• by Wendy Davis  @wendyndavis, April 5, 2024

Kentucky Governor Andy Beshear on Thursday signed a privacy law that gives residents some new rights to control their data, but doesn't give people the right to opt out of ad targeting based on pseudonymous information.

House Bill 15, which was approved unanimously by lawmakers and will take effect in January 2026, enables residents to learn whether their personal information has been processed, and to have that information deleted.

The statute has a provision giving people the right to opt out of ad targeting, but that provision doesn't apply when businesses target ads based on pseudonymous data, such as information stored on cookies or linked to device identifiers -- provided such data is kept separately from information that could be used to identify people. Common behavioral ad targeting techniques rely on pseudonymous identifiers to track people across the web and infer their interests.

The Kentucky law is largely modeled on a 2021 privacy statute in Virginia that was backed by the tech industry. But the Virginia law, unlike Kentucky's, gives people the right to opt out of the use of pseudonymous data for ad targeting.

Advocacy group Consumer Reports opposed the Kentucky law -- in part due to the exemption for pseudonymous ad targeting.

With Beshear's signature, Kentucky has now joined more than a dozen other states with privacy law. Most of those states require companies to let people reject ad targeting based on cookies or other pseudonymous identifiers. The exceptions, in addition to Kentucky, are Iowa, Tennessee and Florida.