EnglishEspañol
Data Privacy LawsConnecticut Laws flagConnecticut Laws
Connecticut flag

Connecticut

Connecticut Data Privacy Laws: CTDPA Consumer Rights Guide (2026)

Independently fact-checkedEditor-reviewedLaw current as of August 14, 2026By Recording Law Editorial TeamReviewed October 12, 202630 min read

Independently fact-checked against primary sources (last audited August 14, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 14, 2026. · 16 primary sources cited on this page. How we verify our legal content

Connecticut Data Privacy Laws: CTDPA Consumer Rights Guide (2026)

Connecticut gives residents several enforceable privacy rights under the Connecticut Data Privacy Act, codified at Conn. Gen. Stat. 42-515 through 42-525 and effective July 1, 2023. Those rights cover access, correction, deletion, portability, the right to obtain a list of third parties who purchased their data, opt-out from data sales and targeted advertising, and appeal. A CTDPA violation is an unfair trade practice enforced solely by the Attorney General, and the Connecticut Unfair Trade Practices Act allows a civil penalty of up to $5,000 for each violation a court finds wilful.

Connecticut has built one of the most active comprehensive data privacy regimes in the United States. The Connecticut Data Privacy Act (CTDPA), signed on May 10, 2022, as Public Act 22-15 and effective July 1, 2023, made Connecticut one of the first five states with a comprehensive consumer privacy law. The law has since been amended three times, most recently by Public Act 26-64 (Substitute SB 4), signed May 27, 2026 and effective October 1, 2026.

This guide covers the CTDPA's scope, consumer rights, business obligations, and enforcement record, the state's data breach notification statute, the Insurance Data Security Law, and the federal overlay that applies to Connecticut residents regardless of the CTDPA's scope.

What Is the Connecticut Data Privacy Act (CTDPA)?

The Connecticut Data Privacy Act is codified at Conn. Gen. Stat. 42-515 through 42-525. Originally modeled on the Colorado Privacy Act, the CTDPA establishes comprehensive privacy rights for Connecticut residents and imposes specific obligations on businesses that collect and process personal data.

The law protects Connecticut residents acting in an individual or household context, such as browsing the internet or making a purchase. It does not protect individuals acting in an employment context, such as applying for a job or performing work duties.

Closed grey laptop, folded reading glasses and a linen notebook on a walnut desk by a window

Connecticut's approach to data privacy is notable for several reasons. Unlike California's CCPA, the CTDPA has no annual revenue threshold. Unlike Utah's UCPA, businesses do not need to exceed a revenue requirement to fall within scope. This makes the CTDPA one of the more consumer-friendly state privacy laws in the country.

Who Must Comply With the CTDPA?

The CTDPA applies to businesses that conduct business in Connecticut or produce products or services targeted to Connecticut residents and meet one of the following thresholds:

  • Consumer volume threshold: Control or process personal data of at least 35,000 Connecticut consumers (lowered from 100,000 by Public Act 25-113, effective July 1, 2026)
  • Sensitive data processing: Control or process sensitive data of any number of consumers, with no volume threshold (since July 1, 2026)
  • Data sale activity: Offer consumers' personal data for sale in trade or commerce, regardless of volume (since July 1, 2026)
  • Consumer Health Data: All Consumer Health Data Controllers are covered regardless of size or scale

Public Act 25-113 also eliminated the former alternative threshold for businesses processing 25,000 consumers' data while deriving more than 25% of gross revenue from data sales; those businesses are now covered through the tests above.

There is no annual revenue threshold, which distinguishes the CTDPA from several other state privacy laws including California's CCPA and Utah's UCPA.

Exempt Entities

The following entities are exempt from the CTDPA:

  • State and local government agencies
  • Nonprofit organizations (except for Consumer Health Data provisions)
  • Higher education institutions
  • National securities associations registered under the Securities Exchange Act of 1934
  • Entities subject to HIPAA
  • Political organizations (added by the 2025 amendments)

The 2025 amendments (Public Act 25-113) replaced the blanket entity-level GLBA exemption with targeted data-level and entity-specific exemptions. Financial institutions such as insurers, banks, and credit unions receive specific exemptions rather than a blanket exemption.

