DPO SchoolDPO School

Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)

Connecticut privacy law (CTDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Since 1 July 2026 the Act applies to persons doing business in Connecticut or targeting its residents that, in the preceding year, controlled or processed personal data of at least 35,000 consumers (payment-only data excluded), and also to persons that control or process consumers' sensitive data or offer personal data for sale. The old 100,000 and 25,000-plus-25-percent tests no longer apply. Nonprofits, higher education, public bodies, HIPAA entities and political committees are exempt; the GLBA exemption is now data-level, with separate entity exemptions for regulated banks, credit unions, insurers and securities firms. Employee, applicant and business-contact data is excluded.

Key points

  1. Threshold: personal data of at least 35,000 consumers in the preceding calendar year, excluding data used only to complete a payment.

    Section: Conn. Gen. Stat. § 42-516(1)

  2. Also covered: anyone who controls or processes consumers' sensitive data (payment-only data excluded), or offers consumers' personal data for sale.

    Section: Conn. Gen. Stat. § 42-516(2) to (3)

  3. Before 1 July 2026 the thresholds were 100,000 consumers, or 25,000 consumers plus over 25 percent of gross revenue from sales.

    Section: Conn. Gen. Stat. § 42-516 (2026 Supp.)

  4. Entity exemptions include public bodies, nonprofits, political committees, higher education, HIPAA covered entities and business associates, tribal government bodies and air carriers.

    Section: Conn. Gen. Stat. § 42-517(a)

  5. Entity-level GLBA exemption removed; now named insurers, regulated banks and credit unions (and affiliates) engaged only in financial activities, and regulated broker-dealers and advisers are exempt.

    Section: Conn. Gen. Stat. § 42-517(a)(10) to (12)

  6. Data subject to GLBA Title V and HIPAA limited data sets are exempt at data level.

    Section: Conn. Gen. Stat. § 42-517(b)(17) to (18)

  7. Employment-context data is exempt, and 'consumer' excludes people acting in a commercial or employment role.

    Section: Conn. Gen. Stat. §§ 42-515(8), 42-517(b)(15)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Connecticut statute

Reference material, not legal advice.