprinting, watermark detection, or similar comparison techniques, excluding data collected about a consumer's interactions with content provided by the controller's own services, data generated in the course of providing a feature or service requested by a consumer, and data collected for the purpose of enforcing terms of service. The Committee Substitute also removed automatic content recognition data from the definition of "sensitive data," leaving four categories: personal data indicating racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify a natural person, personal data collected from a known child, and precise geolocation data. The consumer rights, non-discrimination, and privacy notice provisions were unchanged by the Committee Substitute. The Act amends KRS 367.3617 to prohibit controllers from collecting automatic content recognition data without a consumer's consent, from discriminating against consumers for exercising consumer rights under KRS 367.3615, and from processing personal data in violation of laws prohibiting unlawful discrimination. Controllers are required to establish secure and reliable means for consumers to submit requests to exercise consumer rights under KRS 367.3615 and to provide a reasonably accessible, clear, and meaningful privacy notice disclosing categories of personal data processed, processing purposes, third-party sharing, and mechanisms for exercising consumer rights, including the right to opt out of personal data sales and targeted advertising. Any contractual provision purporting to waive or limit consumer rights under KRS 367.3615 is void and unenforceable. The Act takes effect on 1 July 2027.