Exempt Data Types

Certain types of data are exempt from the CTDPA when maintained in compliance with other federal laws:

  • Data regulated under the Gramm-Leach-Bliley Act (data-level exemption)
  • Protected health information under HIPAA
  • Data covered by the Fair Credit Reporting Act
  • Data protected by the Family Educational Rights and Privacy Act (FERPA)
  • Data processed for specified regulatory compliance purposes

Consumer Rights Under the CTDPA

The CTDPA grants Connecticut residents core privacy rights over their personal data. The Attorney General's office enumerates six of these as its core list (access, correction, deletion, portability, the right to obtain a list of third parties, and opt-out), treating appeal as a related but separate right that applies when a rights request is denied.

data privacy - records management

Right to Access

Consumers can request confirmation of whether a controller is processing their personal data and obtain a copy of that data. The 2025 amendments expanded this right to include the right to know what inferences have been derived from their personal data. Controllers must respond within 45 days, with one possible 45-day extension.

Right to Correct

Consumers can request that a controller correct inaccuracies in their personal data, taking into account the nature of the data and the purposes of processing.

Right to Delete

Consumers can request deletion of their personal data, including data that the controller collected through third-party sources. This broad deletion right extends beyond data directly provided by the consumer.

Right to Data Portability

Consumers can obtain a copy of their personal data in a portable and readily usable format that allows transfer to another controller without hindrance.

Right to Obtain a List of Third Parties

Added by the 2025 amendments, consumers can request a list of the third parties to which a controller has sold their personal data. If the controller does not maintain a list tied to that consumer, it must instead provide a list of all third parties to which it has sold personal data. The fallback is a list of named third parties, not a list of categories. A controller is not required to reveal a trade secret in responding.

Right to Opt Out

Consumers can opt out of three types of processing:

  • The sale of their personal data
  • Targeted advertising based on their data
  • Profiling that produces legal or similarly significant effects (the 2025 amendments expanded this from "solely automated" decisions to "any automated" decisions, including those with some human involvement)

Right to Appeal

If a controller denies a consumer rights request, the consumer has the right to appeal. The controller must respond within 60 days, explaining any actions taken and reasons for the decision. If the appeal is denied, the controller must provide information on how to file a complaint with the Connecticut Attorney General.

Universal Opt-Out Preference Signals

As of January 1, 2025, all controllers subject to the CTDPA must honor universal opt-out preference signals, including Global Privacy Control, sent through privacy-protective browsers or extensions. The signal must come from a platform or mechanism that accurately determines whether the consumer is a Connecticut resident. Controllers cannot override the opt-out signal, though they may notify consumers of conflicts with prior consent choices.

In September 2025, Connecticut Attorney General William Tong joined the attorneys general of California and Colorado and the California Privacy Protection Agency in a joint investigative sweep targeting businesses not processing GPC signals. The coalition sent letters to businesses that were not processing opt-out requests submitted via GPC and requested immediate compliance. Over 40 million consumers use GPC as of 2025.

Sensitive Data Protections

The CTDPA requires controllers to obtain explicit, affirmative consent before processing sensitive data. Under the law, sensitive data includes:

  • Data revealing racial or ethnic origin
  • Religious beliefs
  • Mental or physical health conditions, diagnoses, disability, or treatment
  • Sexual orientation or sexual activity
  • Citizenship or immigration status
  • Genetic data
  • Biometric data used to identify a specific individual
  • Personal data from a known child under age 13
  • Precise geolocation data
  • Consumer health data

The 2025 amendments (Public Act 25-113) expanded the definition of sensitive data to also include:

  • Transgender or nonbinary status
  • Neural data (information generated by measuring activity of an individual's central nervous system)
  • Financial account numbers with access credentials
  • Government-issued identification numbers

Additionally, the amended law requires separate, explicit consumer consent before a controller may sell sensitive data. The definition of "publicly available information" was updated to exclude biometric data collected without consumer consent.

Children's and Minors' Data Protections

Connecticut provides some of the strongest protections for children's and minors' data of any state privacy law.

Children Under 13

Personal data collected from a child the controller has actual knowledge is under 13 is classified as sensitive data. Processing requires parental consent consistent with COPPA standards.

