Consumer Rights

What it requires

Grants consumers rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of automated decisions that produce legal or similarly significant effects. The companion duty to honor opt-out preference signals (such as GPC), in force since January 1, 2025, sits in § 42-520, not here (subsection (c)(1)(A)(ii) since July 1, 2026). Since July 1, 2026, Public Act No. 25-113 has extended the profiling opt-out from 'solely automated' decisions to any automated decision that produces a legal or similarly significant effect. Where feasible, a consumer whose personal data were profiled for such a decision may also question the result, be told why the profiling led to the decision, and review the personal data used; for a housing decision, the consumer may also correct incorrect personal data and have the decision reevaluated. PA 25-113 also added rights to access inferences drawn about the consumer and to obtain a list of the third parties to which the controller has sold personal data. From October 1, 2026, Public Act No. 26-64 (S.B. 4) extends the right to delete to publicly available information that is (i) collated and combined into a consumer profile made available to users of a publicly accessible website, for compensation or free of charge, or (ii) made available for sale, along with any inference generated from that information. On the linked 2026 Supplement page, the July 1, 2026 version follows the superseded text in the section's entry; the PA 26-64 changes in force since October 1, 2026 are not yet printed there.

Statute text

A consumer shall have the right to: (1) Confirm whether or not a controller is processing the consumer's personal data and access such personal data, including, but not limited to, any inferences about the consumer derived from such personal data [...] (4) obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format [...] (5) opt out of the processing of the personal data for purposes of (A) targeted advertising, (B) the sale of personal data, [...] or (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer; (6) if the consumer's personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, (A) question the result of such profiling, (B) be informed of the reason that such profiling resulted in such decision, (C) review the consumer's personal data that were processed for the purposes of such profiling [...]

Connecticut Data Privacy Act, § 42-518Read the full section from Connecticut Office of the Attorney General