Kentucky residents gained significant new privacy rights on January 1, 2026, when the Kentucky Consumer Data Protection Act (KCDPA) took effect. This comprehensive privacy law gives you the legal right to opt out of data sales, delete your personal information, and control how companies use your data. Here's everything you need to know about exercising those rights.
The Kentucky Consumer Data Protection Act (KCDPA)
The KCDPA is one of the newest comprehensive state privacy laws in the United States, joining Indiana and Rhode Island as states whose privacy laws took effect on January 1, 2026. The law applies to companies that conduct business in Kentucky or target Kentucky residents and meet one of these thresholds:
- Control or process personal data of at least 100,000 consumers annually, OR
- Control personal data of at least 25,000 consumers while deriving more than 50% of gross revenue from selling that data
What This Means for You
Most major data brokers and people-search sites meet these thresholds, meaning they must comply with the KCDPA and honor your opt-out requests. You now have a legal right — backed by the Kentucky Attorney General — to demand data brokers stop selling your information.
Your Rights Under the KCDPA
The Kentucky Consumer Data Protection Act grants you five core rights:
- Right to Access — You can request to see what personal data a company has collected about you
- Right to Correct — You can demand that inaccurate personal data be corrected
- Right to Delete — You can request deletion of your personal data
- Right to Data Portability — You can obtain a portable copy of your data
- Right to Opt Out — You can opt out of targeted advertising, data sales, and certain profiling
The Opt-Out Right Explained
The opt-out right is particularly powerful for dealing with data brokers. Under the KCDPA, you can opt out of:
- Sale of personal data — Any transfer of your data to third parties for monetary consideration
- Targeted advertising — Ads based on your personal data and browsing activity
- Profiling — Automated decision-making that produces legal or similarly significant effects
How to Exercise Your KCDPA Rights
Step 1: Identify Data Brokers With Your Information
Search for yourself on major people-search sites. Common brokers that list Kentucky residents include Spokeo, BeenVerified, Whitepages, TruePeopleSearch, Radaris, PeopleFinder, and Intelius. Also check property record aggregators like PropertyShark and background check sites like Instant Checkmate.
Step 2: Submit Formal Opt-Out Requests
Under the KCDPA, companies must provide at least one clear method for submitting opt-out requests. When submitting your request:
- Clearly state you are a Kentucky resident exercising your KCDPA rights
- Specify that you are opting out of the sale of your personal data
- Request deletion of your personal information
- Keep records of your requests and any confirmation numbers
Step 3: Wait for the Response
Companies must respond to your request within 45 days. They may extend this by an additional 45 days if reasonably necessary, but must inform you of the extension. If a company denies your request, they must explain why and provide instructions for appealing.
Step 4: Appeal If Necessary
If a data broker denies your request, you can appeal. If the appeal is also denied, you can file a complaint with the Kentucky Attorney General's office, which has exclusive enforcement authority under the KCDPA.
Important: Sensitive Data Gets Extra Protection
Under the KCDPA, companies must obtain your explicit opt-in consent before processing sensitive data, including racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship status, genetic or biometric data, and precise geolocation. If a data broker is sharing this type of information without your consent, they may already be in violation of the law.
Enforcement and Penalties
The Kentucky Attorney General has exclusive enforcement authority under the KCDPA. The process works as follows:
- The AG identifies a potential violation
- The company receives 30 days written notice to cure the violation
- If the company fails to cure, the AG can pursue civil penalties up to $7,500 per violation
While you cannot sue companies directly under the KCDPA, filing a complaint with the Attorney General's office can trigger enforcement actions.
Major Data Brokers and Their Kentucky Opt-Out Pages
Here are the opt-out methods for brokers most commonly listing Kentucky residents:
- Spokeo — Online opt-out form requiring email verification
- BeenVerified — Online opt-out tool on their website
- Whitepages — Online suppression request form
- TruePeopleSearch — Email-based removal process
- Radaris — Online removal request with identity verification
- Intelius — Online opt-out form
- PeopleFinder — Online opt-out requiring phone verification
Why Manual Opt-Outs Aren't Enough
Even with the KCDPA backing your requests, manually opting out of every data broker is an ongoing battle. Data brokers continuously re-collect information from public records, social media, and commercial data sources. Many Kentucky residents find their information reappearing within weeks or months of a successful removal.
How PrivacyOn Helps Kentucky Residents
PrivacyOn automates the entire opt-out process across 100+ data broker sites, leveraging your KCDPA rights to ensure maximum effectiveness. The service continuously monitors for your information, submits removal requests backed by your legal rights under Kentucky law, and re-checks to catch any reappearing data. With family plans covering up to 5 people and 24/7 monitoring starting at $8.33/month, PrivacyOn makes it easy to exercise your new Kentucky privacy rights without the manual effort.