Minors Ages 13 to 17

Since October 1, 2024, consumers under 16 must provide opt-in consent before their data can be sold or used for targeted advertising. The 2025 amendments (effective July 1, 2026) went further:

  • Controllers are categorically prohibited from processing minors' personal data for targeted advertising or sale, regardless of whether consent is obtained
  • Controllers cannot use system design features that significantly increase, sustain, or extend a minor's use of an online service (anti-addictive design provisions)
  • Impact assessments are required when profiling minors
  • Restrictions apply to the collection of minors' geolocation data and direct messaging capabilities

The February 2026 enforcement report from Attorney General Tong disclosed multiple active investigations into the safety of children and teens online, spanning messaging platforms, gaming, and AI chatbots.

Connecticut's 2026 amendments, enacted as Public Act 26-64 (signed May 27, 2026, effective October 1, 2026), did not add new minor-specific provisions; the minor protections above come from Public Act 25-113. Public Act 26-64 instead targets data brokers, precise geolocation sales, facial recognition technology, and algorithmic pricing, addressed below. Two of those sections were repealed weeks after enactment, and only the facial recognition one was re-enacted.

data privacy - children and student data privacy

Business Obligations Under the CTDPA

Controllers subject to the CTDPA must comply with the following obligations.

Privacy Notice Requirements

Controllers must provide a clear, accessible privacy notice that describes:

  • Categories of personal data processed
  • Purposes of processing
  • How consumers can exercise their rights
  • Categories of personal data shared with third parties
  • Categories of third parties with whom data is shared
  • An easily accessible link for opting out of targeted advertising or data sales

Data Minimization

Collection of personal data must be limited to what is "reasonably necessary and proportionate" in relation to the disclosed purposes. Processing for materially new purposes requires additional consent unless compatible with the original disclosed purposes.

Data Protection Assessments

Controllers must conduct and document data protection assessments for high-risk processing activities, including:

  • Targeted advertising
  • Sale of personal data
  • Processing sensitive data
  • Profiling that presents a risk of unfair treatment, financial injury, or intrusion on solitude

The 2025 amendments created separate "impact assessment" requirements for profiling that produces legal or similarly significant effects on consumers, distinct from the existing data protection assessments.

Processor Requirements

Processors must assist controllers in meeting their obligations. Controller-processor contracts must include provisions on data processing instructions, confidentiality, deletion or return of data upon contract termination, and cooperation with assessments.

Security Safeguards

Controllers must implement and maintain reasonable administrative, technical, and physical security practices to protect the confidentiality, integrity, and accessibility of personal data.

LLM Training Disclosure

Effective July 1, 2026, controllers must disclose whether they collect personal data for the purpose of training large language models. This provision reflects growing concern about AI systems trained on consumer data without consent.

Connecticut Data Breach Notification Law

Separate from the CTDPA, Connecticut's data breach notification statute (Conn. Gen. Stat. 36a-701b) imposes specific requirements on businesses that experience a security breach involving personal information.

Who Must Report

Any person who owns, licenses, or maintains computerized data that includes personal information must report a breach. This includes businesses of all sizes operating in Connecticut.

Definition of Personal Information

Under the breach notification law, "personal information" means an individual's first name or first initial and last name in combination with any one or more of the following:

  • Social Security number
  • Driver's license number or state identification card number
  • Credit or debit card number
  • Financial account number combined with any required security code, access code, or password that permits account access
  • Taxpayer identification number
  • Passport number
  • Medical information or health insurance information
  • Biometric information
  • Precise geolocation data
  • Identity protection personal identification number issued by the Internal Revenue Service

Notification Timeline

Notice to affected Connecticut residents must be provided without unreasonable delay and no later than 60 days from discovery of the breach. Notice to the Office of the Attorney General must be provided no later than when residents are notified.

Credit Monitoring Requirement

If a resident's Social Security number or taxpayer identification number is compromised, the business must offer 24 months of free credit monitoring services to affected individuals. This is among the longer credit monitoring periods required by any state. If a breach notice offers you that monitoring, enrolling costs nothing; once the 24 months end, a paid service such as Aura is one option if you want alerts to continue.

