UPDATE – FEBRUARY 2026:
The 2024 version of HB45 was passed during the 2024 Regular Session and signed into law. As a result, the privacy protections described in this story are no longer merely proposed measures but enacted statutory provisions.
The law establishes restrictions on ALPR data retention. Also, it limits drone-based surveillance involving facial recognition and biometric identification, creates civil liability for harmful deepfakes distributed without consent, prohibits mandatory implanted tracking devices, and enhances penalties for unlawful AI-enabled tracking. These provisions now form part of Kentucky’s active privacy and technology regulatory framework.
Additionally, the Kentucky Consumer Data Protection Act (KCDPA) took effect on January 1, 2026, further strengthening the state’s data privacy landscape. Early 2026 enforcement activity under the KCDPA signals that Kentucky regulators are prepared to apply these laws to emerging AI technologies and data-driven services.
Taken together, Kentucky has moved from considering AI-related privacy legislation to actively implementing and enforcing it.
ORIGINAL NEWS STORY:
Kentucky Bill Seeks to Regulate AI Technologies Impacting Privacy
Kentucky is the latest state government in the United States seeking to get ahead of emerging AI technologies. House Bill 45 (HB45) aims to increase state residents’ privacy protections against intrusive technologies enabled by AI. The multifaceted legislation specifically targets the use of automated license plate readers, drones utilizing facial recognition, deepfake videos, implanted microchips, and location tracking.
One section focuses on limiting how automated license plate reader (ALPR) systems can gather and retain data on vehicle locations. The bill restricts entities like law enforcement from keeping ALPR data for more than 30 days, except for ongoing felony investigations or other specific circumstances. Sharing or selling the ALPR data would also be prohibited except with a subpoena or for law enforcement needs.
The proposed law also makes using drones for illegal surveillance illegal, which would include drones equipped with AI-powered facial recognition or other biometric identification technologies. Flying a drone over private property to record residents going about their daily lives would violate a reasonable expectation of privacy, according to the legislation. There are exceptions built in for utility inspections, cargo delivery, search warrants, and other authorized drone operations. Victims of violations could sue for damages under the bill.
Targeting Deepfakes
HB45 also aims to ban deepfakes. Deepfakes can create fake audio or video of someone doing or saying something they never actually did. The bill would prohibit disseminating deep fakes of someone without their written consent. Exceptions exist for law enforcement, medical uses, commercial sales with notice, and other specific circumstances. In general, creating and distributing deepfakes to harm someone would open an individual or company up to lawsuits for damages.
The legislation also takes aim at invasive bio-tracking technologies. It prohibits requiring someone to be implanted with a microchip or other identification device to track their location or personal information. Previous abuses of chips in the workplace make this a privacy issue lawmakers want to address preemptively through the bill.
Finally, the proposed law enhances penalties for unlawfully using AI-enabled tracking devices to monitor someone’s location without their permission. Installing a tracker on someone’s phone or placing a tracker on their vehicle without consent would become a misdemeanor.
Need Help?
You might be wondering how HB45, or any other AI regulations and laws around the world, could impact you and your business. Don’t hesitate to reach out to BABL AI. Their Audit Experts can answer your concerns and questions while offering valuable insight.
