Regulon — KY-HB-633 · KY HB 633 (Kentucky Kid's Code)

WHAT THIS BILL REGULATES · 3 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Enforcement under the existing Kentucky Consumer Data Protection Act (KRS 367.3611–367.3629). The Attorney General has exclusive enforcement authority. No private right of action is created by this bill or by the underlying statute.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

The bill does not create its own remedies section. Enforcement and penalties are governed by the existing Kentucky Consumer Data Protection Act framework (KRS 367.3625–367.3629), which provides for AG-initiated enforcement actions and civil penalties.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

KRS 367.3611

Definitions (amended)

(1)–(45) As used in KRS 367.3611 to 367.3629: [Definitions including new terms: (2) "Algorithmic feed" means a media display system of an online service, product, or feature that delivers a stream or list of media using automated rules to select, order, rank, or prioritize the media based on a user's personal data; (3) "Algorithmic recommendation system": (a) Means a computational process used to select, order, rank, or prioritize media provided to a user through an online service, product, or feature...; (11) "Covered design feature" means any feature that: (a) Continuously loads new media in an algorithmic feed seamlessly and absent a specific request from the user in an infinite scroll feed; (b) Uses intermittent, variable reward schedules; or (c) Automatically plays a video...; (13) "Covered minor" means a user that a covered online service knows or should have known, based on objective knowledge or circumstances, to be a minor; (14) "Covered online service" means a person that owns, operates, controls, or provides an online service that: (a) Conducts business in this state; (b) Alone, or jointly with its affiliates, subsidiaries, or parent companies, determines the purposes and means of processing of consumers' personal data; and (c) Annually processes, buys, receives, sells, or shares the personal data of one hundred thousand (100,000) or more consumers, or derives at least fifty percent (50%) of its annual gross revenue from the sale or sharing of personal data; (15) "Dark pattern": (a) Means a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision making, or choice...; (25) "Knows to be a child" or "knows to be a minor" means having actual knowledge that a user is a child or minor...; (27) "Minor" means an individual under the age of eighteen (18) years; (29) "Online service": (a) Means any service, product, or feature that is accessible to the public via the internet...; (45) "User" means an individual who registers an account or creates a profile on a covered online service.]

Section 1 amends the existing definitions section of Kentucky's Consumer Data Protection Act to add fifteen new defined terms required by the Kentucky Kid's Code. The most consequential new terms are covered online service — which establishes a new category of regulated entity defined by data-processing volume thresholds — covered minor, algorithmic feed, algorithmic recommendation system, covered design feature, and dark pattern. The knowledge standard for minor status is noteworthy: 'actual knowledge' encompasses not only self-identified age but also any age the service has attributed to or associated with the individual for any purpose, and where the service's marketing classification is inconsistent with self-identified age, the self-identified age must be disregarded.

Several existing definitions are also updated with formatting and cross-reference corrections, but no substantive changes to pre-existing operative terms.

Section 2 (New Section of KRS 367.3611–367.3629)

Kentucky Kid's Code — Minor user protections

Deployer

(1)(a)–(e) 1 A covered online service shall: (a) Configure all default privacy settings provided to a covered minor through its online service, product, or feature to the highest level of privacy; (b) Provide covered minors with settings to enable or disable each specific category of push notification offered by the covered online service on the product or service, including but not limited to marketing notifications, direct message notifications, media interaction notifications, and any other category of notification pushed by the product or service; (c) Disable by default all interaction counts, including but not limited to counts of reactions and comments on all of the covered minor's media; (d) Offer settings to enable or disable specific types of interaction counts, including but not limited to comments, reactions, reshares, or other categories of interactions; and (e) Offer a single setting to turn on all interaction counts only if the settings to turn on specific interactions are equally prominent and accessible.