Penalties for Non-Compliance

Failure to comply with breach notification requirements constitutes a violation of the Connecticut Unfair Trade Practices Act (CUTPA), which can result in civil penalties and enforcement action by the Attorney General.

a plain white envelope slit open with a blank folded sheet drawn out, and a brass letter opener on a dark desk

Connecticut Insurance Data Security Law

In addition to the CTDPA and the breach notification statute, Connecticut's Insurance Data Security Law (Conn. Gen. Stat. 38a-38 et seq., enacted with an original effective date of October 1, 2020, later delayed by COVID-19 executive orders and Public Act 21-157 to a compliance date of October 1, 2021) imposes cybersecurity obligations on entities licensed by the Connecticut Insurance Department. This includes insurers, agents, brokers, and other insurance industry licensees.

Core Requirements

Licensees must develop and maintain a written information security program. The program must be based on the licensee's risk assessment, be appropriate to the size and complexity of the licensee's operations, and address administrative, technical, and physical safeguards.

Cybersecurity Event Requirements

Licensees must investigate any suspected cybersecurity event, assess its nature and scope, identify any private information potentially compromised, and restore system security. Records relating to cybersecurity events must be retained for at least five years.

Notification to the Commissioner

Licensees must notify the Insurance Commissioner as soon as possible, but within three business days, after determining that a cybersecurity event occurred. The notification must include the date of the event, how the licensee discovered it, a general description of the information involved, and any remediation steps taken. Consumer notification follows the existing state breach notification law (Conn. Gen. Stat. 36a-701b).

Exemptions

Licensees with fewer than 10 employees, including independent contractors with access to the licensee's nonpublic information, are exempt from the full written information security program requirement. Connecticut's exemption is based solely on employee count; the statute does not include a revenue or asset-based prong.

CTDPA Penalties and Enforcement

The Connecticut Attorney General has exclusive enforcement authority over the CTDPA. There is no private right of action, meaning consumers cannot sue businesses directly for violations.

Civil Penalties

Conn. Gen. Stat. 42-525(e) sets no dollar figure. It provides that a CTDPA violation is an unfair trade practice under Conn. Gen. Stat. 42-110b, enforced solely by the Attorney General, so the money comes from the Connecticut Unfair Trade Practices Act penalty statute, Conn. Gen. Stat. 42-110o.

Violation TypeMaximum Penalty
CTDPA violation a court finds wilful (per violation)$5,000
Data breach notification failure under CUTPA, where wilful (per violation)$5,000
Violating a CUTPA restraining order or injunction (per violation)$25,000
Pattern of violationsInjunctive relief, restitution, disgorgement

The wilfulness condition matters. Under Conn. Gen. Stat. 42-110o(b), the $5,000 per-violation penalty is available only where the court finds the person wilfully used a practice prohibited by section 42-110b, and a person acts wilfully when they knew or should have known the conduct was a violation. A violation that is not found wilful carries no $5,000 per-violation penalty. In addition to monetary penalties, the Attorney General can seek injunctive relief to stop ongoing violations, restitution for affected consumers, and disgorgement of profits.

Cure Period Changes

When the CTDPA first took effect, controllers received a 60-day right to cure violations after receiving notice from the Attorney General. This mandatory cure period expired on December 31, 2024. Since January 1, 2025, the Attorney General may proceed directly to enforcement without offering a cure period, though the AG retains discretion to offer one.

When deciding whether to offer a cure opportunity, the Attorney General may consider:

  • The number of violations
  • The size and complexity of the controller or processor
  • The nature and extent of processing activities
  • The substantial likelihood of injury to the public
  • Safety of persons or property
  • Whether the violation was caused by human or technical error

First Enforcement Action: TicketNetwork Settlement

In July 2025, Attorney General Tong announced the first monetary settlement under the CTDPA. TicketNetwork LLC agreed to pay $85,000 to resolve allegations that:

  • Its privacy notice was largely unreadable and missing key information about consumer rights
  • Consumer rights request mechanisms were misconfigured or inoperable
  • The company repeatedly represented it had fixed deficiencies when it had not
  • The company failed to respond timely to follow-up correspondence from the Attorney General

The Attorney General had first sent a cure notice to TicketNetwork on November 9, 2023, four months after the CTDPA took effect. TicketNetwork was the only company that failed to comply with an initial cure notice during the cure period.

