Connecticut Surveillance Pricing Law Delayed to July 1, 2027; Genetic Data Rules Took Effect October 1, 2026

Connecticut Surveillance Pricing Law Delayed to July 1, 2027; Genetic Data Rules Took Effect October 1, 2026

Connecticut Public Act 26-64 reached its October 1, 2026 effective date, but its surveillance pricing ban did not. The General Assembly repealed that section six days after enactment, then repealed its replacement two days later, and the surviving version does not bind retailers until July 1, 2027.

Information last verified on October 8, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers Connecticut state law only, specifically Public Act 26-64 and the two 2026 acts that amended it, Public Act 26-100 and Public Act 26-130. It does not cover federal pricing or genetic privacy law, the Federal Trade Commission's separate surveillance pricing work, or any other state's statute. It describes what the enacted text provides and does not assess how any court or the Attorney General will apply it.

What Happened

Substitute Senate Bill No. 4, "An Act Concerning Consumer Privacy and Protection," was approved on May 27, 2026 as Public Act 26-64. The Connecticut General Assembly's bill history records Senate passage on April 23, 2026, House concurrence on May 4, 2026, and signature on May 27, 2026.

The act runs 41 pages across twenty sections. Each section carries the marker "(Effective October 1, 2026)." That date arrived a week ago, which is why the act is being reported as newly in force.

The pricing section that was supposed to start October 1

Section 11 was the headline consumer provision. Its operative ban reads:

no retail seller or third-party delivery service doing business in the state shall engage in surveillance pricing.

Connecticut Public Act 26-64, Section 11(c)(1)

The section defined "surveillance pricing" as setting a customized price for a consumer good or service that is specific to a consumer, based in whole or in part on personal data that was both gathered through tracking technology such as biometric monitoring, a camera, device tracking or a sensor, and acquired by the person setting the price from a third party, directly or indirectly. Subparagraphs (A) and (B) of Section 11(a)(9) are joined by "and," so both elements had to be present.

Section 11(b)(1) added a separate labeling duty on any person doing business in the state who used a "price setting device" for a reason other than setting a discount and then advertised that price online. The required text was "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA."

Two repeals before the start date

Neither duty ever took effect. Public Act 26-100, approved June 2, 2026, provides at Section 66:

Sections 11 and 16 of public act 26-64 are repealed. (Effective from passage)

Because that repeal was effective from passage, Section 11 was off the books on June 2, 2026, nearly four months before its own October 1 start date. Public Act 26-100 substituted a new pricing section of its own, Section 44, with an effective date of February 1, 2027.

Two days later the legislature undid that too. Public Act 26-130, approved June 4, 2026, provides at Section 19: "Section 44 of public act 26-100 is repealed. (Effective from passage)." The surviving pricing law is Public Act 26-130, Section 11, which carries the marker "(Effective July 1, 2027)." That section is otherwise the same text as the one it replaced. Measured against Public Act 26-100, Section 44 it changes only two things: it moves the effective date from February 1, 2027 to July 1, 2027, and it drops the word "in-person" from the definition of "retail seller" in subsection (a)(8), so the section reaches retail sales generally rather than only in-person ones. The substantive rewrite described below was Public Act 26-100's work, carried forward.

The Connecticut Office of Legislative Research reaches the same endpoint in its official summary of Public Act 26-64, which states the act's effective date as "October 1, 2026 (except that PA 26-100, § 44, as amended by PA 26-130, § 11, delays the surveillance pricing provisions until July 1, 2027)."

What the surviving version changes

Public Act 26-130, Section 11 keeps the structure of the original: a ban in subsection (c), a disclosure duty in subsection (b), exemptions in subsection (d), and Attorney General enforcement in subsection (e). The substance moved in several places that matter to a business building a compliance plan.

The label text is shorter. Section 11(b)(1) now requires "THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA," and it must be readily visible to the average consumer. The trigger also changed: the duty no longer keys off using a "price setting device" but off engaging in surveillance pricing. A person required to give that disclosure must also disclose to consumers their rights under Conn. Gen. Stat. 42-518.

