• by Wendy Davis  @wendyndavis, March 28, 2024

Kentucky lawmakers have passed a privacy bill that would empower residents to wield some control over their data, but wouldn't give people the right to reject a common form of online behavioral advertising.

If signed, House Bill 15, introduced last month and approved Wednesday by the state legislature, would enable residents to learn whether their personal information has been processed, and to have that information deleted.

While the bill includes a provision stating that people have the right to opt out of ad targeting, that provision doesn't apply to pseudonymous information -- like data linked to cookies or device identifiers -- provided such data is kept separately from information that could be used to identify people. Common behavioral ad targeting techniques rely on pseudonymous identifiers to track people across the web and infer their interests.

If signed by Governor Andy Beshear, the law will take effect in 2026.

The advocacy group Consumer Reports on Thursday urged Beshear to veto the measure, arguing that the privacy rights outlined in the bill are undercut by other provisions in it, including the exemption for pseudonymous information.

“This bill claims to be a consumer privacy measure, but it really only codifies the status quo preferred by large tech companies,” Consumer Reports policy analyst Matt Schwartz stated Thursday.

If enacted, Kentucky would join more than a dozen other states with new privacy laws. Of those other states Iowa, Tennesseee and Florida don't appear to require companies to allow people to opt out of ad targeting based on pseudonymous data.