Joint GPC Enforcement Sweep (2025)

In September 2025, the Connecticut, California, and Colorado attorneys general, along with the California Privacy Protection Agency, announced a coordinated investigative sweep targeting businesses that were not processing opt-out requests submitted via Global Privacy Control. The coalition sent warning letters to companies identified as failing to honor GPC signals as required by law.

2026 Annual Enforcement Report

Attorney General Tong released the third annual CTDPA enforcement report on February 5, 2026. Key findings include:

  • Dozens of notices of violation and warning letters issued throughout 2025
  • Multiple data breach settlements finalized
  • Multiple active investigations into children's and teens' safety online, including messaging platforms, gaming, and AI chatbots
  • Investigation priorities: connected vehicles and geolocation tracking, social media targeting youth, data brokers, and AI products posing risks to minors

The report recommended legislative action to narrow "publicly available information" definitions, establish standalone genetic privacy protections, enact chatbot safeguards, and enhance consumer opt-out provisions.

2025 Amendments: Public Act 25-113 (SB 1295)

Connecticut enacted the 2025 amendments on June 24, 2025, as Public Act 25-113. Most provisions take effect July 1, 2026, with impact assessment requirements applying to processing activities created on or after August 1, 2026. Key changes include:

Lowered Applicability Threshold

The consumer processing threshold drops from 100,000 to 35,000 Connecticut consumers, significantly expanding the number of businesses subject to the law.

Expanded Sensitive Data Categories

New categories: disability or treatment status, transgender or nonbinary status, neural data, financial account numbers with access credentials, and government-issued identification numbers.

Stronger Minor Protections

Categorical prohibition on processing minors' data for targeted advertising or sale, regardless of consent. Anti-addictive design requirements for online services used by minors.

GLBA Exemption Restructured

Entity-level GLBA exemption replaced with targeted data-level and entity-specific exemptions.

Enhanced Consumer Rights

Right to access now includes derived inferences. Right to receive lists of third parties who purchased consumer data. Profiling opt-out expanded to cover any automated decision-making, not only fully automated decisions.

AI and LLM Transparency

Controllers must disclose whether personal data is collected for training large language models.

Impact Assessment Requirements

New impact assessments required for profiling that produces legal or similarly significant effects, separate from the existing data protection assessments.

2026 Amendments: Public Act 26-64 (SB 4)

A closed brass padlock on the perforated door of a black server cabinet in a quiet equipment room

Connecticut enacted its third round of CTDPA changes when Governor Lamont signed Substitute Senate Bill 4 as Public Act 26-64 on May 27, 2026. Every section of the act carried an October 1, 2026 effective date, but two did not reach it in their original form. Public Act 26-100, Section 66 repealed Sections 11 and 16 effective from passage on June 2, 2026. The same act re-enacted the facial recognition conditions at its Section 45, effective October 1, 2026, so those requirements are in force; the surveillance pricing provisions moved instead to Public Act 26-130, Section 11, effective July 1, 2027. Public Act 26-100 also rewrote several of the data broker sections. Public Act 26-64 does not change the CTDPA's applicability thresholds (Conn. Gen. Stat. 42-516 is unchanged); it adds new substantive protections plus a separate data broker program. Key provisions include:

Data Broker Registry

Businesses that sell or license brokered personal data about consumers with whom they have no direct relationship must register with the Department of Consumer Protection to do so in Connecticut on or after January 1, 2027, paying a $2,500 initial fee and a $2,500 annual renewal. The registry is publicly accessible.

Single-Deletion Mechanism

The act directs the Department of Consumer Protection to establish, by July 1, 2028, an accessible mechanism that lets a consumer submit one verified request to delete their personal data held by all registered data brokers at once, rather than contacting each broker separately.

Geolocation Sale Restrictions

The act prohibits any controller or third party from selling a consumer's precise geolocation data, defined as data that pinpoints an individual's location within a radius of 1,750 feet (Conn. Gen. Stat. 42-520(a)(3) and 42-521(a)(2)). The ban applies to selling that data outright and does not reach the content of communications or data generated by advanced utility metering infrastructure.

Facial Recognition Technology: In Force Since October 1, 2026

The act defines facial recognition technology (Conn. Gen. Stat. 42-515(17)) as any technology that analyzes facial features in still images or video to uniquely and personally identify a specific individual. That definition was added by Section 12 of Public Act 26-64 and stands.

