AI Frontier Institute

AN ACT relating to data privacy.

View primary source →

This Kentucky House bill (26 RS BR 356) has not been enacted. It is in the House Small Business & Information Technology Committee. If enacted, it would amend the Kentucky Consumer Data Protection Act (KRS 367.3611 to 367.3629) to add protections for minors on online services. Section 1 amends KRS 367.3611 with new definitions, including "algorithmic feed," "algorithmic recommendation system," "covered design feature" (infinite scroll, variable reward schedules, autoplay video), "covered minor," "covered online service," "dark pattern," and "minor" (under 18). It also changes "child" to mean under 13. Section 2 creates a new section requiring covered online services to do the following for covered minors: - Set default privacy settings to the highest level. - Give minors controls over each category of push notification. - Disable interaction counts by default. - Offer a tool to request deletion of accounts, media and data, to be honored within 15 days. - Let minors opt out of personalized algorithmic feeds, limit in-game purchases, and limit time spent on the service. - Collect and retain only minimal personal data. - Show a sign when precise geolocation is collected. - Give parents controls over a child's settings, purchases, and time of use. - Provide harm-reporting mechanisms and a user-blocking tool. Section 2 also bars covered online services from several practices: - By default, recommending minors to adult users, or adults to minors, for connection or messaging. - By default, displaying a minor's contacts, enabling search indexing of a minor's profile, or showing a minor's location. - Profiling minors except where necessary for a requested service. - Facilitating advertising of prohibited products (narcotic drugs, tobacco, gambling, alcohol) or targeted advertising to minors. - Using dark patterns directed at minors. - Sending notifications between 10 p.m. and 6 a.m., or on school-day hours (8 a.m. to 4 p.m. weekdays, August 1 to May 31). Section 3 amends KRS 367.3613 on applicability and exemptions. It keeps the existing exemptions and adds that controllers and processors who comply with COPPA's verifiable parental consent requirements are deemed compliant with the Act's parental consent obligations. Section 4 provides that Section 2 may be cited as the Kentucky Kid's Code.

← Back to the tracker