Kentucky Age Verification Law: HB 278 and KRS 436 Explained

Kentucky's age-verification law, House Bill 278, took effect July 15, 2024 and requires a "covered platform" to verify a visitor's age before granting access to material harmful to minors, but only where more than one-third of the material the site publishes is that kind of matter. Unlike most states in this cluster, Kentucky's Attorney General has no authority to enforce it; the law is private-lawsuit only by design.

What Kentucky's Age-Verification Law Requires

House Bill 278 added six new sections to KRS Chapter 436, a chapter that long predates 2024 and otherwise collects unrelated offenses against morality, several of whose older sections were repealed decades ago. The new sections are KRS 436.001 (definitions), 436.002 (liability for failure to perform age verification, the operative duty), 436.004 (a ban on retaining identifying information collected during verification), 436.006 (venue, defenses, and the bar on government enforcement), 436.008 (construction), and 436.009 (voiding any attempt to waive or be estopped from bringing a civil action under the law).

KRS 436.002(1) makes a covered platform liable in a civil action if it knowingly and intentionally publishes or distributes material on the internet, more than one-third of which is matter harmful to minors, and fails to perform age verification either by itself or through a third party. That one-third threshold is a real limit on who the statute reaches: a site where such material is a smaller share of what it publishes falls outside the section. "Covered platform" is itself a defined term, and KRS 436.001(2) defines it as a website that in the regular course of trade or business creates, hosts, or makes available matter harmful to minors with the objective of earning a profit, whether or not it actually earns one and whether or not that is its principal business.

The remedy is stated in the statute rather than inferred from summaries. KRS 436.002(2) allows recovery of damages of ten thousand dollars ($10,000) per instance that the covered platform failed to perform age verification, plus "actual damages, court costs, and reasonable attorney's fees."

Private Right of Action Only, No State Enforcement

KRS 436.006's title alone settles the enforcement question: "Civil actions -- Venue -- Defenses -- Enforcement by governmental entities or officers prohibited." Kentucky's Attorney General, unlike Oklahoma's or Texas's, has no statutory role in enforcing this law. Only a private individual with standing to bring a civil action can do so.

Who that individual may be is also limited. KRS 436.002(2) lets any person injured by a violation sue, or a parent or legal guardian sue on behalf of an injured minor. But KRS 436.002(3) applies the section only to a minor who is a permanent resident of Kentucky, has resided in Kentucky for more than one year, or has been sojourning in Kentucky for at least thirty-one consecutive days. A minor with no Kentucky connection of that kind is outside the statute, and so is the claim brought on that minor's behalf.

This puts Kentucky in the same structural category as Montana's law after its 2025 amendment removed the Montana Attorney General's enforcement authority, and North Dakota's NDCC 51-07-32. The practical difference for Kentucky is that this was the original design of HB 278, not a later narrowing.

Litigation Status

No legal challenge to HB 278 or KRS 436.001 through 436.009 was found in the litigation trackers reviewed for this article, including Orrick's Online Safety Law Center, which lists no Kentucky entry. This is a researched absence based on available trackers and search results, not a confirmed docket search, and should not be read as a guarantee that no suit has ever been filed.

The Law Requires Verification, Not a Ban

Kentucky's statute requires covered sites to verify a visitor's age before granting access to material harmful to minors; it does not make that material illegal to view once verification succeeds. Whether a particular site chooses to build a verification system or block Kentucky traffic instead, as some adult platforms have done in other states with similar laws, is that company's own business decision, not a requirement of Kentucky's statute.

Two Provisions Worth Knowing About

KRS 436.009 voids any attempt to waive the right to bring a civil action under the law, or to be estopped from bringing one, meaning a website cannot use its terms of service or a clickthrough agreement to sign away a user's ability to sue over a violation. Paired with the ban on retaining identifying information in KRS 436.004, the law is structured to keep the private right of action usable rather than something a site could contract around.

KRS 436.008 is labeled a construction clause, but it carries substantive coverage limits worth reading. It bars liability for an internet service provider and its affiliates or subsidiaries, for a general purpose search engine, and for a cloud service provider acting in that capacity, so long as the provider is not responsible for creating the content that constitutes matter harmful to minors. It provides that these sections do not subject a covered platform to liability to the extent federal law protects it, naming 47 U.S.C. sec. 230 specifically. And it disapplies the sections entirely in any case to the extent they would violate the Commerce Clause of the United States Constitution. Cutting the other way, KRS 436.008 also preserves other causes of action, sanctions, and criminal penalties otherwise available under state or federal law, and provides that complying with these sections does not excuse any other legal duty.

Kentucky's law predates the U.S. Supreme Court's June 2025 decision in Free Speech Coalition v. Paxton by roughly eleven months. That decision upheld Texas's similarly structured law and held that intermediate scrutiny, not strict scrutiny, is the correct First Amendment standard for this category of statute. It now supplies the standard against which any future challenge to Kentucky's law would be litigated.

Related Resources

• Age Verification Laws by State
• Montana Age Verification Law
• Texas Age Verification Law
• North Dakota Age Verification Law

---

Last updated: 2026-09-02.

Frequently Asked Questions

Is porn banned in Kentucky?

No. Kentucky's law requires covered websites to verify a visitor's age before granting access to material harmful to minors; it does not prohibit adults from viewing that material once verified.

What law requires age verification in Kentucky?

House Bill 278 (2024), enacted as 2024 Ky. Acts ch. 106 and codified as KRS 436.001 through 436.009.

Can Kentucky's Attorney General sue a noncompliant website?

No. KRS 436.006 expressly bars enforcement by governmental entities or officers. Only a private civil action brought by an affected individual is available under this law.

When did Kentucky's age-verification law take effect?

July 15, 2024. The official Kentucky Legislative Research Commission codification of KRS 436.001 through 436.009 carries that effective date, with a history line recording that the sections were created by 2024 Ky. Acts ch. 106.

Does Kentucky's law apply to every website with adult material?

No. KRS 436.002(1) reaches a covered platform only where more than one-third of the material it publishes or distributes online is matter harmful to minors. KRS 436.008 further carves out internet service providers, general purpose search engines, and cloud service providers that did not create the content, preserves federal protections including 47 U.S.C. sec. 230, and disapplies the sections where they would violate the Commerce Clause.

Has Kentucky's age-verification law been challenged in court?

No legal challenge was found in the litigation trackers and searches reviewed for this article, as of August 2026.

What can someone recover if a site fails to verify age in Kentucky?

KRS 436.002(2) provides damages of $10,000 per instance the covered platform failed to perform age verification, plus actual damages, court costs, and reasonable attorney's fees. The action may be brought by any person injured by a violation, or by a parent or legal guardian on behalf of an injured minor, and KRS 436.002(3) limits it to minors who are Kentucky permanent residents, have lived in Kentucky more than one year, or have been sojourning there at least thirty-one consecutive days.