No disclosure is required if the advertised price is the bona fide market price, a term the new section defines as the price regularly advertised to the public for a reasonably substantial period.

The ban reaches further in one respect and less far in others. "Surveillance pricing" in the 2027 version covers a customized price specific to "a consumer or group of consumers," not just an individual consumer. The carve-outs grew: the customer-retention exception now also covers reestablishing a customer, attracting a new one, cross-selling, and reengaging a lapsed customer. Justifiable cost differences now expressly include consumers' physical locations.

Two new exceptions cover correcting a price resulting from a pricing error and resetting a price after a system or network outage.

The exempt-entity list was rewritten. Public Act 26-64 exempted insurance licensees, Gramm-Leach-Bliley financial institutions, and banks and holding companies supervised by the Banking Commissioner. Public Act 26-130, Section 11(d) keeps the insurance exemption and replaces the banking carve-outs with a demonstration-based exemption for a person who can show that a credit refusal or credit pricing decision rested on consumer report data under the Fair Credit Reporting Act or on factors a creditor may consider under the Equal Credit Opportunity Act. The enacted text cites 15 USC 1681 et seq. for both statutes.

Enforcement did not change. A violation is an unfair or deceptive trade practice under Conn. Gen. Stat. 42-110b(a) and "shall be enforced solely by the Attorney General." Section 11(e) also states that nothing in the section creates a private right of action or grounds for an action under Conn. Gen. Stat. 42-110g, the Connecticut Unfair Trade Practices Act's private remedy. A Connecticut consumer who believes a retailer priced them by tracking data cannot sue under this statute.

The Genetic Testing Regime That Did Take Effect

Sections 17 to 19 of Public Act 26-64 are the part of the act that actually became operative on October 1, 2026. Neither Public Act 26-100 nor Public Act 26-130 amends them; the word "genetic" does not appear in either later act.

The regime applies to a "direct-to-consumer genetic testing company," defined in Section 17(4) as any person doing business in Connecticut who, in the ordinary course of business, offers genetic testing directly to a consumer or collects, uses or analyzes genetic data a consumer provided. It excludes a Connecticut-licensed health care provider ordering genetic testing for a medical purpose within the scope of practice. A "consumer" is any individual physically present in the state who is a recipient or prospective recipient of genetic testing.

A property right in the sample

Section 18 is the provision worth reading closely, because property framing is unusual in state privacy statutes. Its operative sentence provides:

A consumer shall have a property right in, and shall retain the right to exercise exclusive control over, any biological sample that is derived from the consumer's body and provided to, or used by, a direct-to-consumer genetic testing company, as well as the results of any genetic testing conducted on the consumer's DNA by a direct-to-consumer genetic testing company.

Connecticut Public Act 26-64, Section 18

The section goes on to say that the right of exclusive control includes control over "the collection, use, retention, maintenance, disclosure or destruction" of the sample and the results. Section 19(a)(1) then requires companies to transact business "in a manner that is consistent with a consumer's rights under section 18."

The practical mechanism is not a lawsuit. Section 19(b) routes violations to the Attorney General alone and forecloses a private action, so the property right operates through the company's compliance duties and through enforcement, not through a consumer suing over their own DNA.

Consent is layered, not single

Section 19(a)(4) requires express consent before a company collects, uses or discloses genetic data, and it must first disclose its policies on use, the identity of each person who may access results including vendors and service providers, and how it may disclose the data. "Express consent" is defined in Section 17(6) as an affirmative response to a clear, meaningful and prominent notice about a specific purpose.

Section 19(a)(5) then requires separately obtained express consent for each of three things: disclosing or transferring genetic data to any person other than a vendor or service provider; using the data for any purpose other than the primary purpose for which testing was offered; and retaining the biological sample for any period after the testing is complete. A single checkbox at signup does not satisfy all four consents.

Research transfers get a federal standard. Section 19(a)(6) requires informed consent in accordance with the Common Rule, 45 CFR 46, for any disclosure or transfer of genetic data to a third party for research purposes, or for research under the company's control intended for publication or generalizable knowledge.