The operative duties reached the statute through a different section than the one that first wrote them, which matters if you are checking a citation. Section 16 of Public Act 26-64 would have amended Conn. Gen. Stat. 42-524(a), but Public Act 26-100, Section 66, approved June 2, 2026, repealed Sections 11 and 16 of Public Act 26-64 effective from passage. The same act re-enacted the identical amendment at its Section 45, effective October 1, 2026, and added one exception. The requirements are therefore in force, and the operative provision is Conn. Gen. Stat. 42-524(a)(2) as amended by Public Act 26-100, Section 45.

A controller or consumer health data controller that uses facial recognition technology on its premises to prevent, detect, protect against or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities or any illegal activity, to preserve the integrity or security of systems, or to investigate, report or prosecute those responsible, must use that technology exclusively to match still images or video against a database it maintains exclusively.

It must also post clearly legible signage at each entrance to the premises where the technology is in use, other than an entrance to an area where access is restricted to authorized employees. The signage must alert consumers entering the premises that facial recognition technology is in use, and must carry a conspicuous hyperlink or quick response code directing consumers to the controller's facial recognition technology policy. That policy must include contact information for the office of the Attorney General, and may disclose the controller's policies on interactions between its loss prevention officers and consumers.

Section 45 adds a carve-out that Section 16 did not contain: a controller is not required to satisfy these conditions with respect to a consumer whose consent to the use of facial recognition technology it has obtained in the course of a commercial transaction.

Surveillance Pricing: Delayed to July 1, 2027

Section 11 of Public Act 26-64 would have banned surveillance pricing and required a price label from October 1, 2026. It was repealed by Public Act 26-100, Section 66 before that date, and the replacement enacted as Public Act 26-100, Section 44 was itself repealed by Public Act 26-130, Section 19. The surviving provision is Public Act 26-130, Section 11, which carries an effective date of July 1, 2027. No surveillance pricing ban and no pricing label duty is in force in Connecticut today.

The surviving section also drops the in-person limitation its predecessor carried, so it reaches retail sales generally, and it shortens the required label to the words THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA. When it takes effect, a violation is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act, enforced solely by the Attorney General, and the section expressly creates no private right of action.

Broadened Definition of Publicly Available Information

The act narrows what counts as publicly available information (Conn. Gen. Stat. 42-515(35)), excluding biometric data collected without the consumer's knowledge, genetic data the consumer has not made public, nonconsensual intimate or synthetic intimate images, and personal data created by combining other data with publicly available information. Data outside that category receives the CTDPA's full protections.

Expanded Deletion Right

Consumers gain the right to delete publicly available information that has been collated into a consumer profile made available to others, along with any inference generated from it (Conn. Gen. Stat. 42-518(a)(3)).

Direct-to-Consumer Genetic Testing

Separately from the CTDPA, the act gives consumers a property right and exclusive control over biological samples and DNA test results held by direct-to-consumer genetic testing companies, and bars disclosure of results except with the consumer's express consent or under a court order, warrant, or subpoena.

Federal Overlay: Laws That Apply in Connecticut Regardless of the CTDPA

Several federal laws protect Connecticut residents' data independently of the CTDPA.

TAKE IT DOWN Act (Pub. L. 119-12, May 19, 2025)

The TAKE IT DOWN Act, signed by President Trump on May 19, 2025, makes it a federal crime to knowingly publish or threaten to publish nonconsensual intimate images, including AI-generated images. Platform removal obligations (48-hour takedown requirement) took effect on May 19, 2026, with FTC enforcement authority and potential civil penalties of $53,088 per violation.

HIPAA

The Health Insurance Portability and Accountability Act governs protected health information held by covered entities (hospitals, doctors, insurers) and their business associates. HIPAA-regulated entities are exempt from the CTDPA, but their HIPAA obligations remain in force.

GLBA

The Gramm-Leach-Bliley Act imposes privacy and security obligations on financial institutions. The CTDPA excludes GLBA-regulated data (at the data level under the 2025 amendments), but the GLBA itself continues to apply.

FCRA

The Fair Credit Reporting Act governs consumer reporting agencies and the use of consumer credit information. FCRA-regulated data is excluded from the CTDPA.

