Definitions

What it requires

Establishes key definitions under the Connecticut Data Privacy Act, including controller, processor, consumer, personal data, and consent, as amended by Public Act No. 25-113. Effective July 1, 2026, PA 25-113 broadens the definition of 'sensitive data' to add government-issued identifiers (such as driver's license, passport, and Social Security numbers), financial account information, and neural data. Effective October 1, 2026, Public Act No. 26-64 (S.B. 4) rewrites the 'publicly available information' definition in both directions. It widens the base: information made available through government records or to the general public from widely distributed media no longer has to have been made available lawfully, and a processor's or an affiliate's reasonable basis to believe the consumer lawfully made the information public now counts alongside a controller's. It also adds exclusions for personal data created by combining personal data with publicly available information, genetic data the consumer has not made public, information posted where the consumer kept a reasonable expectation of privacy, obscene visual depictions, and intimate or synthetically created intimate images known to be nonconsensual, and the biometric-data exclusion now turns on collection without the consumer's knowledge rather than without consent. PA 26-64 also adds a definition of 'facial recognition technology'. On the linked 2026 Supplement page, the July 1, 2026 version follows the superseded text in the section's entry; the PA 26-64 changes in force since October 1, 2026 are not yet printed there.

Statute text

"Controller" means a person who, alone or jointly with others, determines the purpose and means of processing personal data. [...] "Processor" means a person who processes personal data on behalf of a controller.

Connecticut Data Privacy Act, § 42-515Read the full section from Connecticut Office of the Attorney General