Kentucky’s Smart TV Consent Requirement and the FTC’s New Focus on Children Online

Want to receive these privacy recaps in your inbox each week? Subscribe here.

Two notable privacy law developments are shaping the regulatory outlook for businesses: Kentucky has passed a first-of-its-kind amendment requiring consumer consent before smart TVs collect automatic content recognition data, while the FTC has released a five-year strategic plan naming protecting children online a top enforcement priority. Together, these actions reflect a growing national push at both the state and federal level to give consumers greater control over how their data is collected and used.

Keep reading to learn more and discover my takeaways.

United States

Kentucky Passes Bill Requiring Consent for Smart TV ACR Data Collection.

The Kentucky legislature passed an amendment to its comprehensive privacy law prohibiting controllers from collecting automatic content recognition (ACR) data without a consumer’s consent. “Automatic content recognition data” is defined as “data about a consumer’s content viewing history collected through the use of technology that is embedded or operated through a smart television or smart monitor, integrated with internet connectivity and an operating system that identifies, in real time, the specific content displayed by analyzing audio or video fingerprints”. The definition includes content received through broadcast, cable, satellite, streaming services, or external inputs, through digital fingerprinting, watermark detection, or similar comparison techniques. It does not include data collected about a consumer’s interactions with content provided by the controller’s own services, data generated while providing a feature or service requested by a consumer, or data collected to enforce terms of service. Unless the Governor vetoes it, the amendment will take effect on July 1, 2027.

TAKEAWAY

ACR technology has been the subject of several Texas AG lawsuits filed against smart TV companies in late 2025. Those actions alleged collection, through ACR technology, and sale for advertising purposes, of consumer viewing information without informed consent violated the Texas Trade Practices Act. To state a claim under that law, the Texas AG had to allege that the defendants engaged in false, misleading, or deceptive acts or practices. One defendant, Samsung, settled, agreeing to consent-based ACR practices without paying monetary penalties, but the remaining actions are still ongoing. By passing a law expressly requiring consent for ACR data collection, Kentucky may find it easier to take action against Smart TV companies and can seek monetary penalties up to $7,500 per violation (i.e., per affected consumer). However, the Attorney General must provide 30-day notice and an opportunity to cure before bringing an action.  

FTC’s 5-Year Strategic Plan Names Protecting Children Online as a Key Concern.

The Federal Trade Commission (FTC) published a strategic plan for fiscal years 2026-2030, listing its strategic goals and objectives. In its description of Strategic Goal 1 (Protect Americans from unfair or deceptive acts or practices in the marketplace), the plan states that protecting children online is “a key concern, and a place where the FTC is focusing its consumer protection tools and resources”. The plan identifies the Children’s Online Privacy Protection Act (COPPA) as the FTC’s primary authority in this area.

TAKEAWAY

This description is a new addition to the FTC’s strategic plan and is further emphasized by FTC Chairman Ferguson’s introductory message, which states that protecting children online is “one of the most important consumer protection issues of our time”. This implies we may see increased enforcement actions regarding children’s privacy and other child protection issues. However, this may be balanced against another new addition to the plan: returning the phrase “without unduly burdening legitimate business activity” to the mission statement. Chairman Ferguson described this as “reflecting our commitment to end overregulation of American businesses that compete fairly and deal honestly with consumers”. The FTC recently issued a policy statement clarifying that the commission won’t bring enforcement actions under COPPA against sites that collect, use or disclose children’s personal information solely to determine the user’s age without obtaining parental consent, provided certain conditions are met. This statement may foreshadow the type of balancing we can expect from the FTC in this area.  

A LITTLE MORE PRIVACY, IF YOU PLEASE

• FTC Takes Action Against Match and OKCupid Alleging Deceptive Data Sharing
• California Governor Issues Executive Order on AI Standards for Government Contracts
• South Korea DPA Publishes Revised Pseudonymization Guidance
  
  
  

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.