What a company may never do, consent or not

The enacted text contains no outright ban on selling genetic data. Sections 17 to 19 build a consent regime instead.

It does contain categorical disclosure bans. Section 19(a)(7) bars disclosing genetic testing results to anyone other than the consumer unless the consumer expressly consented or the disclosure is to a person acting under a court order, warrant or subpoena. Section 19(a)(8) bars disclosing genetic data to three categories outright, with no consent exception written in: the consumer's employer; any person who in the ordinary course of business offers health, life or long-term care insurance coverage in Connecticut or any other state, or who supplies data to an insurer, health care center or fraternal benefit society for underwriting or rating risks; and any third party the company knows or reasonably should know intends to use the data for marketing, including targeted advertising.

Section 19(a)(10) requires a process for the consumer to access their genetic data, require deletion, require destruction of the biological sample with confirmation, and revoke research consent both as to the company and as to any third party the company already gave the data to. Section 19(a)(9) requires reasonable security measures.

What Else in Public Act 26-64 Is Now Operative

The rest of the act is in force, and we reported the facial recognition and geolocation pieces at signing in our June coverage of the same act's facial recognition signage duty. Several points are worth stating plainly, and some have moved since then.

Data broker registration stands on its original timetable. Section 2(a) provides that "[e]xcept as provided in section 7 of this act, no data broker shall sell or license brokered personal data in this state on or after January 1, 2027, unless the data broker is actively registered with the Department of Consumer Protection." Section 7(a), as substituted by Public Act 26-100, Section 42, lifts Sections 1 to 10 off a list of entities and data: personal data handled under the Driver's Privacy Protection Act, HIPAA covered entities, business associates and protected health information, consumer reporting agencies, furnishers and users of consumer reports regulated under the Fair Credit Reporting Act, Gramm-Leach-Bliley financial institutions, businesses collecting data on their own customers, investors or donors, and political committees. Initial and renewal fees are $2,500 each under Section 2(b), and a registration expires December 31 of the year it issued. The Commissioner must establish an accessible deletion mechanism program by July 1, 2028 under Section 5(a)(1), and registered brokers must post annual deletion-request statistics starting July 1, 2029 under Section 6.

Public Act 26-100, Section 43 amended the civil penalty from not more than $200 per day for each violation to not more than $200 per day per consumer for each violation, imposed by the Commissioner after notice and a hearing.

The geolocation sale ban is in force. Section 14 adds Conn. Gen. Stat. 42-520(a)(3)(A): "No controller shall sell any consumer's precise geolocation data." Section 15 extends the same bar to third parties under 42-521. Both carry exceptions for the content of communications and for data generated by advanced utility metering infrastructure.

The facial recognition signage duty is in force, but its citation moved. Section 16 of Public Act 26-64, which carried that amendment to Conn. Gen. Stat. 42-524(a), was repealed by Public Act 26-100, Section 66 in the same breath as Section 11. Public Act 26-100, Section 45 substituted its own version of 42-524(a), effective October 1, 2026, carrying the signage requirement, the limit to matching still images or video against the controller's own database, and the policy hyperlink or QR code. Section 45 also adds a new subparagraph (a)(2)(C) under which a controller is not required to satisfy the signage and policy requirements with respect to a consumer whose consent to the use of facial recognition technology in the course of a commercial transaction it has obtained, a provision Public Act 26-64 Section 16 did not contain.

One more date for the calendar: Section 20 bars a streaming video service from transmitting commercial advertisement audio louder than the accompanying video content, but only "on and after July 1, 2027." Public Act 26-100, Section 58 rewrote the definitions in Section 20(a), including narrowing "streaming video service" to exclude broadcast stations, cable operators, multichannel video programming distributors, and services that carry no commercial advertisements. Attorney General enforcement only, and no private right of action.

