AN ACT relating to data privacy, portability, and interoperability.

UNOFFICIAL COPY 26 RS BR 353
Page 1 of 7
XXXX 2/3/2026 2:57 PM Jacketed
AN ACT relating to data privacy, portability, and interoperability. 1
Be it enacted by the General Assembly of the Commonwealth of Kentucky: 2
SECTION 1. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 3
READ AS FOLLOWS: 4
As used in Sections 1 to 6 of this Act: 5
(1) "Artificial intelligence system" has the same meaning as in KRS 42.722; 6
(2) "Contextual data" means any inform ation provided by a user to an artificial 7
intelligence system and any context associated with the user’s interactions with 8
the artificial intelligence system, including prompts, conversational histories, 9
files, preferences, and metadata. "Contextual data" does not include a model 10
operator’s trade secrets; 11
(3) "Model operator" means the natural or legal person that deploys an artificial 12
intelligence system and retains control over how the system is offered to or 13
interacts with end users, but does not include a person or entity that solely 14
interacts with artifici al intelligence systems through application programming 15
interfaces, licensed services, prompting, or fine tuning; 16
(4) "Open protocol" means a publicly available set of rules that: 17
(a) Enables export of social graph or contextual data to other social media 18
services or model operators; and 19
(b) Is free from licensing fees and patent restrictions; 20
(5) "Personal data" has the same meaning as in KRS 367.3611 and also includes a 21
user's social graph; 22
(6) (a) "Social graph" means data that represents a user's connec tions and 23
interactions within a social media service. Social graph includes: 24
1. The user's social connections with other users; 25
2. Content created by the user; 26
3. The user's responses to other users' content, including comments, 27
UNOFFICIAL COPY 26 RS BR 353
Page 2 of 7
XXXX 2/3/2026 2:57 PM Jacketed
reactions, mentions, reposts, shares, and other engagements; 1
4. Metadata associated with the items described in subparagraphs 1. to 3. 2
of this paragraph; and 3
5. Relational references sufficient to maintain the associations among 4
data elements described in subparagraphs 1. to 3. of this paragraph; 5
(7) "Social media company" means an entity that owns or operates a social media 6
service; 7
(8) (a) "Social media service" means a public website or application that: 8
1. Displays content that is primarily generated by users and not by the 9
social media company; 10
2. Permits an individual to register as a user and create a profile that is 11
made visible to the general public or a set of other users defined by the 12
account holder; 13
3. Allows users to interact socially with each other within the website o r 14
application; 15
4. Makes available to each user a list or lists of other users with whom 16
the user shares a connection within the website or application; and 17
5. Allows users to post content viewable by other users. 18
(b) Social media service does not include: 19
1. Email; 20
2. Cloud storage; or 21
3. Document viewing, sharing, or collaboration services; and 22
(9) "User" means an individual located in the Commonwealth who accesses or uses 23
a social media service. 24
SECTION 2. A NEW SECTIO N OF KRS CHAPTER 367 IS CREATED TO 25
READ AS FOLLOWS: 26
(1) If a user requests a copy of the user's personal data under KRS 367.3615(2)(d), a 27
UNOFFICIAL COPY 26 RS BR 353
Page 3 of 7
XXXX 2/3/2026 2:57 PM Jacketed
social media company or model operator shall provide the personal data, 1
including the user's social graph and contextual data, in a format that: 2
(a) Is portable, to the extent technically feasible; 3
(b) Is readily usable, to the extent practicable; and 4
(c) Allows the user to transmit the data to another social media company or 5
model operator without impediment if the social media company or model 6
operator processes the data by automated means. 7
(2) A social media company or model operator shall delete a user' s social graph and 8
contextual data if a consumer requests, pursuant to KRS 367.3615(2)(c), that the 9
social media service or model operator delete their personal data about the user. 10
(3) A social media company or model operator shall fulfill a request from a user to 11
exercise the user's data rights under this section within five (5) business days. 12
SECTION 3. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 13
READ AS FOLLOWS: 14
(1) A social media company shall implement a transpar ent, third -party accessible 15
interoperability interface or interfaces that allow users to choose to: 16
(a) Share a common set of the user's personal data or a user -selected part of 17
the user's personal data between the social media services designated by the 18
user; and 19
(b) Enable third parties to access personal data created by the user and to be 20
notified when new or updated personal data is available, with the user's 21
permission. 22
(2) A model operator shall implement a third -party accessible interoperability 23
interface to allow users to share their contextual data directly with other artificial 24
intelligence systems they designate and enable those artificial intelligence systems 25
to be notified when new or updated data is available. 26
(3) A social media company or mode l operator shall reasonably secure all personal 27
UNOFFICIAL COPY 26 RS BR 353
Page 4 of 7
XXXX 2/3/2026 2:57 PM Jacketed
data obtained through an interoperability interface. 1
(4) To achieve interoperability under subsection (1) of this section, a social media 2
company or model operator shall: 3
(a) Utilize an open protocol; 4
(b) Facilitate and maintain interoperability and continuous, real -time data 5
sharing with other social media services or artificial intelligence systems 6
through an interoperability interface, based on reasonable terms that do not 7
discriminate between social media services or artificial intelligence systems; 8
(c) Establish reasonable and proportionate thresholds related to the frequency, 9
nature, and volume of requests, beyond which the social media company or 10
model operator may assess a reasonable fee for such access; and 11
(d) Disclose to other social media companies or model operators complete, 12
accurate, and regularly updated documentation describing access to the 13
interoperability interface required under this section. 14
(5) A social media company, model operator, or th ird party shall safeguard the 15
