Amend KRS 367.3611 to define "actual knowledge," "algorithmic feed," "algorithmic recommendation system," "covered design feature," "covered minor," "covered online service," "dark pattern," "knows to be a child," "knows to be a minor," "minor," "online service," "parent," "personalized recommendation system," "publicly available information," and "user"; create a new section of KRS 367.3611 to 367.3629, the Kentucky Consumer Data Protection Act, to require a covered online service to configure all default privacy settings provided to a covered minor through its online service, product, or feature to the highest level of privacy; provide a covered minor and his or her parents with certain default settings and tools to protect the minor from profiling, targeted advertising for prohibited products, or the use of dark patterns to impair a covered minor's choice; prohibit the use of notifications and push alerts to a covered minor between certain days and times; amend KRS 367.3613 to conform; provide that Section 2 of the Act may be cited as the Kentucky Kid's Code.
Create new sections of KRS Chapter 367 to establish consumer rights relating to social media and artificial intelligence data; define terms; require social media companies and model operators to implement data interoperability interfaces; establish requirements for data sharing between social media services and artificial intelligence systems; grant rulemaking authority to the Attorney General, along with the Consumers' Advisory Council, and enforcement authority to the Office of the Attorney General; provide for civil penalties: provide that the Act may be cited as the Kentucky Digital Choice Act.
Amend KRS 367.3611, relating to the Kentucky Consumer Data Protection Act, to define "automatic content recognition" and "smart monitor" and to include automatic content recognition data in the definition of "sensitive data"; EFFECTIVE July 1, 2027.
Create new sections of KRS Chapter 194A to establish the Kentucky statewide health data utility; define terms; establish purposes and a restricted fund for the utility; require the executive director of the Office of Data Analytics to be responsible for the development, implementation, operation, and maintenance of the utility, contract with a consortium of public health colleges to operate and govern the utility, and promulgate administrative regulations to carry out those duties; establish functions and content of utility; create a consortium of public health colleges; establish duties of consortium in operating and governing the utility; establish administration and operation requirements for the consortium; establish the Kentucky Health Information Technology Board; require the board to establish policies and procedures for the sharing and submission of health information, approve data control, governance, and privacy practices, and advise the executive director and the consortium; require the utility's participants to comply with health information sharing and submission requirements within certain timeframes; require the secretary of the Cabinet for Health and Family Services to enforce the mandatory reporting requirements for the utility's participants; establish enforcement powers of secretary including civil penalty assessment; require the consortium and the executive director to make annual reports relating to the utility; amend KRS 194A.030, 194A.101, 194A.103, 194A.095, 205.640, 205.6489, 211.474, 214.375, and 311A.190 to conform; repeal KRS 216.2920, 216.2921, 216.2923, 216.2925, 216.2927, and 216.2929, relating to health data collection; establish timeframe for making initial appointments, and provide for staggered appointments to the board; require the Cabinet for Health and Family Services or the Department for Medicaid Services to seek federal approval if it is determined that such approval is necessary; provide authorization from the General Assembly to make changes in the Medicaid program as required under KRS 205.5372(1); EFFECTIVE, in part, July 1, 2028.
Amend KRS 367.3611 to define "automated-decision system," "base price," "individualized data," and "surveillance pricing"; amend KRS 367.3617 to prohibit any controller under the Kentucky Consumer Data Protection Act from engaging in surveillance pricing, or offering, setting, or displaying a price for a good or service to a consumer using an automated-decision system that is based, in whole or in part, on individualized data; provide that the Act may be cited as the Kentucky Price Fairness Act.
Create a new section of KRS Chapter 189 to define terms related to automated license plate readers; restrict use of automated license plate readers; establish limitations on use and sale of data captured by automated license plate readers; provide that captured license plate data may be retained longer than 90 days only if it is being used in a criminal or insurance investigation or has become subject to a preservation of evidence notification; require law enforcement agencies to adopt and make public a written policy governing use of automated license plate readers; provide that any recorded images or data captured by an automated license plate reader may be made available to the National Insurance Crime Bureau or its successor organization; require the Transportation Cabinet to establish a permit process for installation of automated license plate readers on highway rights-of-way and to promulgate administrative regulations; amend KRS 189.990 to establish penalty for violation.