(2)(a)–(b) 2 A covered online service shall: (a) Provide a prominent and accessible tool to allow: 1. A covered minor to request the covered online service delete any: a. Account profiles; b. Media and personal data provided by or obtained about the consumer, including personal data the consumer provided to the covered online service; c. Personal data the covered online service obtained from another source; and d. Derived data; or 2. The parent of a covered minor to make such a request on the child's behalf; (b) Comply with a request under paragraph (a) of this subsection not later than fifteen (15) days after a covered online service receives the request;

(2)(c) 3 Provide each covered minor with accessible and user-friendly tools that: 1. Allow a covered minor to opt out of the use of the covered minor's personal data to select, recommend, or prioritize media for the covered minor in an algorithmic feed, except when that personal data is: a. The covered minor's express and unambiguous request to receive: i. Media from a specific account, feed, or user, or to receive more or less media from that account, feed, or user; ii. A specific category of media, including but not limited to "breaking news" or to see more or less of that category of media; or iii. More or less media with similar characteristics as the media they are currently viewing; b. User-selected privacy or accessibility settings; c. The covered minor's location, but only to determine whether the covered minor is within the Commonwealth for purposes of complying with this section; d. The consumer's age, but only to implement the covered business's policies regarding media appropriate for minors; or e. A search query, provided the search query is only used to select and prioritize media in response to the search; 2. Control the use of in-game purchases or other transactions by allowing a covered minor to opt out of all purchases and transactions or to place limits on purchases and transactions; 3. Limit the amount of time the covered minor spends on the covered online service; and 4. Notify a covered minor of a covered design feature when any of the tools described in this section are in effect, and describe what settings have been applied;

(2)(d) 3 Establish default settings for the safeguards required in paragraph (c) of this subsection at the option or level that provides the highest protection available for the safety of the covered minor;

(2)(e)–(f) 4 Collect and use only the minimum amount of a covered minor's personal data necessary to provide the specific elements of an online service with which the covered minor has knowingly engaged, and ensure that the collected personal data is not used for reasons other than those for which it was collected; (f) Retain the personal data of a covered minor only as long as necessary to provide the specific elements of an online service with which the covered minor has knowingly engaged;

(2)(g)–(h) 5 Provide an obvious sign to a covered minor when precise geolocation information is being collected or used; (h) If the covered online service allows parental monitoring, provide an obvious signal to a covered minor when the minor is being monitored;

(2)(i) 6 Provide parents the ability to do the following for an individual the covered online service knows to be a child: 1. Manage the child's privacy and account settings in a manner that allows parents to: a. View the child's privacy and account settings; and b. Change and control the child's privacy and account settings; 2. Restrict purchases and financial transactions of the child; 3. Enable parents to view the total time the child has spent on a covered online service, and place reasonable limits on the child's use of the covered online service; and 4. Restrict the child's use of the covered online service during times of day specified by the parents, including during school hours and at night;

(2)(j) 7 Establish mechanisms for covered minors and parents to report harms on covered online services.

(3)(a)–(i) 8 A covered online service shall not, by default, configure its online product, service, or feature to: (a) Use an algorithmic recommendation system to recommend to any known adult user that they connect to a covered minor as a friend, follower, or contact; (b) Use an algorithmic recommendation system to recommend to any known adult user that they follow a covered minor's media, unless the covered minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation; (c) Use an algorithmic recommendation system to recommend to any known adult user that they communicate with a covered minor through direct messaging, unless the covered minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation; (d) Use an algorithmic recommendation system to recommend to a covered minor that they communicate with any known adult through direct messaging, unless the covered minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation; (e) Display a covered minor's friends, followers, or contacts; (f) Enable search engine indexing of a covered minor's account profile and media; (g) Display the location of any covered minor to any other user unless the covered minor has expressly and unambiguously chosen to share his or her location with the specific user; (h) Send push notifications to any covered minor; or (i) Provide a single setting that enables all push notifications.

(4)(a)–(d) 9 A covered online service that facilitates communications between users shall provide a prominent, accessible, and responsive tool that gives a covered minor the option to block specific users from taking each of the following actions: 1. Accessing the user's media; 2. Interacting with the user's media; 3. Communicating with the user through their media; 4. Communicating with the user through direct messaging; and 5. Communicating with the user through any other means offered by the covered online service through the product or service. (b) The tool described in paragraph (a) of this subsection shall provide a covered minor with the option to prevent media from the blocked user from appearing in the covered minor's feed. (c) The tool described in paragraph (a) of this subsection shall, at a minimum, be accessible from a feature located: 1. Proximate to every instance of another user's username, avatar, or both; 2. On all media shared by another user; 3. On every direct message or direct message thread; and 4. In a first-level settings menu labeled "blocked users." (d) The features described in paragraph (c)1. to 3. of this subsection shall provide a covered minor with the option to: 1. Block the other user, which will trigger all of the settings in paragraphs (a) and (b) of this subsection; or 2. Go to the settings page to select more granular block settings for the other user.

