Connecticut Data Privacy Act
Connecticut privacy law granting consumer rights, requiring data protection assessments, and honoring opt-out signals, as amended by Public Acts No. 25-113 and No. 26-64.
Definitions
Establishes key definitions under the Connecticut Data Privacy Act, including controller, processor, consumer, personal data, and consent, as amended by Public Act No. 25-113. Effective July 1, 2026, PA 25-113 broadens the definition of 'sensitive data' to add government-issued identifiers (such as driver's license, passport, and Social Security numbers), financial account information, and neural data. Effective October 1, 2026, Public Act No. 26-64 (S.B. 4) further narrows the 'publicly available information' carve-out—excluding, among other things, public data that has been collated and combined into a consumer profile, and certain nonconsensual and synthetic intimate imagery.
Applicability
Applies to entities conducting business in Connecticut or targeting Connecticut residents that meet any one of three independent triggers. Under Public Act No. 25-113 (signed June 24, 2025, effective July 1, 2026), the prior 100,000/25,000-consumer thresholds are replaced by: (1) processing the personal data of at least 35,000 consumers; (2) controlling or processing consumers' sensitive data in any amount, with no consumer-count floor; or (3) offering consumers' personal data for sale in trade or commerce, also with no consumer-count floor. A business can therefore fall in scope solely by touching sensitive data or selling personal data, regardless of how many consumers' records it processes.
Consumer Rights
Grants consumers rights to access, correct, delete, and obtain a portable copy of personal data. Mandates honoring technical universal opt-out signals (like GPC) since January 1, 2025. Effective July 1, 2026, Public Act No. 25-113 adds profiling-related rights: consumers subject to solely automated decisions that produce legal or similarly significant effects may question the outcome, be informed of the reasoning, and review the personal data used to reach it. Effective October 1, 2026, Public Act No. 26-64 (S.B. 4) broadens the right to delete to reach publicly available information that has been collated and combined into a freely available or for-sale consumer profile, along with inferences drawn from it.
Duties of Controllers
Requires data minimization, security safeguards, detailed privacy notices, and explicit consent for processing sensitive data. Also includes requirements for revoking consent. Effective July 1, 2026, Public Act No. 25-113 adds two obligations: the privacy notice must disclose whether the controller uses or sells personal data to train large language models (LLMs), and controllers may not sell a consumer's sensitive data without first obtaining the consumer's consent. Effective October 1, 2026, Public Act No. 26-64 (S.B. 4) removes the 'material' qualifier from the purpose-limitation duty (so consent is required to process personal data for any new purpose incompatible with the disclosed purpose), prohibits controllers and third parties from selling a consumer's precise geolocation data, and requires controllers that use facial-recognition technology to post entrance signage and publish a facial-recognition policy.
Data Protection Assessments
Requires controllers to conduct and document data protection assessments for activities that present a heightened risk of harm, such as targeted advertising, sale of personal data, and profiling.
Enforcement and Penalties
Vests enforcement authority exclusively in the Connecticut Attorney General; there is no private right of action. Each violation of sections 42-515 to 42-525 constitutes an unfair trade practice under the Connecticut Unfair Trade Practices Act (CUTPA), carrying civil penalties of up to $5,000 per willful violation, in addition to injunctive relief and restitution. The mandatory 60-day right to cure sunset on December 31, 2024, so the Attorney General may now bring an enforcement action at its discretion without first affording an opportunity to cure.
Legal notice: This reference library is for informational purposes only and does not constitute legal advice. Excerpts are reproduced from official public sources and are current as of May 2026. Laws and regulations change: always verify against the authoritative source and consult a qualified attorney.