The Connecticut Privacy Law All of This Amends

Sections 12 through 16 of Public Act 26-64 operate on the Connecticut Data Privacy Act, Conn. Gen. Stat. 42-515 to 42-526, which has governed controllers and processors in the state since 2023. The pricing and genetic testing sections are freestanding, but the CTDPA is the framework a Connecticut business is already measured against, and the 2026 amendments only make sense against it. We maintain a full treatment in our guide to the Connecticut Data Privacy Act.

Section 13 expands the access and deletion rights at 42-518(a). A consumer may now access inferences derived from their personal data and confirm whether they are being profiled for decisions with legal or similarly significant effects. The deletion right reaches publicly available information that was collated and combined into a consumer profile made available for compensation or for free, and any inference generated from it.

A new 42-518(a)(7) lets a consumer obtain a list of the third parties the controller sold their personal data to, or, if the controller keeps no such list, a list of all third parties it sold personal data to. Trade secrets are carved out. The rights these provisions build on are set out in the consumer rights the CTDPA already granted.

Section 14 also tightens controller duties at 42-520(a)(1). It bars selling sensitive data without consent, bars targeted advertising and the sale of personal data where the controller has actual knowledge or wilfully disregards that the consumer is at least 13 but under 18, and changes the new-purpose consent trigger from a "material" new purpose to any new purpose that is neither reasonably necessary to nor compatible with the disclosed purposes. Businesses mapping these duties against the rest of their obligations can work from our compliance checklist for Connecticut controllers, and our state-by-state privacy law tracker shows how the Connecticut rules now line up against the other state consumer privacy statutes in force.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The reporting hook here is an effective date that did not arrive. Public Act 26-64 marked every section "Effective October 1, 2026," and that marker is the date a reader will see on the face of the act. But a marker inside an act is not a guarantee that the section survives to its own start date, and Section 11 did not: it was repealed by an act approved June 2, 2026, six days after the act it sat in was signed.

That makes a practical difference to anyone building a compliance calendar from the act. A Connecticut retailer who read Public Act 26-64 in June and set an October 1 deadline for pricing changes was working from repealed text. A retailer who skipped the pricing question entirely because "it was repealed" is also wrong, because Public Act 26-130, Section 11 reinstated the ban with a July 1, 2027 date. The operative citation is now the criminal justice act, Public Act 26-130, which is not where anyone would look for a pricing rule.

The redrafting is also substantive, not cosmetic. Moving the disclosure trigger from "uses a price setting device" to "engages in surveillance pricing" narrows the duty considerably, because a company can run an automated pricing process on personal data without meeting the tracking-technology and third-party-acquisition elements of the surveillance pricing definition. Adding the bona fide market price safe harbor narrows it again. The new pricing-error and outage exceptions close two gaps a retailer would otherwise have litigated.

The exemption swap shifts a burden. Under Public Act 26-64 a covered bank sat outside the section by status. Under Public Act 26-130 a person claiming the credit exemption must be able to demonstrate that the pricing or refusal rested on consumer report data or on permitted creditor factors, a showing a status-based exemption never required.

On the genetic testing side, the property framing in Section 18 is the part worth watching, and it is worth being precise about what it does. A property right that cannot be enforced by its holder is an unusual instrument. Section 19(b) gives the consumer no private action, so the right's content is defined by the duties in Section 19 and by whatever the Attorney General chooses to enforce. Whether property framing adds anything beyond those duties is an open question that the text does not answer.

The categorical bans in Section 19(a)(8) are the provisions most likely to change behavior now. Consent-based rules can be satisfied with better interface design. A flat bar on routing genetic data to an employer, to a life or long-term care insurer, or to a marketer cannot be consented around on the face of the text.

The thread running through all of it is that Connecticut chose Attorney General enforcement every time. Section 11(e), Section 19(b) and Section 20(c) each route violations to Conn. Gen. Stat. 42-110b(a) and each expressly foreclose Conn. Gen. Stat. 42-110g. Consumers get rules without a remedy of their own, which means the real measure of these regimes will be how much enforcement capacity the Attorney General's office puts behind them.

