Kentucky KCDPA — AG Action Regarding AI Companion Apps (Jan 2026)
Jurisdiction: Kentucky, USA
In force: · Last checked:
Summary
The Kentucky Consumer Data Protection Act (KCDPA) took effect January 1, 2026. On January 8, 2026, the Kentucky Attorney General filed suit under the KCDPA citing three observable compliance gaps in a major companion AI service: (1) absence of meaningful age-verification that allowed easy circumvention of minor protections; (2) collection of sensitive minor data for LLM training without parental consent; (3) dark-pattern UI designs engineered to induce compulsive usage and emotional dependency. The KCDPA applies to any controller processing personal data of Kentucky residents.
Observable requirements
Publicly verifiable behaviors — not a legal compliance checklist.
- App implements a verifiable age-gating mechanism (beyond self-declaration) before granting access to features targeting minors
- App's privacy policy discloses whether conversation data from minors is used to train AI models
- App obtains verifiable parental consent before collecting sensitive data from users under 13
- App does not use dark-pattern designs (e.g., guilt-trip notifications, artificial urgency) to drive re-engagement
- App provides an accessible in-app mechanism for users to request deletion of their personal data