Connecticut Requires Facial-Recognition Signs (PA 26-64)

Connecticut Governor Ned Lamont signed Senate Bill 4 into law as Public Act 26-64 on May 27, 2026. The law requires businesses covered by Connecticut's data privacy law that use facial recognition on their premises for security or fraud prevention to post entrance signage, and it bans the sale of precise geolocation data and creates a data-broker registry. Every section of the act was marked effective October 1, 2026, but two of them never got there: the General Assembly repealed sections 11 and 16 before that date, and the signage duty was re-enacted in Public Act 26-100.

Information last verified on October 8, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses Connecticut Public Act 26-64 and the facial-recognition, geolocation, and data-broker provisions it adds to Connecticut law. It does not state the surveillance or privacy law of other states. For Connecticut consumer-privacy law generally, see Connecticut data privacy laws.

What Happened

On May 27, 2026, Governor Ned Lamont signed Senate Bill 4, titled An Act Concerning Consumer Privacy and Protection, into law as Public Act 26-64. The Connecticut Senate had passed the bill 31-4 on April 23, 2026, and the House passed it 141-6 on May 4, 2026, margins that crossed party lines in both chambers. The law is an omnibus update to the state's consumer-privacy regime, and several of its provisions sit squarely in the surveillance space the site covers.

Two pieces stand out for anyone who walks into a store or carries a phone in Connecticut. The first is a notice mandate for facial recognition: a business that uses the technology on its premises for security or fraud prevention now has to tell people at the door. The second is a ban on selling consumers' precise geolocation data. The law phases in across several dates: every section was marked effective October 1, 2026, and some duties inside them start later. Two sections were repealed before that date, as explained below.

What the Law Actually Says

For facial recognition, the operative provision is no longer section 16 of Public Act 26-64. Public Act 26-100, section 66 (approved June 2, 2026) repealed sections 11 and 16 of Public Act 26-64 effective from passage, and Public Act 26-100, section 45 substituted its own version of Conn. Gen. Stat. 42-524(a), effective October 1, 2026, carrying the signage duty at subparagraph (a)(2). Public Act 26-100 also added a new subparagraph (a)(2)(C), which Public Act 26-64 did not contain: a controller is not required to satisfy the signage and policy requirements with respect to a consumer whose consent to the use of facial recognition technology in the course of a commercial transaction it has obtained. As re-enacted, the duty reaches a business that is a controller or consumer health data controller under Connecticut's data privacy law and uses the technology on its premises to prevent, detect or respond to security incidents, identity theft, fraud, harassment or other illegal activity. Such a business may match images only against a database it maintains itself, and it must post clearly legible signage at each entrance to the premises where the technology is in use, with an exception for entrances to employee-only restricted areas. The signage must alert people that facial recognition is in use and point them, through a QR code or a hyperlink, to the business's facial-recognition policy, and that policy must include contact information for the Connecticut Attorney General. The duty is tied to those security and fraud-prevention uses; the act does not add a separate signage rule for other uses. It folds facial recognition into Connecticut's broader privacy framework rather than leaving it unregulated.

Public Act 26-64 does not contain license-plate-reader provisions. Connecticut's limits on automated license-plate-reader data are in a separate law, Public Act 26-14.

Section 11 of Public Act 26-64, a surveillance pricing ban, was repealed by the same Public Act 26-100, section 66 and never took effect. Its replacement, Public Act 26-100, section 44, was in turn repealed by Public Act 26-130, section 19 (approved June 4, 2026). The surviving surveillance pricing provision is Public Act 26-130, section 11, which is marked effective July 1, 2027.

The act reaches further still. It bans the outright sale of consumers' precise geolocation data, a categorical prohibition rather than an opt-out. It creates a data-broker registry at the Department of Consumer Protection and, on a later timeline, an accessible deletion mechanism that lets a resident ask brokers to delete their data through a single request, an approach modeled on California's Delete Act. All of these amend the Connecticut Data Privacy Act, codified at Conn. Gen. Stat. 42-515 and following, which Connecticut first enacted in 2022. For the underlying statute and consumer rights, see Connecticut data privacy laws and the state's biometric privacy rules.