This is general legal information, not legal advice. It covers Connecticut state law and reflects sources verified on October 8, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• our June coverage of the same act's facial recognition signage duty
• our guide to the Connecticut Data Privacy Act
• the consumer rights the CTDPA already granted
• our compliance checklist for Connecticut controllers
• our state-by-state privacy law tracker

Last updated: 2026-10-08. This is a developing story; details verified as of 2026-10-08.

Frequently Asked Questions

Is surveillance pricing illegal in Connecticut right now?

No. The surveillance pricing ban in Public Act 26-64, Section 11 was repealed by Public Act 26-100, Section 66, effective from passage on June 2, 2026, before its October 1, 2026 start date. The surviving ban is Public Act 26-130, Section 11, which is marked effective July 1, 2027.

What does Connecticut's surveillance pricing law actually prohibit?

Public Act 26-130, Section 11(c)(1) bars a retail seller or third-party delivery service doing business in Connecticut from engaging in surveillance pricing, meaning setting a customized price specific to a consumer or group of consumers based in whole or in part on personal data that was both gathered through tracking technology and acquired by the person setting the price from a third party. Loyalty programs consumers enroll in, publicly posted broad-group discounts, justifiable cost or timing differences, pricing-error corrections and post-outage resets are all excluded.

What price label will Connecticut require, and when?

From July 1, 2027, Public Act 26-130, Section 11(b)(1) requires an online disclosure reading THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA, or a substantially similar disclosure, readily visible to the average consumer. The person giving it must also disclose consumers' rights under Conn. Gen. Stat. 42-518. No disclosure is required if the advertised price is the bona fide market price.

Can a Connecticut consumer sue a retailer for surveillance pricing?

Not under this statute. Section 11(e) makes a violation an unfair or deceptive trade practice under Conn. Gen. Stat. 42-110b(a) enforced solely by the Attorney General, and states that nothing in the section creates a private right of action or grounds for an action under Conn. Gen. Stat. 42-110g. The genetic testing provisions at Section 19(b) and the streaming audio provision at Section 20(c) carry the same limitation.

Did Connecticut ban the sale of genetic data?

No. Public Act 26-64, Sections 17 to 19 contain no outright sale ban. They require express consent to collect, use or disclose genetic data, plus separate express consent for disclosure to anyone who is not a vendor or service provider, for secondary use, and for retaining the biological sample.

Can a genetic testing company give my results to my employer or my insurer?

Public Act 26-64, Section 19(a)(8) bars a direct-to-consumer genetic testing company from disclosing genetic data to the consumer's employer, to any person who in the ordinary course of business offers health, life or long-term care insurance in any state or supplies data to an insurer for underwriting or rating, and to any third party the company knows or reasonably should know intends marketing use. No consent exception is written into that subdivision. Section 19(a)(7) separately bars disclosing results to anyone but the consumer absent express consent or a court order, warrant or subpoena.

What does a property right in my biological sample mean under Section 18?

Section 18 gives a Connecticut consumer a property right in, and exclusive control over, the biological sample derived from their body and given to or used by a genetic testing company, and over the results of testing on their DNA. Control expressly includes collection, use, retention, maintenance, disclosure and destruction. Because Section 19(b) creates no private right of action, the right operates through the company's duties under Section 19 and through Attorney General enforcement rather than through a consumer lawsuit.

When do Connecticut data brokers have to register?

Public Act 26-64, Section 2(a) bars a data broker from selling or licensing brokered personal data in Connecticut on or after January 1, 2027 unless actively registered with the Department of Consumer Protection. Initial and renewal fees are $2,500 each and a registration expires December 31 of its issue year. The civil penalty, as amended by Public Act 26-100, Section 43, is up to $200 per day per consumer for each violation, imposed by the Commissioner of Consumer Protection after notice and a hearing.

Is Connecticut's precise geolocation sale ban in effect?

Yes. Public Act 26-64, Section 14 added Conn. Gen. Stat. 42-520(a)(3)(A), providing that no controller shall sell any consumer's precise geolocation data, and Section 15 extended the bar to third parties under 42-521. Both took effect October 1, 2026, with exceptions for the content of communications and for data generated by advanced utility metering infrastructure.