Connecticut Requires Facial-Recognition Signs (PA 26-64)

Connecticut Governor Ned Lamont signed Senate Bill 4 into law as Public Act 26-64 on May 27, 2026. The law requires businesses that use facial recognition on their premises to post entrance signage, and it sharply limits how state agencies use automated license-plate-reader data. Its main surveillance provisions take effect October 1, 2026, with enforcement of the facial-recognition rule reported to phase in later.

Information last verified on June 9, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses Connecticut Public Act 26-64 and the facial-recognition, license-plate-reader, geolocation, and data-broker provisions it adds to Connecticut law. It does not state the surveillance or privacy law of other states. For Connecticut consumer-privacy law generally, see Connecticut data privacy laws.

What Happened

On May 27, 2026, Governor Ned Lamont signed Senate Bill 4, titled An Act Concerning Consumer Privacy and Protection, into law as Public Act 26-64. The Connecticut Senate had passed the bill 31-4 on April 23, 2026, and the House passed it 141-6 on May 4, 2026, margins that crossed party lines in both chambers. The law is an omnibus update to the state's consumer-privacy regime, and several of its provisions sit squarely in the surveillance space the site covers.

Two pieces stand out for anyone who walks into a store or drives a car in Connecticut. The first is a notice mandate for facial recognition: a business that uses the technology on its premises now has to tell people at the door. The second is a set of guardrails on automated license-plate readers, the roadside cameras that log passing vehicles. The law phases in across several dates. The license-plate-reader provisions take effect October 1, 2026, and available summaries of the act report that Attorney General enforcement of the facial-recognition signage requirement begins February 1, 2027.

What the Law Actually Says

For facial recognition, Public Act 26-64 requires a business that uses the technology on its premises to post clearly legible signage at each public entrance, with an exception for entrances to employee-only restricted areas. The signage must point consumers, through a QR code or a hyperlink, to the business's facial-recognition policy, and that policy must include contact information for the Connecticut Attorney General. The duty applies even when the technology is used for security or fraud prevention rather than marketing, and the law places limits on how facial-recognition databases may be maintained. It folds facial recognition into Connecticut's broader privacy framework rather than leaving it unregulated.

For automated license-plate readers, the law restricts how Connecticut state agencies may use and share the data those cameras collect. It shields ALPR records from public disclosure, bars state agencies from contracting with vendors that sell or improperly disclose license-plate information, and prohibits using ALPR data for immigration enforcement or for investigations involving reproductive or gender-affirming health care. These are limits on government use of a surveillance tool, distinct from the consumer-facing facial-recognition notice rule.

The act reaches further still. It bans the outright sale of consumers' precise geolocation data, a categorical prohibition rather than an opt-out. It creates a data-broker registry at the Department of Consumer Protection and, on a later timeline, an accessible deletion mechanism that lets a resident ask brokers to delete their data through a single request, an approach modeled on California's Delete Act. All of these amend the Connecticut Data Privacy Act, codified at Conn. Gen. Stat. 42-515 and following, which Connecticut first enacted in 2022. For the underlying statute and consumer rights, see Connecticut data privacy laws and the state's biometric privacy rules.

What the Law Actually Says About Recording

Public Act 26-64 does not change Connecticut's recording-consent rules, which live in separate statutes. Connecticut requires all-party consent to record a private telephone conversation under its civil wiretapping statute, and it criminalizes certain unauthorized interceptions, a framework explained in our Connecticut recording laws guide. What the new law adds is a layer aimed at a different technology: passive identification and tracking through faceprints and license plates, rather than the recording of a conversation. A reader trying to understand their rights in Connecticut now has to look at two regimes, the consent rules for recording someone, and the new notice and use limits for facial recognition and plate readers.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The facial-recognition signage rule is the part most people will actually encounter. Several states regulate biometric data once it is collected, but Connecticut is among the few to require a business to tell you, at the entrance, that facial recognition is in use, and to route you to a written policy with a regulator's contact information. That shifts facial recognition from something that happens silently to something a shopper can see and question before walking in. It is a notice model rather than a ban, and notice models tend to draw fewer constitutional objections than outright prohibitions.

The license-plate-reader provisions point in a different direction: they regulate the government, not the storefront. By shielding ALPR records from disclosure and forbidding their use for immigration or reproductive-care investigations, the legislature drew lines around how a fast-spreading surveillance network can be queried. That debate is live in other states too, including the Boulder litigation we have covered over Flock cameras. Connecticut answered some of those questions by statute rather than waiting for a court. We are not predicting how other states will respond. The pattern worth watching is that a single privacy bill now bundles biometric notice, government surveillance limits, a geolocation-sale ban, and a data-broker deletion tool, a combination other legislatures may copy.

How This Affects You

If you live in or visit Connecticut, the most visible change is the requirement that businesses using facial recognition post entrance signs linking to a policy, a duty whose Attorney General enforcement is reported to begin February 1, 2027. If you drive in the state, the law limits how agencies can use plate-reader data about your vehicle, though it governs government use rather than giving you a direct claim. These are general descriptions of the law, not advice about any specific situation.

If you run a business or agency in Connecticut, the threshold questions are whether you use facial recognition on premises, whether you operate or query ALPR systems, and whether you qualify as a data broker that must register. A general summary is not a substitute for a close read of the enacted text and advice from a Connecticut-licensed lawyer where the stakes warrant it. The Connecticut Data Privacy Act is enforced by the Attorney General, not through private lawsuits.

This is general legal information, not legal advice. It covers Connecticut Public Act 26-64 as signed and reflects sources verified on June 9, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Related articles

• Connecticut data privacy laws (CTDPA)
• Connecticut recording laws: consent rules explained
• Biometric privacy laws by state
• Boulder license-plate-camera lawsuit (Flock)
• Ring facial-recognition class action

---

Last updated: 2026-06-09. This is a developing story; details verified as of June 9, 2026.