Privacy Law Library

Consumer Report Security Freeze Law (including protected persons)

KY Security Freeze

Credit reporting · Financial · Children

Lets Kentucky consumers freeze their credit reports so they cannot be released to new creditors without the consumer's authorization, and sets deadlines for placing, lifting, and removing freezes. A 2017 addition lets parents, guardians, and other representatives freeze the record or report of a child under 16 or an incapacitated person.

Where
Kentucky
Citation
KRS 367.363 to 367.365 (created 2006 Ky. Acts ch. 42; KRS 367.3645 created 2017 Ky. Acts ch. 119; amended 2018 Ky. Acts ch. 41)
Status
In force
In force since
2006-07-12
Last amended
2018-03-30
Enforced by
Consumers via civil action; Attorney General retains other enforcement powers
People can sue
Yes
Penalties
Willful noncompliance: actual damages, $100 to $1,000 liquidated damages, punitive damages, costs and attorney's fees. Negligent noncompliance: actual damages plus costs and fees. Anyone acting under false pretenses is liable to the agency for the greater of actual damages or $1,000.
Applies to
  • Consumer reporting agencies maintaining consumer reports on Kentucky consumers
  • Persons who obtain reports or request freezes under false pretenses

What a privacy notice must say

  • While a freeze is in place, send written confirmation within 30 days of any change to name, date of birth, SSN, or address; address changes go to both old and new addresses.KRS 367.365(11)

Rights it gives people

  • Consumers may request a security freeze by certified mail or any telephone, fax, or electronic method the agency offers; the agency must place it within 10 business days and then not release the report to third parties without express authorization.KRS 367.365(1)
  • A representative with sufficient proof of authority may request a freeze for a protected person (under 16 or under guardianship or conservatorship); the agency must create a record if none exists and place the freeze within 30 days.KRS 367.3645(1)-(4)

Practices it requires

  • Within 10 business days, give the consumer a unique PIN or password and written instructions for placing, lifting, and removing the freeze.KRS 367.365(2)
  • Temporarily lift a freeze within 3 business days of a proper request and remove it within 3 business days of a request with identification and PIN.KRS 367.365(6), (8)

Other duties

  • Freeze fees are capped at $10 (CPI-adjustable); no fee may be charged to identity theft victims who provide a police report.KRS 367.365(10)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The $10 fee provision appears to be superseded in practice by the 2018 federal requirement (15 U.S.C. 1681c-1) that nationwide agencies place and lift freezes free of charge; not verified against the federal text in this pass.

Research reference, not legal advice.