Indiana, Kentucky, and Rhode Island Privacy Laws Take Effect
Comprehensive privacy laws in Indiana (Consumer Data Protection Act), Kentucky (Consumer Data Protection Act), and Rhode Island (Data Transparency and Privacy Protection Act) all became effective on January 1, 2026, bringing the number of states with operative comprehensive privacy laws to roughly twenty as of August 2026. Indiana and Kentucky follow the familiar Virginia model with exclusive attorney general enforcement, a 30-day cure period, and civil penalties up to $7,500 per violation; Kentucky's Attorney General has established a dedicated Office of Data Privacy to handle enforcement and consumer complaints. Rhode Island diverges in important ways: a lower applicability threshold of 35,000 customers, no cure period, and treatment of violations as deceptive trade practices carrying penalties up to $10,000 per violation.
Key Analytics
Impact Analysis
2026 is proving to be an enforcement ramp year as much as an expansion year: the California Privacy Protection Agency has moved into monetary penalties (including a $632,500 order against American Honda in March 2025 over defective opt-out flows), the Texas Attorney General is actively litigating under the TDPSA through a dedicated privacy enforcement team, and Connecticut's Attorney General reported dozens of violation notices and its first CTDPA settlement in its latest enforcement report. Organizations that treated newer state laws as paper obligations should assume regulators will now test opt-out mechanisms, privacy notices, and rights-request workflows in practice. Rhode Island's lower threshold and lack of a cure period mean smaller businesses may be in scope for the first time with no grace window if a violation is alleged.
Recommended Actions
- Reassess applicability under the three new laws, paying particular attention to Rhode Island's 35,000-customer threshold, which can capture organizations that fall below other states' limits.
- Extend data subject request intake, verification, and response workflows to cover Indiana, Kentucky, and Rhode Island residents, noting that Rhode Island provides no cure period before enforcement.
- Update privacy notices and records of processing to reflect the three new jurisdictions, including Rhode Island's specific disclosure requirements around data sales and third-party sharing.
- Pressure-test opt-out mechanisms, consent flows, and authorized agent handling end to end, since the CPPA's Honda action shows regulators are penalizing broken or asymmetric privacy interfaces, not just missing policies.
- Maintain documented data protection assessments for targeted advertising, profiling, and sensitive data processing in a form ready to produce to a state attorney general on request.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Rights request workflow extension to Indiana, Kentucky, and Rhode Island
- ›End-to-end testing of opt-out, consent, and authorized agent handling
- ›Privacy notice and records of processing updates for three jurisdictions
- ›Data protection assessments held ready for attorney general production
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 80 to 170 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.