Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

KY HB633: AN ACT relating to data privacy.

Dead/Failed Kentucky · 2026 session

Last verified Oct 15, 2026 · official bill text

HB633 · where it stands

This bill did not become law (dead/failed) · last action Feb 20, 2026.

What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Kentucky's HB 633, the Kentucky Kid's Code, would add duties to the Consumer Data Protection Act for large online services used by minors: highest-privacy defaults, controls over algorithmic feeds, limits on algorithmic recommendations linking adults and minors, and bans on profiling, targeted ads, dark patterns and certain push notifications. Introduced February 12, 2026; sent to the House Small Business & Information Technology Committee February 20, 2026. It died when the 2026 session ended without passing.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill did not pass. It would have covered online services with 100,000+ consumers (or 50% of revenue from data sales) that know or should know users are minors.

Key provisions

  1. Amends KRS 367.3611 to define algorithmic feed, algorithmic recommendation system, covered design feature (infinite scroll, variable rewards, autoplay), covered minor and dark pattern
  2. A covered online service (100,000+ consumers' data, or 50% of revenue from selling or sharing data) would have to default all minors' privacy settings to the highest level and offer a tool to delete a minor's data and accounts, honored within 15 days
  3. Minors could opt out of algorithmic feeds that use their personal data, with listed exceptions, and could choose a feed limited to sources they follow; the service would have to let them state and edit their media preferences
  4. By default, no algorithmic recommendations connecting known adults with minors by friending, following or direct messaging unless already connected, and no push notifications to minors
  5. Could not profile a minor except as necessary for a requested service, facilitate targeted advertising or ads for prohibited products, or use dark patterns directed at a minor
  6. Could not send notifications or push alerts to a covered minor from 10 p.m. to 6 a.m. or from 8 a.m. to 4 p.m. on weekdays between August 1 and May 31

Latest legislative action

Feb 20, 2026. to Small Business & Information Technology (H)

Sponsors

NameRole
Primary
Primary
Primary

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error