Kentucky · House Bill · 2026 Regular Session
HB559
Kentucky HB 559 — An Act Relating to Data Privacy, Portability, and Interoperability (Kentucky Digital Choice Act)

Status ● Introduced Effective N/A Passage Likelihood L

WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE

How Is This Bill Enforced

Enforcement Authority
Attorney General has exclusive enforcement authority. No private right of action — the statute expressly disclaims one. Prior to initiating any action, the Attorney General must provide 30 days' written notice identifying the specific provisions alleged to have been violated. If the entity cures the violation and provides a written statement within 30 days, no damages action may be initiated.
Private Right of Action
No private right of action. Enforcement is exclusive to the designated authority.
Penalties
Up to $7,500 per continued violation after expiration of the 30-day cure period. Attorney General may recover reasonable investigation and preparation expenses, court costs, attorney's fees, and any other relief ordered by the court. Civil penalties are deposited into the Digital Choice Fund administered by the Office of the Attorney General.

What This Bill Requires

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text
Analysis & Obligations
Section 1
Definitions

(1)–(9) As used in Sections 1 to 6 of this Act: (1) \"Artificial intelligence systemArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1)\" has the same meaning as in KRS 42.722; (2)

Section 1 establishes the defined terms used throughout the Kentucky Digital Choice Act. Key definitions include model operator — the entity deploying an AI system and controlling how it interacts with end users (excluding entities that merely access AI through APIs or prompting) — and contextual data, a novel category covering all user-provided information and interaction context with an AI system, including prompts, conversational histories, files, preferences, and metadata, but explicitly excluding the model operator's trade secrets. The section also defines social graph broadly to include connections, user-created content, engagement metadata, and relational references sufficient to maintain associations among data elements.

Section 2
Data portability, deletion, and response timelines
Deployer

(1) 1 If a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) requests a copy of the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) under KRS 367.3615(2)(d), a social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall provide the personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5), including the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s social graphSocial graph"Social graph" means data that represents a user's connections and interactions within a social media service. Social graph includes: 1. The user's social connections with other users; 2. Content created by the user; 3. The user's responses to other users' content, including comments, reactions, mentions, reposts, shares, and other engagements; 4. Metadata associated with the items described in subparagraphs 1. to 3. of this paragraph; and 5. Relational references sufficient to maintain the associations among data elements described in subparagraphs 1. to 3. of this paragraph;Section 1(6) and contextual dataContextual data"Contextual data" means any information provided by a user to an artificial intelligence system and any context associated with the user's interactions with the artificial intelligence system, including prompts, conversational histories, files, preferences, and metadata. "Contextual data" does not include a model operator's trade secrets;Section 1(2), in a format that: (a) Is portable, to the extent technically feasible; (b) Is readily usable, to the extent practicable; and (c) Allows the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to transmit the data to another social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) without impediment if the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) processes the data by automated means.

(2) 2 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall delete a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s social graphSocial graph"Social graph" means data that represents a user's connections and interactions within a social media service. Social graph includes: 1. The user's social connections with other users; 2. Content created by the user; 3. The user's responses to other users' content, including comments, reactions, mentions, reposts, shares, and other engagements; 4. Metadata associated with the items described in subparagraphs 1. to 3. of this paragraph; and 5. Relational references sufficient to maintain the associations among data elements described in subparagraphs 1. to 3. of this paragraph;Section 1(6) and contextual dataContextual data"Contextual data" means any information provided by a user to an artificial intelligence system and any context associated with the user's interactions with the artificial intelligence system, including prompts, conversational histories, files, preferences, and metadata. "Contextual data" does not include a model operator's trade secrets;Section 1(2) if a consumer requests, pursuant to KRS 367.3615(2)(c), that the social media serviceSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) delete their personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) about the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9).

(3) 3 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall fulfill a request from a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to exercise the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s data rights under this section within five (5) business days.

Section 2 builds on Kentucky's existing consumer data rights under KRS 367.3615 by requiring social media companies and model operators to provide personal data — including social graph and contextual data — in a portable, usable format that allows unimpeded transfer to another service. The section also extends the existing deletion right to social graph and contextual data specifically. All requests must be fulfilled within five business days, a significantly shorter timeline than the 45-day window typical of most state data privacy laws.

