{"id":735,"date":"2026-10-03T14:15:00","date_gmt":"2026-10-03T12:15:00","guid":{"rendered":"https:\/\/grindloop.io\/blog\/?p=735"},"modified":"2026-10-03T13:39:30","modified_gmt":"2026-10-03T11:39:30","slug":"kotlin-data-class-copy-private-constructor","status":"publish","type":"post","link":"https:\/\/grindloop.ai\/blog\/kotlin-data-class-copy-private-constructor\/","title":{"rendered":"Why a Private Constructor Doesn’t Stop Kotlin Data Class copy()"},"content":{"rendered":"

A private constructor on a Kotlin data class doesn’t stop callers from building new instances. The compiler still generates a public copy()<\/code>. It calls that private constructor for anyone who holds an instance. So a factory that validates input guards only the first object. Every copy after it skips the factory. Kotlin 2.0.20 started warning about this. Kotlin 2.4.20 still only warns. Its compiler message says the warning becomes an error in language version 2.5. A second cause sits under the first. The rules about what counts as a valid value live in the factory, not in the type. That’s why closing copy()<\/code> alone isn’t enough. The fix has two parts. Annotate the class with @ConsistentCopyVisibility<\/code> so the data class copy matches the constructor’s visibility. Then move every invariant into an init<\/code> block, so every constructor call checks it. That includes the class’s own calls to copy()<\/code>.<\/p>\n\n

An Email value object that a caller can forge<\/h2>\n\n

The running example is an Email<\/code> type. The only way in is Email.of()<\/code>. It trims and lowercases the raw input, checks the format and returns null when the check fails. The constructor is private, so the author believes every Email<\/code> passed through that check.<\/p>\n\n\n

data class Email private constructor(val value: String) {\n    companion object {\n        private val EMAIL = Regex(\"^[^@\\\\s]+@[^@\\\\s]+\\\\.[a-z]+$\")\n\n        fun of(raw: String): Email? {\n            val normalized = raw.trim().lowercase()\n            return if (EMAIL.matches(normalized)) Email(normalized) else null\n        }\n    }\n}\n\nfun main() {\n    val email = Email.of(\"  Ana@Example.COM \")!!\n    println(email)\n    val forged = email.copy(value = \"not an email\")\n    println(forged)\n}<\/pre>\n\n\n
Compiled with kotlinc<\/code> 2.4.20 and run on the JVM, it prints this:<\/p>\n\n\n
Email(value=ana@example.com)\nEmail(value=not an email)<\/pre>\n\n\n
The build passes. It reports two warnings, one on the class and one on the call site. The first starts with “non-public primary constructor is exposed via the generated ‘copy()’ method.” A warning is easy to miss in a long build log, so the forged value can ship.<\/p>\n\n
Root cause 1: the data class copy() ignores the constructor’s visibility<\/h2>\n\n
The data classes docs<\/a> show what the compiler generates. For a class User(name, age)<\/code>, copy()<\/code> is a function with default arguments that returns User(name, age)<\/code>. It’s an ordinary call to the primary constructor. By default, the compiler gives that function public visibility, whatever the constructor’s visibility is.<\/p>\n\n
The bug report is KT-11914<\/a>. It was filed in April 2016 against Kotlin 1.0.1. The problem is nearly as old as the language. The issue says the language committee agreed to treat the current behavior as a design bug. The fix ships in phases, because changing copy()<\/code>‘s visibility changes the binary signature that compiled callers link against.<\/p>\n\n