(5)(a)–(c) 10 A covered online service that offers an algorithmic feed to a covered minor that uses the covered minor's personal data to select, recommend, or prioritize media in the feed shall: (a) Provide a prominent and accessible user interface that enables the covered minor to: 1. Expressly and unambiguously communicate his or her preferences about the types of media to be recommended and to be blocked in the output of the relevant algorithmic recommendation system; and 2. Access, review, and make changes to any personal data the covered online service uses to determine the output of the relevant algorithmic recommendation system; (b) Ensure that the relevant algorithmic recommendation system is informed by these preferences; and (c) Provide the minor with the choice of an algorithmic feed that only selects media from sources the minor affirmatively chose to follow or otherwise include in the feed.

(6)(a) 11 A covered online service shall not: (a) Profile a covered minor unless profiling is necessary to provide a covered online service requested by a covered minor, and only with respect to the aspects of the covered online service with which the covered minor is actively and knowingly engaged;

(6)(b)–(c) 12 Facilitate advertising of prohibited products, including but not limited to narcotic drugs, tobacco products, gambling, and alcohol, to covered minors; (c) Facilitate targeted advertising to a covered minor;

(6)(d) 13 Use dark patterns directed at a covered minor;

(6)(e) 14 Be required to collect the personal data of a user to comply with this section. A covered online service that collects personal data of a user for age verification shall not use personal data for other purposes and shall delete personal data after use for age verification;

(6)(f)–(g) 15 Provide a covered minor with a single setting that makes more than one (1) default privacy or design feature setting less protective at once; (g) Request or prompt a covered minor to make any of the settings less protective, unless the change is strictly necessary for the covered minor to access a service or feature that the minor has expressly and unambiguously requested;

(6)(h) 16 Use notifications and push alerts to a covered minor between the hours of 10 p.m. and 6 a.m., and between the hours of 8 a.m. and 4 p.m. on weekdays from August 1 to May 31, prevailing time in the covered minor's location.

Section 2 is the operative core of the bill — it creates the 'Kentucky Kid's Code,' imposing a comprehensive set of obligations on covered online services when they interact with covered minors. The obligations fall into several functional clusters: default privacy configuration (subsection 1); account deletion and data management tools (subsection 2); algorithmic feed transparency and opt-out rights (subsections 2(c) and 5); parental controls for known children (subsection 2(i)); default prohibitions on adult-minor algorithmic recommendations and search-engine indexing (subsection 3); user-blocking tools (subsection 4); and categorical prohibitions on profiling, targeted advertising, dark patterns, prohibited-product advertising, notification curfews, and privacy-degrading interface patterns directed at minors (subsection 6).

The data minimization obligation in subsection 2(e) is notable: it applies specifically to covered minors' personal data and restricts both collection and use to what is necessary for the specific service elements the minor has knowingly engaged with. Subsection 6(e) adds a complementary restriction on age-verification data — services may not collect personal data solely to comply with this section, and data collected for age verification must be deleted after use and not repurposed.

The notification curfew in subsection 6(h) is unusually prescriptive, blocking push notifications between 10 p.m.–6 a.m. and between 8 a.m.–4 p.m. on weekdays during the school year (August 1–May 31), based on the minor's local time.

Compliance actions 16 items

Covered online services must configure all default privacy settings for covered minors to the highest level of privacy, disable all interaction counts by default, and provide granular settings for push notifications and interaction counts.

MN-01.8

Covered online services must provide a prominent and accessible tool allowing covered minors (or their parents) to request deletion of account profiles, media, personal data, third-party-obtained data, and derived data, and must comply within fifteen days of receiving the request.

MN-01.9

Covered online services must provide covered minors with accessible tools to (1) opt out of personal-data-driven algorithmic feed recommendations (subject to narrow exceptions), (2) control in-game purchases and transactions, (3) limit time spent on the service, and (4) receive notification when a covered design feature is in effect. Default settings for these safeguards must be set to the highest available protection level.

MN-01.3

Covered online services must collect and use only the minimum amount of a covered minor's personal data necessary to provide the specific service elements the minor has knowingly engaged with, must not use the data for other purposes, and must retain it only as long as necessary for those elements.

