Connecticut Data Privacy Act
Connecticut privacy law granting consumer rights, requiring data protection assessments, and honoring opt-out signals, as amended by Public Act No. 25-113.
Definitions
Establishes key definitions under the Connecticut Data Privacy Act, including controller, processor, consumer, personal data, and consent, as amended by Public Act No. 25-113. Effective July 1, 2026, PA 25-113 broadens the definition of 'sensitive data' to add government-issued identifiers (such as driver's license, passport, and Social Security numbers), financial account information, and neural data.
Applicability
Applies to entities conducting business in Connecticut or targeting Connecticut residents that meet any one of three independent triggers. Under Public Act No. 25-113 (signed June 24, 2025, effective July 1, 2026), the prior 100,000/25,000-consumer thresholds are replaced by: (1) processing the personal data of at least 35,000 consumers; (2) controlling or processing consumers' sensitive data in any amount, with no consumer-count floor; or (3) offering consumers' personal data for sale in trade or commerce, also with no consumer-count floor. A business can therefore fall in scope solely by touching sensitive data or selling personal data, regardless of how many consumers' records it processes.
Consumer Rights
Grants consumers rights to access, correct, delete, and obtain a portable copy of personal data. Mandates honoring technical universal opt-out signals (like GPC) since January 1, 2025. Effective July 1, 2026, Public Act No. 25-113 adds profiling-related rights: consumers subject to solely automated decisions that produce legal or similarly significant effects may question the outcome, be informed of the reasoning, and review the personal data used to reach it.
Duties of Controllers
Requires data minimization, security safeguards, detailed privacy notices, and explicit consent for processing sensitive data. Also includes requirements for revoking consent. Effective July 1, 2026, Public Act No. 25-113 adds two obligations: the privacy notice must disclose whether the controller uses or sells personal data to train large language models (LLMs), and controllers may not sell a consumer's sensitive data without first obtaining the consumer's consent.
Data Protection Assessments
Requires controllers to conduct and document data protection assessments for activities that present a heightened risk of harm, such as targeted advertising, sale of personal data, and profiling.
Enforcement and Penalties
Vests enforcement authority exclusively in the Connecticut Attorney General. Rejects a private right of action, and specifies investigative procedures and cure periods.
Legal notice: This reference library is for informational purposes only and does not constitute legal advice. Excerpts are reproduced from official public sources and are current as of June 2025. Laws and regulations change: always verify against the authoritative source and consult a qualified attorney.