KY SB345: AN ACT relating to the protection of children using the internet.

In one paragraph

Kentucky's SB 345 (2024 session) would have required businesses that knowingly process children's personal information to protect children (under 18) online. Before offering new online services likely to be accessed by children, they would have had to complete data protection impact assessments, set default privacy settings to a high level, and not profile children by default where an assessment found unmitigated high risk. Profiling meant automated processing of personal information to evaluate a person. Violations would have been unfair or deceptive practices with Attorney General penalties of up to $2,500 or $7,500 per affected child. Referred to committee March 1, 2024; died.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill died and never became law. Online services likely to be accessed by Kentucky children would have needed impact assessments, high-privacy defaults and limits on profiling.

Key provisions

1. 1Covered entity: a business or organization that knowingly processes a child's personal information; child: under 18 (Sec. 1)
2. 2Data protection impact assessment required before new online services, products or features likely to be accessed by children are offered; a list of assessments must be given to the Attorney General on request (Secs. 2-3)
3. 3Profiling (any automated processing of personal information to evaluate a person) of a child by default is barred where an assessment identifies high risk without adequate mitigation (Sec. 2(2)(b))
4. 4High default privacy settings; limits on precise geolocation, secondary use and dark patterns; an obvious signal when a child is monitored or tracked (Sec. 2)
5. 5Attorney General enforcement as an unfair or deceptive practice; 90-day cure period for good-faith entities; up to $2,500 per affected child per negligent violation or $7,500 per intentional violation; no private right of action (Secs. 4, 6)
6. 6COPPA compliance counts as compliance for children under 13; the sections would become ineffective if a federal law on minors' data, consent, age verification or parental controls is enacted (Sec. 5)
7. 7Referred to Economic Development, Tourism, & Labor (S) March 1, 2024; died at the end of the session

Latest legislative action

Mar 1, 2024. to Economic Development, Tourism, & Labor (S); no further action before the 2024 regular session ended

Sponsors