D-01.4

Covered online services must provide an obvious sign to covered minors when precise geolocation information is being collected or used, and must provide an obvious signal when parental monitoring is active.

MN-01.3

Covered online services must provide parents of known children (under 13) with the ability to view and control the child's privacy and account settings, restrict purchases and financial transactions, view total time spent and place reasonable usage limits, and restrict usage during parent-specified times of day including school hours and nighttime.

MN-01.3

Covered online services must establish mechanisms for covered minors and parents to report harms on the service.

MN-01

Covered online services must not, by default, use algorithmic recommendation systems to recommend adult-minor connections, following, or direct messaging (unless the accounts were already connected); must not display a covered minor's friends, followers, or contacts; must not enable search-engine indexing of a minor's profile and media; must not display a minor's location to other users without express consent; and must not send push notifications to covered minors by default.

MN-01.8

Covered online services that facilitate user communications must provide covered minors with a prominent, accessible, and responsive blocking tool — accessible proximate to usernames/avatars, on all shared media, on every direct message thread, and in a first-level 'blocked users' settings menu — that allows the minor to block specific users from accessing or interacting with the minor's media, communicating via media or direct message, and to prevent blocked users' media from appearing in the minor's feed.

MN-01.3

Covered online services offering algorithmic feeds to covered minors must provide a prominent interface enabling the minor to express preferences about recommended and blocked media types, access and modify the personal data used by the recommendation system, and choose a feed that only displays media from sources the minor affirmatively chose to follow.

MN-01.3

Covered online services must not profile a covered minor unless profiling is necessary to provide a service the minor requested, and only with respect to the service aspects the minor is actively and knowingly engaged with.

MN-01

Covered online services must not facilitate advertising of prohibited products (narcotic drugs, tobacco, gambling, alcohol) to covered minors and must not facilitate targeted advertising to covered minors.

MN-01.7

Covered online services must not use dark patterns directed at covered minors.

CP-01.3

Covered online services must not be required to collect personal data to comply with this section. Any personal data collected for age verification must not be used for other purposes and must be deleted after use for age verification.

D-01.4

Covered online services must not provide covered minors with a single setting that makes more than one default privacy or design feature setting less protective at once, and must not request or prompt a covered minor to make settings less protective unless strictly necessary for a service the minor expressly requested.

CP-01.3

Covered online services must not send notifications or push alerts to covered minors between 10 p.m. and 6 a.m., or between 8 a.m. and 4 p.m. on weekdays from August 1 through May 31, based on prevailing time in the minor's location.

MN-01.4

KRS 367.3613

Applicability and exemptions (amended)

(1)–(3) KRS 367.3611 to 367.3629 applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers; or (b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data. (2) KRS 367.3611 to 367.3629 shall not apply to any: [enumerated exemptions for government, financial institutions, HIPAA entities, nonprofits, higher education, certain organizations, utilities]. (3) The following information and data are exempt from KRS 367.3611 to 367.3629: [enumerated data exemptions].

(4) Controllers and processors that comply with the verifiable parental consent requirements of the Children's Online Privacy Protection Act, 15 U.S.C. sec. 6501 et seq., shall be deemed compliant with any obligation to obtain parental consent under KRS 367.3611 to 367.3629.

Section 3 amends the existing applicability section of the KCDPA with minor wording updates. The thresholds remain unchanged: the act applies to persons conducting business in the Commonwealth or targeting Kentucky residents that control or process personal data of at least 100,000 consumers, or 25,000 consumers plus 50% gross revenue from personal data sales. The exemptions for government, financial institutions, HIPAA entities, nonprofits, higher education, and enumerated federal-law-governed data are preserved intact.

The new subsection (4) adds a COPPA safe harbor: controllers and processors that comply with the verifiable parental consent requirements of COPPA are deemed compliant with any parental consent obligation under the Act. This is significant for Section 2's parental control provisions for known children (under 13).

Section 4

Short title

Section 2 of this Act may be cited as the Kentucky Kid's Code.

Section 4 provides the short title: Section 2 of this Act may be cited as the Kentucky Kid's Code.

Minor Safety Parental consent · controls · termination workflows

12 items

MN-01.8