Compliance actions 3 items
1
Social media companies and model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must provide usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) who request a copy of their personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) with all personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) — including social graphSocial graph"Social graph" means data that represents a user's connections and interactions within a social media service. Social graph includes: 1. The user's social connections with other users; 2. Content created by the user; 3. The user's responses to other users' content, including comments, reactions, mentions, reposts, shares, and other engagements; 4. Metadata associated with the items described in subparagraphs 1. to 3. of this paragraph; and 5. Relational references sufficient to maintain the associations among data elements described in subparagraphs 1. to 3. of this paragraph;Section 1(6) and contextual dataContextual data"Contextual data" means any information provided by a user to an artificial intelligence system and any context associated with the user's interactions with the artificial intelligence system, including prompts, conversational histories, files, preferences, and metadata. "Contextual data" does not include a model operator's trade secrets;Section 1(2) — in a format that is portable, readily usable, and allows unimpeded transfer to another social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3).
D-01.1
2
Social media companies and model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must delete a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s social graphSocial graph"Social graph" means data that represents a user's connections and interactions within a social media service. Social graph includes: 1. The user's social connections with other users; 2. Content created by the user; 3. The user's responses to other users' content, including comments, reactions, mentions, reposts, shares, and other engagements; 4. Metadata associated with the items described in subparagraphs 1. to 3. of this paragraph; and 5. Relational references sufficient to maintain the associations among data elements described in subparagraphs 1. to 3. of this paragraph;Section 1(6) and contextual dataContextual data"Contextual data" means any information provided by a user to an artificial intelligence system and any context associated with the user's interactions with the artificial intelligence system, including prompts, conversational histories, files, preferences, and metadata. "Contextual data" does not include a model operator's trade secrets;Section 1(2) when the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) requests deletion of their personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) under KRS 367.3615(2)(c).
D-01
3
Social media companies and model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must fulfill all userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) data rights requests under this section within five business days.
D-01
Section 3
Interoperability interface requirements
Deployer

(1) 4 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) shall implement a transparent, third-party accessible interoperability interface or interfaces that allow usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to choose to: (a) Share a common set of the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) or a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)-selected part of the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) between the social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) designated by the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9); and (b) Enable third parties to access personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) created by the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) and to be notified when new or updated personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) is available, with the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s permission.

(2) 5 A model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall implement a third-party accessible interoperability interface to allow usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to share their contextual dataContextual data"Contextual data" means any information provided by a user to an artificial intelligence system and any context associated with the user's interactions with the artificial intelligence system, including prompts, conversational histories, files, preferences, and metadata. "Contextual data" does not include a model operator's trade secrets;Section 1(2) directly with other artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1) they designate and enable those artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1) to be notified when new or updated data is available.

(3) 6 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall reasonably secure all personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) obtained through an interoperability interface.

(4) 7 To achieve interoperability under subsection (1) of this section, a social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall: (a) Utilize an open protocolOpen protocol"Open protocol" means a publicly available set of rules that: (a) Enables export of social graph or contextual data to other social media services or model operators; and (b) Is free from licensing fees and patent restrictions;Section 1(4); (b) Facilitate and maintain interoperability and continuous, real-time data sharing with other social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) or artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1) through an interoperability interface, based on reasonable terms that do not discriminate between social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) or artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1); (c) Establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) may assess a reasonable fee for such access; and (d) Disclose to other social media companies or model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.

(5) 8 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party shall safeguard the privacy and security of a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) obtained from other social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) or artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1) through the interoperability interface in accordance with the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7)'s, model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3)'s, or third party's privacy notice and administrative, technical, and physical data security practices.

(6) 9 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party shall not share or receive a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) through the interoperability interface except with the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s consent.

(7) 10 A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall adopt an accessible, prominent, and persistent method for usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to give consent for data sharing with other social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8), artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1), or third parties through the interoperability interface.

(8) A social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) is not required to: (a) Provide access to: 1. Inferences, analyses, or derived data that the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) has generated internally about a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9); or 2. Proprietary algorithms, ranking systems, or other internal operating mechanisms; (b) Transmit personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5): 1. That is stored or structured in a proprietary format; 2. For which no open, industry-standard format is reasonably available; and 3. That would disclose information as described in subsection (7) of this section; or (c) Display or otherwise use data received from another social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3).

(9) 11 A business that uses an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1) provided by a model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) to provide applications or services to a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) shall promptly transmit a userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s request to the model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) with sufficient information for the model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) to execute the request and communicate about the request with the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9).

