Comprehensive state privacy law
Connecticut privacy law
Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Conn. Gen. Stat. §§ 42-515 to 42-526 (minors: §§ 42-529 to 42-529e)
- Official text
- https://www.cga.ct.gov/current/pub/chap_743jj.htm
- Enacted
- May 10, 2022. Public Act 22-15 (SB 6, 2022)
- In force
- July 1, 2023
- Effective dates
- July 1, 2023: main provisions (P.A. 22-15)
- October 1, 2023: consumer health data rules (§ 42-526) and related changes (P.A. 23-56, as delayed by P.A. 23-204)
- January 1, 2025: controllers must honor opt-out preference signals; mandatory cure period ended 31 December 2024
- July 1, 2026: P.A. 25-113 overhaul: new thresholds, GLBA change, new rights, notice contents, impact assessments, minors under 18
- August 1, 2026: impact assessments apply to profiling activities created or generated on or after this date (§ 42-522(g)(2))
- October 1, 2026: P.A. 26-64 (as amended by P.A. 26-100): data broker registration, ban on selling precise geolocation data, wider deletion right, facial recognition notice rules
- July 1, 2028: Department of Consumer Protection must establish the accessible deletion mechanism for data brokers (P.A. 26-64, § 5)
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. No private right of action under the Act or any other law; violations are unfair trade practices enforced solely by the Attorney General, and the CUTPA private action (§ 42-110g) does not apply (§ 42-525(d) to (e)).
- Cure period
- 60 days. Ended December 31, 2024. From 1 July 2023 to 31 December 2024 the Attorney General had to give a notice and 60 days to cure where a cure was possible. Since 1 January 2025 a cure opportunity is discretionary, weighing factors such as the number of violations, size of the business, likelihood of injury, human or technical error and sensitivity of the data. (§ 42-525(b) to (c))
- Rulemaking
- No. The CTDPA gives the Attorney General no general rulemaking power. P.A. 26-64 gives the Department of Consumer Protection duties for data broker registration and the deletion mechanism.
Amendments
- Public Act 23-56 (with P.A. 23-204) (in force October 1, 2023). Added consumer health data, geofencing limits and consumer health data controllers (§ 42-526); widened sensitive data.
- Public Act 23-204 (in force June 12, 2023). Restructured the cure provisions in § 42-525(b) to (c), including consumer health data controllers.
- Public Act 25-113 (SB 1295, 2025), §§ 5 to 18 (in force July 1, 2026). Thresholds cut to 35,000 consumers, or any controller of sensitive data, or any seller of personal data; entity-level GLBA exemption replaced by data-level exemption plus named bank, credit union, insurer and securities entities; new rights (inferences in access, contest profiling decisions, list of third parties data was sold to); profiling opt-out widened to any automated decision; 'reasonably necessary and proportionate' minimisation; consent to sell sensitive data; no targeted ads or sale for minors under 18; new notice contents including LLM training statement; impact assessments for significant-effect profiling (from 1 August 2026); neural data, financial account data and government ID numbers added to sensitive data. Signed 24 June 2025.
- Public Act 26-64 (SB 4, 2026), §§ 1 to 10 and 12 to 15 (in force October 1, 2026). Data broker registration with the Department of Consumer Protection; accessible deletion mechanism to be built by 1 July 2028 (registered brokers must access it from 1 October 2028 and every 45 days); no controller or third party may sell precise geolocation data; deletion right extends to publicly available information compiled into profiles or offered for sale and inferences from it; narrower 'publicly available information'; facial recognition technology defined. Signed 27 May 2026.
- Public Act 26-100 (HB 5222, 2026), §§ 39 to 45 and 66 (in force October 1, 2026). Amended the P.A. 26-64 data broker sections (verification and timing of the deletion mechanism, removal of the 'data service provider' concept), replaced the P.A. 26-64 change to § 42-524(a) on facial recognition (premises security use, signage and policy), and repealed P.A. 26-64 §§ 11 and 16. A separate surveillance pricing section (§ 44) takes effect 1 February 2027. Signed 2 June 2026.
Topics
- ApplicabilitySince 1 July 2026 the Act applies to persons doing business in Connecticut or targeting its residents that, in the preceding year, controlled or processed personal data of at least 35,000 consumers (payment-only data excluded), and also to persons that control or process consumers' sensitive data or offer personal data for sale. The old 100,000 and 25,000-plus-25-percent tests no longer apply. Nonprofits, higher education, public bodies, HIPAA entities and political committees are exempt; the GLBA exemption is now data-level, with separate entity exemptions for regulated banks, credit unions, insurers and securities firms. Employee, applicant and business-contact data is excluded.
- Consumer rightsConsumers may access their data (including inferences and whether it is used for significant-effect profiling), correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling in furtherance of any automated decision with legal or similarly significant effects. Since 1 July 2026 they may also contest such profiling decisions and obtain a list of third parties to which their data was sold; from 1 October 2026 deletion extends to compiled publicly available information. Controllers respond within 45 days, extendable by 45 days, and decide appeals within 60 days.
- Sensitive dataSensitive data includes racial or ethnic origin, religious beliefs, health conditions and disabilities, sex life, sexual orientation, nonbinary or transgender status, citizenship or immigration status, consumer health data, genetic or biometric data, data of a known child, crime-victim status, precise geolocation, and (from 1 July 2026) neural data, financial account credentials and government ID numbers. Processing requires consent and must be reasonably necessary, and selling sensitive data requires consent. Controllers may not process minors' (under 18) data for targeted advertising or sale. From 1 October 2026 no one may sell precise geolocation data.
- Controller dutiesControllers must limit collection to what is reasonably necessary and proportionate, get consent for material new purposes, keep reasonable security and give a detailed privacy notice. Since 1 July 2026 the notice must also state whether data is used to train large language models and the date of last update, and be posted through a 'privacy' link. Data protection assessments are required for heightened-risk processing, and impact assessments for significant-effect profiling begun on or after 1 August 2026. Opt-out preference signals must be honored since 1 January 2025.
- ProcessorsA processor must follow the controller's instructions and help with consumer requests, security, breach notice, and data protection and impact assessments. A binding contract must set out instructions, nature and purpose, data types, duration and rights and obligations, and require confidentiality, deletion or return, compliance information, subcontractor flow-down after a chance to object, and assessments. From 1 October 2026 the assistance duties sit in § 42-521(a)(1) and third parties may not sell precise geolocation data.
- EnforcementOnly the Attorney General enforces the Act; violations are unfair trade practices under CUTPA. The mandatory 60-day cure period ended on 31 December 2024, and any cure opportunity is now at the Attorney General's discretion. CUTPA allows civil penalties of up to $5,000 per wilful violation. There is no private right of action.
Sources
- General Statutes of Connecticut, Chapter 743jj (2026 Supplement, revised to 1 January 2026; does not yet show P.A. 25-113 text in force 1 July 2026)
- Public Act 25-113 (Substitute SB 1295), approved 24 June 2025
- Bill status, SB 1295 (2025)
- Public Act 26-64 (Substitute SB 4), approved 27 May 2026
- Bill status, SB 4 (2026)
- Public Act 26-100 (HB 5222), approved 2 June 2026
- General Statutes of Connecticut, Chapter 735a (CUTPA), § 42-110o civil penalties
- Bill status, SB 6 (2022)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Connecticut statute
Reference material, not legal advice.