Indiana, Kentucky and Rhode Island privacy laws start January 1, 2026

Three more US states switch on comprehensive consumer privacy laws on January 1, 2026: Indiana, Kentucky and Rhode Island. If your business collects personal data from people in any of them and you pass the size thresholds, you’ll need to honor access, correction, deletion and opt-out requests from their residents, get consent before processing sensitive data, and have a privacy notice that meets each law’s terms. Indiana and Kentucky look a lot like the laws already in force elsewhere. Rhode Island is the one that deserves a closer look, because it reaches smaller businesses and gives you no grace period to fix a mistake.

What changed

Indiana Consumer Data Protection Act

Indiana’s law was passed in 2023 and applies to businesses that operate in Indiana or target Indiana residents and either control or process the personal data of at least 100,000 Indiana consumers in a year, or handle data on at least 25,000 consumers and get more than 50% of gross revenue from selling personal data. Consumers get rights to access, correct, delete and port their data, and to opt out of targeted advertising, the sale of their data and certain profiling. Processing sensitive data needs opt-in consent. The Indiana Attorney General enforces the law, with a 30-day cure period and civil penalties of up to $7,500 per violation. The AG’s office has already published a consumer "bill of rights" explaining how it reads the law.

Kentucky Consumer Data Protection Act

Kentucky’s law was signed in April 2024 and uses the same 100,000 and 25,000 plus 50% thresholds. The rights are much the same. Sensitive data, which includes racial or ethnic origin, religious beliefs, health conditions, sex life and sexual orientation, needs consent. The Attorney General has exclusive enforcement power, with a 30-day cure period and penalties of up to $7,500 per violation. A 2025 amendment (HB 473) says the data protection assessment requirement applies to processing activities created or generated after June 1, 2026.

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island’s law covers businesses that control or process the personal data of at least 35,000 Rhode Island customers in a year (not counting data used only to complete a payment), or at least 10,000 customers where more than 20% of gross revenue comes from selling personal data. That 35,000 figure is one of the lowest in the country. It also has an unusual transparency rule: a commercial website or online service that collects and sells personal data has to identify the categories of data it collects and all the third parties it has sold, or may sell, that data to. Penalties run up to $10,000 per violation, and there’s no cure period.

Comparison of three state privacy laws effective January 1, 2026: Indiana and Kentucky apply at 100,000 consumers, carry penalties up to 7,500 dollars and allow a 30 day cure period; Rhode Island applies at 35,000 customers, carries penalties up to 10,000 dollars and has no cure period.
Indiana and Kentucky follow the usual template, while Rhode Island reaches smaller businesses and has no cure period.

Who it affects

These laws aren’t limited to companies based in the three states. An online shop in Texas with a big Kentucky customer list is covered just as much as a Louisville retailer. The ones most likely to be caught for the first time are regional retailers, subscription businesses, apps and marketing-heavy companies that hold large customer or loyalty databases.

The usual exemptions in state privacy laws (for certain regulated financial and health data, for example) differ in detail from state to state, so don’t assume your exemption in one state carries over to the next.

Key dates

What it means in practice

Take Harbor and Pine, a home goods retailer near Providence with a loyalty program covering 38,000 Rhode Island customers. It also ships nationwide and holds data on 38,000 Kentucky customers and 20,000 in Indiana. It doesn’t sell customer data.

So Harbor and Pine needs a Rhode Island compliant notice and a working process for requests from January 1. If it shares data with an ad network in a way that counts as a sale, it has to name those third parties. And if a regulator finds a gap, there’s no 30-day window to fix it first. Ten violations at $10,000 each is a $100,000 problem for a business that size.

My view: if you already comply with one of the mainstream state laws, Indiana and Kentucky are mostly a mapping exercise. Rhode Island is where you should spend your time before New Year’s Day.

What to do now

  1. Count consumers by state. Pull customer and marketing records and see where you sit against 100,000, 35,000 and the revenue-from-sales tests.
  2. Update your privacy notice. Add the new states, and for Rhode Island, list the categories of data and the third parties you sell to, if any.
  3. Check your consent flows for sensitive data, including health, precise location and data about children.
  4. Test your request process. Make sure access, deletion, correction and opt-out requests from these states are routed and answered on time.
  5. Review vendor contracts. Processors need proper terms; see our guide to data processing agreements and the glossary entry on the data processing agreement.
  6. Plan Kentucky assessments for any new high-risk processing you start after June 1, 2026.

For the bigger picture across all states, read our overview of US state privacy laws and our notes on website terms and privacy policies. The list of states keeps growing, so it’s worth checking again each January.

Sources

This article is general information, not legal or tax advice. Laws differ between countries and states and change over time, so check the rules that apply to you or speak to a qualified professional.