Section 3 is the core interoperability mandate of the bill. It requires social media companies to implement transparent, third-party-accessible interoperability interfaces enabling users to share personal data across social media services and to grant third parties access to their user-created data. Model operators face a parallel obligation to implement interoperability interfaces for contextual data sharing across AI systems. Both must use open protocols, maintain continuous real-time data sharing on nondiscriminatory terms, provide complete API documentation to other covered entities, and implement user consent mechanisms.

The section includes significant privacy guardrails: all personal data obtained through the interoperability interface must be reasonably secured, and data sharing requires user consent. Social media companies are not required to export inferences, derived data, proprietary algorithms, or data stored in proprietary formats with no available open standard. Businesses using AI systems provided by a model operator must promptly relay user requests to the model operator.

Compliance actions 8 items
4
Social media companies must implement transparent, third-party-accessible interoperability interfaces that allow usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to (1) share personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) between social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) designates, and (2) enable third parties to access userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)-created personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) and receive notifications of new or updated data, with the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s permission.
5
Model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must implement a third-party-accessible interoperability interface to allow usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to share their contextual dataContextual data"Contextual data" means any information provided by a user to an artificial intelligence system and any context associated with the user's interactions with the artificial intelligence system, including prompts, conversational histories, files, preferences, and metadata. "Contextual data" does not include a model operator's trade secrets;Section 1(2) directly with other AI systems they designate and enable those AI systems to receive notifications when new or updated data is available.
6
Social media companies and model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must reasonably secure all personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) obtained through an interoperability interface.
7
Social media companies and model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must (1) utilize an open protocolOpen protocol"Open protocol" means a publicly available set of rules that: (a) Enables export of social graph or contextual data to other social media services or model operators; and (b) Is free from licensing fees and patent restrictions;Section 1(4) for interoperability, (2) facilitate and maintain continuous, real-time data sharing on reasonable, nondiscriminatory terms, (3) establish reasonable thresholds beyond which a reasonable fee may be assessed, and (4) disclose complete, accurate, and regularly updated documentation describing access to the interoperability interface.
8
Social media companies, model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), and third parties must safeguard the privacy and security of userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) obtained through the interoperability interface in accordance with their privacy notice and administrative, technical, and physical data security practices.
9
Social media companies, model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), and third parties must not share or receive userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) personal dataPersonal data"Personal data" has the same meaning as in KRS 367.3611 and also includes a user's social graph;Section 1(5) through the interoperability interface without the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9)'s consent.
10
Social media companies and model operatorsModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) must adopt an accessible, prominent, and persistent method for usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) to give consent for data sharing with other social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8), AI systems, or third parties through the interoperability interface.
11
Businesses that use an AI system provided by a model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) to deliver applications or services to usersUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) must promptly transmit userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9) data-rights requests to the model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) with sufficient information for the model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) to execute the request and communicate with the userUser"User" means an individual located in the Commonwealth who accesses or uses a social media service.Section 1(9).
Section 4
Attorney General open protocol identification and safe harbor

(1) The Attorney General, in consultation with the Consumers' Advisory Council, may identify open protocolsOpen protocol"Open protocol" means a publicly available set of rules that: (a) Enables export of social graph or contextual data to other social media services or model operators; and (b) Is free from licensing fees and patent restrictions;Section 1(4) that the Attorney General has determined, after an assessment, meet the requirements of Section 3 of this Act.

(2) If a social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) uses an open protocolOpen protocol"Open protocol" means a publicly available set of rules that: (a) Enables export of social graph or contextual data to other social media services or model operators; and (b) Is free from licensing fees and patent restrictions;Section 1(4) identified by the Attorney General under subsection (1) of this section, the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7) or model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3) shall be entitled to a rebuttable presumption of providing access on reasonable terms that do not discriminate between social media servicesSocial media service"Social media service" means a public website or application that: 1. Displays content that is primarily generated by users and not by the social media company; 2. Permits an individual to register as a user and create a profile that is made visible to the general public or a set of other users defined by the account holder; 3. Allows users to interact socially with each other within the website or application; 4. Makes available to each user a list or lists of other users with whom the user shares a connection within the website or application; and 5. Allows users to post content viewable by other users. Social media service does not include: 1. Email; 2. Cloud storage; or 3. Document viewing, sharing, or collaboration services;Section 1(8) or artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" has the same meaning as in KRS 42.722;Section 1(1).

Section 4 authorizes the Attorney General, in consultation with the Consumers' Advisory Council, to identify open protocols that meet the interoperability requirements of Section 3. Social media companies and model operators that use an Attorney General–identified open protocol receive a rebuttable presumption of compliance with the nondiscrimination and reasonable-terms requirements — effectively a safe harbor for protocol selection.

Section 5
Enforcement, cure period, and penalties

(1) The Attorney General shall have exclusive authority to enforce violations of Sections 1 to 6 of this Act. The Attorney General may enforce Sections 1 to 6 of this Act by bringing an action in the name of the Commonwealth of Kentucky or on behalf of persons residing in this Commonwealth. The Attorney General shall have all powers and duties granted to the Attorney General under KRS Chapter 15 to investigate and prosecute any violation of Sections 1 to 6 of this Act. The Attorney General may demand any information, documentary material, or physical evidence from any social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party believed to be engaged in, or about to engage in, any violation of Sections 1 to 6 of this Act.

(2) Prior to initiating any action for violation of Sections 1 to 6 of this Act, the Attorney General shall provide a social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party thirty (30) days' written notice identifying the specific provisions of Sections 1 to 6 of this Act that the Attorney General alleges have been or are being violated. If within the thirty (30) day period the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action for damages under subsection (3) of this section shall be initiated against the social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party.

(3) If a social media companySocial media company"Social media company" means an entity that owns or operates a social media service;Section 1(7), model operatorModel operator"Model operator" means the natural or legal person that deploys an artificial intelligence system and retains control over how the system is offered to or interacts with end users, but does not include a person or entity that solely interacts with artificial intelligence systems through application programming interfaces, licensed services, prompting, or fine tuning;Section 1(3), or third party continues to violate Sections 1 to 6 of this Act following the cure period in subsection (2) of this section, or breaches an express written statement provided to the Attorney General under subsection (2) of this section, the Attorney General may initiate an action and seek damages for up to seven thousand five hundred dollars ($7,500) for each continued violation under Sections 1 to 6 of this Act.

(4) Nothing in Sections 1 to 6 of this Act or any other law, regulation, or the equivalent shall be construed as providing the basis for, or giving rise to, a private right of action for any violation of Sections 1 to 6 of this Act.

(5) The Attorney General may recover reasonable expenses incurred in investigating and preparing the case, court costs, attorney's fees, and any other relief ordered by the court for any action initiated under Sections 1 to 6 of this Act.

Section 5 vests exclusive enforcement authority in the Attorney General, who may bring actions in the name of the Commonwealth or on behalf of Kentucky residents. The statute expressly disclaims any private right of action. Before initiating a damages action, the Attorney General must provide 30 days' written notice identifying the specific violations. If the entity cures the violation and provides a written statement within that period, no damages action may proceed. After the cure period, penalties run up to $7,500 per continued violation. The Attorney General may also recover investigation expenses, court costs, and attorney's fees.

Section 6
Digital Choice Fund

(1)–(4) There is hereby established in the State Treasury a trust and agency account to be known as the digital choice fund. The fund shall consist of moneys received from all civil penalties collected pursuant to Sections 1 to 6 of this Act. Interest earned on moneys in the fund shall accrue to the fund. The fund shall be administered by the Office of the Attorney General. Amounts deposited into the fund shall be used by the Office of the Attorney General to enforce Sections 1 to 6 of this Act. Notwithstanding KRS 45.229, fund amounts not expended at the close of the fiscal year shall not lapse but shall be carried forward into the next fiscal year.

Section 6 establishes the Digital Choice Fund as a trust and agency account in the State Treasury, funded by civil penalties collected under the Act. The fund is administered by the Office of the Attorney General and is dedicated to enforcement of the Act. Unspent balances carry forward across fiscal years and do not lapse.

Section 7
Severability

If any provision of this Act or the application thereof to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of this Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

Standard severability clause providing that if any provision is held invalid, the remaining provisions remain in effect.

Section 8
Short title

This Act may be cited as the Kentucky Digital Choice Act.

Establishes the short title: the Kentucky Digital Choice Act.

Passage Likelihood

Low
Status Introduced
Chamber No passage
Committee No action
Majority party (No data)
Bipartisan No
Prior session None

Legislative History

2026-02-04 introduced in House
2026-02-04 to Committee on Committees (H)
2026-02-11 to Small Business & Information Technology (H)

Entry Last Reviewed

2026-05-20
AI generated