COPPA

The Children's Online Privacy Protection Act governs online collection of personal data from children under 13. COPPA consent requirements apply in addition to the CTDPA's sensitive data protections for children.

FTC Act Section 5

The Federal Trade Commission has broad authority to pursue unfair or deceptive data practices under Section 5 of the FTC Act regardless of whether a state privacy law applies. Failure to honor stated privacy policies, misleading data security claims, and deceptive consent practices can all trigger FTC enforcement.

APRA Status

The American Privacy Rights Act (APRA), a federal comprehensive privacy bill, passed committee in 2024 but did not become law. APRA 2.0 was introduced in 2025. As of May 2026, no federal comprehensive privacy law has been enacted. Connecticut residents remain covered by the CTDPA and federal sectoral laws.

How Connecticut Residents Exercise Their Rights

To submit a privacy rights request to a covered business under the CTDPA, Connecticut residents should:

  1. Locate the business's privacy notice, which must be clearly accessible and describe how to submit a rights request.
  2. Submit a request through the mechanism the business provides, typically an online form, email address, or toll-free phone number.
  3. Expect a response within 45 days. The business may extend by another 45 days with notice.
  4. If the request is denied, submit an appeal within the time frame stated in the business's denial notice. The business must respond to the appeal within 60 days.
  5. If the appeal is denied, the business must provide information on how to file a complaint with the Connecticut Attorney General's Privacy and Data Security Department.

To opt out of data sales and targeted advertising using Global Privacy Control, consumers can enable GPC in a compatible browser or browser extension such as Privacy Badger, Brave, or DuckDuckGo Privacy Browser. As of January 1, 2025, businesses covered by the CTDPA must treat that signal as a valid opt-out request.

To report a data breach that affected your personal information, contact the Connecticut Attorney General's Office or use the online breach report form.

Before Connecticut's One-Request Broker Deletion Arrives

You can use your CTDPA rights yourself: send deletion and opt-out requests to businesses directly, and turn on Global Privacy Control, which covered businesses must treat as a valid opt-out. The state's mechanism for deleting your data from every registered data broker with a single request is not due until July 1, 2028, so until then broker listings are handled one company at a time. Aura removes your personal information from data broker and people-search sites, an option for anyone who does not want to contact each broker separately.

See Aura's Broker Removal

Affiliate disclosure: if you sign up through this link we may earn a commission, at no extra cost to you. Learn more

How Connecticut Compares to Other State Privacy Laws

Connecticut's CTDPA stands out among state privacy laws for several reasons:

  • No revenue threshold: Unlike California (CCPA) and Utah (UCPA), there is no revenue requirement for the law to apply
  • Universal opt-out signals: Connecticut was among the first states to mandate that businesses honor Global Privacy Control and similar mechanisms
  • Strong minor protections: The categorical ban on processing minors' data for advertising or sale, regardless of consent, goes further than most state laws
  • Proactive enforcement: The AG's office issued dozens of notices and completed the first monetary settlement within two years of the law's effective date, and participated in multi-state GPC enforcement
  • Frequent amendments: Connecticut has amended the CTDPA three times in four years, most recently by Public Act 26-64 (SB 4), effective October 1, 2026
  • Neural data protections: Connecticut is among a small number of states to include neural data in its sensitive data definition
  • Anti-dark pattern provisions: The CTDPA explicitly prohibits the use of dark patterns to obtain consumer consent

Compliance Steps for Businesses

Businesses subject to the CTDPA should take the following steps:

  1. Determine applicability: Check whether your business meets the 35,000-consumer threshold, processes sensitive data at any volume, or offers personal data for sale in trade or commerce at any volume. The former 100,000-consumer and 25,000-consumer-plus-25%-revenue thresholds applied only through June 30, 2026.
  2. Update privacy notices: Ensure your privacy notice describes all required categories, discloses purposes of processing, and includes opt-out mechanisms.
  3. Honor GPC signals: Implement technical infrastructure to detect and process Global Privacy Control signals as opt-out requests for Connecticut residents.
  4. Build rights-request workflows: Establish processes to receive, verify, and respond to access, correction, deletion, portability, opt-out, and appeal requests within 45 days.
  5. Conduct data protection assessments: Document assessments for targeted advertising, data sales, sensitive data processing, and profiling activities.
  6. Comply with the July 1, 2026 changes: If you process sensitive data or sell personal data in any volume, you are covered regardless of consumer count. Update contracts with processors, extend impact assessment programs to profiling activities, and add LLM training disclosures.
  7. Comply with Insurance Data Security Law: If your business holds a Connecticut insurance license, maintain a written information security program and comply with the three-business-day notification requirement for cybersecurity events.