What the Law Actually Says About Recording

Public Act 26-64 does not change Connecticut's recording-consent rules, which live in separate statutes. Connecticut requires all-party consent to record a private telephone conversation under its civil wiretapping statute, and it criminalizes certain unauthorized interceptions, a framework explained in our Connecticut recording laws guide. What the new law adds is a layer aimed at a different technology: passive identification and tracking through faceprints, rather than the recording of a conversation. A reader trying to understand their rights in Connecticut now has to look at two regimes, the consent rules for recording someone, and the new notice and use limits for facial recognition.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The facial-recognition signage rule is the part most people will actually encounter. Several states regulate biometric data once it is collected, but Connecticut is among the few to require a business that uses facial recognition for security or fraud prevention to tell you, at the entrance, that it is in use, and to route you to a written policy with a regulator's contact information. That shifts facial recognition from something that happens silently to something a shopper can see and question before walking in. It is a notice model rather than a ban, and notice models tend to draw fewer constitutional objections than outright prohibitions.

The geolocation-sale ban points in a different direction: it is a categorical prohibition rather than the notice model used for facial recognition. Connecticut addressed government use of license-plate readers in a separate act, Public Act 26-14, not in this bill. We are not predicting how other states will respond. The pattern worth watching is that a single privacy bill now bundles biometric notice, a geolocation-sale ban, and a data-broker deletion tool, a combination other legislatures may copy.

How This Affects You

If you live in or visit Connecticut, the most visible change is the requirement that businesses using facial recognition for security or fraud prevention post entrance signs linking to a policy, a duty that took effect October 1, 2026 under Public Act 26-100, section 45 rather than under the repealed section 16 of Public Act 26-64, and that does not apply with respect to a consumer whose consent was obtained in the course of a commercial transaction. These are general descriptions of the law, not advice about any specific situation.

If you run a business in Connecticut, the threshold questions are whether you are covered by Connecticut's data privacy law and use facial recognition on premises for security or fraud prevention, and whether you qualify as a data broker that must register. A general summary is not a substitute for a close read of the enacted text and advice from a Connecticut-licensed lawyer where the stakes warrant it. The Connecticut Data Privacy Act is enforced by the Attorney General, not through private lawsuits.

This is general legal information, not legal advice. It covers Connecticut Public Act 26-64 as signed, together with the later acts that amended it, and reflects sources verified on October 8, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Related articles

• Connecticut data privacy laws (CTDPA)
• Connecticut recording laws: consent rules explained
• Biometric privacy laws by state
• Boulder license-plate-camera lawsuit (Flock)
• Ring facial-recognition class action

---

Last updated: 2026-10-08. This is a developing story; details verified as of 2026-10-08.

Frequently Asked Questions

When does Connecticut's facial-recognition rule take effect?

The signage duty took effect October 1, 2026, but not under the section this article originally cited. Public Act 26-64 was signed May 27, 2026 and every section was marked effective October 1, 2026. Public Act 26-100, section 66 then repealed sections 11 and 16 of Public Act 26-64 on June 2, 2026, and Public Act 26-100, section 45 re-enacted Conn. Gen. Stat. 42-524(a) with the signage duty at subparagraph (a)(2), effective October 1, 2026.

What does the facial-recognition signage rule require?

A business covered by Connecticut's data privacy law that uses facial recognition on its premises for security or fraud prevention must match faces only against a database it maintains itself and post clearly legible entrance signage with a QR code or hyperlink to its facial-recognition policy, and that policy must include Connecticut Attorney General contact information. The act ties the duty to those uses and adds no separate signage rule for other uses.

Does the law restrict license-plate readers?

Not in this act. Public Act 26-64 contains no license-plate-reader provisions; Connecticut addressed ALPR data in a separate law, Public Act 26-14.

Does Public Act 26-64 change Connecticut's recording-consent rules?

No. Connecticut's all-party consent rule for recording private phone calls and its criminal wiretapping provisions live in separate statutes. The new law adds notice and use limits for facial recognition.

What is the data-broker deletion registry?

Public Act 26-64 creates a Department of Consumer Protection data-broker registry and, on a later timeline, a single deletion mechanism that lets a resident ask registered brokers to delete their data through one request, an approach modeled on California's Delete Act.

Who enforces the new requirements?

The Connecticut Attorney General enforces the Connecticut Data Privacy Act, which Public Act 26-64 amends. The Act does not create a private right of action.