privacy and security of a user's personal data obtained from other social media 16
services or artificial intelligence systems through the interoperability interface in 17
accordance with the social media company's, model operator's , or third party's 18
privacy notice and administrative, technical, and physical data security practices. 19
(6) A social media company, model operator, or third party shall not share or receive 20
a user's personal data through the interoperability interface excep t with the 21
user's consent. 22
(7) A social media company or model operator shall adopt an accessible, prominent, 23
and persistent method for users to give consent for data sharing with other social 24
media services, artificial intelligence systems, or third parti es through the 25
interoperability interface. 26
(8) A social media company is not required to: 27
UNOFFICIAL COPY 26 RS BR 353
Page 5 of 7
XXXX 2/3/2026 2:57 PM Jacketed
(a) Provide access to: 1
1. Inferences, analyses, or derived data that the social media company 2
has generated internally about a user; or 3
2. Proprietary algorithms, ran king systems, or other internal operating 4
mechanisms; 5
(b) Transmit personal data: 6
1. That is stored or structured in a proprietary format; 7
2. For which no open, industry -standard format is reasonably available; 8
and 9
3. That would disclose information as described in subsection (7) of this 10
section; or 11
(c) Display or otherwise use data received from another social media company 12
or model operator. 13
(9) A business that uses an artificial intelligence system provided by a model operator 14
to provide applications or services to a user shall promptly transmit a user's 15
request to the model operator with sufficient information for the model operator 16
to execute the request and communicate about the request with the user. 17
SECTION 4. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 18
READ AS FOLLOWS: 19
(1) The Attorney General, in consultation with the Consumers' Advisory Council, 20
may identify open protocols that the Attorney General has determined, after an 21
assessment, meet the requirements of Section 3 of this Act. 22
(2) If a social media company or model operator uses an open protocol identified by 23
the Attorney General under subsection (1) of this section, the social media 24
company or model operator shall be entitled to a rebuttable presumption of 25
providing access on reasonable terms that do not discriminate between social 26
media services or artificial intelligence systems. 27
UNOFFICIAL COPY 26 RS BR 353
Page 6 of 7
XXXX 2/3/2026 2:57 PM Jacketed
SECTION 5. A NEW SECTION OF KRS CHAPTER 367 IS CREAT ED TO 1
READ AS FOLLOWS: 2
(1) The Attorney General shall have exclusive authority to enforce violations of 3
Sections 1 to 6 of this Act. The Attorney General may enforce Sections 1 to 6 of 4
this Act by bringing an action in the name of the Commonwealth of Kentu cky or 5
on behalf of persons residing in this Commonwealth. The Attorney General shall 6
have all powers and duties granted to the Attorney General under KRS Chapter 7
15 to investigate and prosecute any violation of Sections 1 to 6 of this Act. The 8
Attorney Ge neral may demand any information, documentary material, or 9
physical evidence from any social media company, model operator, or third party 10
believed to be engaged in, or about to engage in, any violation of Sections 1 to 6 11
of this Act. 12
(2) Prior to initiati ng any action for violation of Sections 1 to 6 of this Act, the 13
Attorney General shall provide a social media company, model operator, or third 14
party thirty (30) days' written notice identifying the specific provisions of Sections 15
1 to 6 of this Act that t he Attorney General alleges have been or are being 16
violated. If within the thirty (30) day period the social media company, model 17
operator, or third party cures the noticed violation and provides the Attorney 18
General an express written statement that the a lleged violations have been cured 19
and that no further violations shall occur, no action for damages under 20
subsection (3) of this section shall be initiated against the social media company, 21
model operator, or third party. 22
(3) If a social media company, mod el operator, or third party continues to violate 23
Sections 1 to 6 of this Act following the cure period in subsection (2) of this 24
section, or breaches an express written statement provided to the Attorney 25
General under subsection (2) of this section, the Attorney General may initiate an 26
action and seek damages for up to seven thousand five hundred dollars ($7,500) 27
UNOFFICIAL COPY 26 RS BR 353
Page 7 of 7
XXXX 2/3/2026 2:57 PM Jacketed
for each continued violation under Sections 1 to 6 of this Act. 1
(4) Nothing in Sections 1 to 6 of this Act or any other law, regulation, or the 2
equivalent shall be construed as providing the basis for, or giving rise to, a 3
private right of action for any violation of Sections 1 to 6 of this Act. 4
(5) The Attorney General may recover reasonable expenses incurred in investigating 5
and preparing the case , court costs, attorney's fees, and any other relief ordered 6
by the court for any action initiated under Sections 1 to 6 of this Act. 7
SECTION 6. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 8
READ AS FOLLOWS: 9
(1) There is hereby established in the State Treasury a trust and agency account to be 10
known as the digital choice fund. The fund shall consist of moneys received from 11
all civil penalties collected pursuant to Sections 1 to 6 of this Act. Interest earned 12
on moneys in the fund shall accrue to the fund. 13
(2) The fund shall be administered by the Office of the Attorney General. 14
(3) Amounts deposited into the fund shall be used by the Office of the Attorney 15
General to enforce Sections 1 to 6 of this Act. 16
(4) Notwithstanding KRS 45.229, fund amounts not expended at the close of the 17
fiscal year shall not lapse but shall be carried forward into the next fiscal year. 18
Section 7. If any provision of this Act or the application thereof to any person 19
or circumstance is held invalid, the invalidity shall not affect other provisions or 20
applications of this Act that can be given effect without the invalid provision or 21
application, and to this end the provisions of this Act are severable. 22
Section 8. This Act may be cited as the Kentucky Digital Choice Act. 23