More Connecticut Laws

Explore additional Connecticut legal topics and data privacy resources:

In-depth guides

More Connecticut Laws

Updates

Corrected the Public Act 26-64 summary. The surveillance pricing section (Section 11) was repealed by Public Act 26-100, Section 66 effective from passage on June 2, 2026 and never took effect; the surviving provision is Public Act 26-130, Section 11, effective July 1, 2027, so no surveillance pricing duty is in force today. Section 16, on facial recognition, was repealed by the same section but re-enacted by Public Act 26-100, Section 45 effective October 1, 2026, so those duties are in force. The page now cites the operative provision, Conn. Gen. Stat. 42-524(a)(2), states the purpose limitation and the employee-entrance carve-out, and adds the Section 45 consent exception it had omitted.

Corrected the third-party disclosure right to reflect that the statutory fallback is a list of all third parties rather than categories, and clarified that the $5,000 CTDPA penalty is a Connecticut Unfair Trade Practices Act penalty available only for violations a court finds wilful.

Updated this page to reflect that Connecticut's lowered CTDPA thresholds (35,000 consumers, or any volume for sensitive-data processing or data sales) took effect July 1, 2026 and are now current law; corrected the Insurance Data Security Law's small-business exemption to Connecticut's actual employee-count-only test; fixed the date of the multistate Global Privacy Control enforcement sweep to September 2025; expanded the data breach notification law's personal-information list; and added the CTDPA's right to obtain a list of third-party data purchasers.

Independently fact-checked against the cited primary sources; governing law re-checked for recent changes

Governing law re-checked for recent changes

Reviewed and approved by an editor

Sources and References

  1. Connecticut Data Privacy Act Overview(portal.ct.gov).gov
  2. CTDPA Full Text - Public Act 22-15(cga.ct.gov).gov
  3. Chapter 743jj - Data Privacy and Security Statutes(cga.ct.gov).gov
  4. 2025 Amendments - Public Act 25-113 (SB 1295)(cga.ct.gov).gov
  5. 2023 Amendments - Public Act 23-56(cga.ct.gov).gov
  6. CT AG - Reporting a Data Breach(portal.ct.gov).gov
  7. CT AG - Privacy and Data Security Department(portal.ct.gov).gov
  8. 2026 CTDPA Enforcement Report Press Release(portal.ct.gov).gov
  9. 2024 CTDPA Annual Report to General Assembly(portal.ct.gov).gov
  10. TicketNetwork Settlement Announcement(portal.ct.gov).gov
  11. CT Breach Notification Statute - Conn. Gen. Stat. 36a-701b(cga.ct.gov).gov
  12. Report a Breach Online Form(portal.ct.gov).gov
  13. Connecticut Public Act 26-64 (Substitute SB 4, 2026), full text(cga.ct.gov).gov
  14. Connecticut SB 4 (2026) Bill Status and Legislative History(cga.ct.gov).gov
  15. Connecticut Unfair Trade Practices Act, Conn. Gen. Stat. 42-110o (civil penalties)(cga.ct.gov)
  16. Chapter 743jj, Connecticut Data Privacy Act current statutes (Conn. Gen. Stat. 42-515 to 42-526)(cga.ct.gov)
  17. Connecticut Public Act No. 26-100 (Substitute House Bill No. 5222), Section 66 (repealing Sections 11 and 16 of Public Act 26-64, effective from passage) and Section 45 (re-enacting the facial recognition amendment to Conn. Gen. Stat. 42-524(a), effective October 1, 2026, with a consent exception), approved June 2, 2026(www.cga.ct.gov).gov
  18. Connecticut Public Act No. 26-130 (Substitute House Bill No. 5563), Sections 11 and 19 (surviving surveillance pricing provision, effective July 1, 2027; repealing Public Act 26-100, Section 44)(www.cga.ct.gov).gov
Share: