--- title: "Connecticut privacy law (CTDPA): applicability" canonical: "https://dposchool.com/state-privacy-laws/state/connecticut/applicability" source: "https://www.cga.ct.gov/current/pub/chap_743jj.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring) # Connecticut privacy law (CTDPA): applicability Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Since 1 July 2026 the Act applies to persons doing business in Connecticut or targeting its residents that, in the preceding year, controlled or processed personal data of at least 35,000 consumers (payment-only data excluded), and also to persons that control or process consumers' sensitive data or offer personal data for sale. The old 100,000 and 25,000-plus-25-percent tests no longer apply. Nonprofits, higher education, public bodies, HIPAA entities and political committees are exempt; the GLBA exemption is now data-level, with separate entity exemptions for regulated banks, credit unions, insurers and securities firms. Employee, applicant and business-contact data is excluded. ## Key points 1. Threshold: personal data of at least 35,000 consumers in the preceding calendar year, excluding data used only to complete a payment. Section: [Conn. Gen. Stat. § 42-516(1)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 2. Also covered: anyone who controls or processes consumers' sensitive data (payment-only data excluded), or offers consumers' personal data for sale. Section: [Conn. Gen. Stat. § 42-516(2) to (3)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 3. Before 1 July 2026 the thresholds were 100,000 consumers, or 25,000 consumers plus over 25 percent of gross revenue from sales. Section: [Conn. Gen. Stat. § 42-516 (2026 Supp.)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 4. Entity exemptions include public bodies, nonprofits, political committees, higher education, HIPAA covered entities and business associates, tribal government bodies and air carriers. Section: [Conn. Gen. Stat. § 42-517(a)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 5. Entity-level GLBA exemption removed; now named insurers, regulated banks and credit unions (and affiliates) engaged only in financial activities, and regulated broker-dealers and advisers are exempt. Section: [Conn. Gen. Stat. § 42-517(a)(10) to (12)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 6. Data subject to GLBA Title V and HIPAA limited data sets are exempt at data level. Section: [Conn. Gen. Stat. § 42-517(b)(17) to (18)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 7. Employment-context data is exempt, and 'consumer' excludes people acting in a commercial or employment role. Section: [Conn. Gen. Stat. §§ 42-515(8), 42-517(b)(15)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) ## Sources - [Public Act 25-113 (Substitute SB 1295), approved 24 June 2025](https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF) - [General Statutes of Connecticut, Chapter 743jj (2026 Supplement, revised to 1 January 2026; does not yet show P.A. 25-113 text in force 1 July 2026)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) [Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Connecticut statute](https://www.cga.ct.gov/current/pub/chap_743jj.htm) Reference material, not legal advice. ## Other topics for Connecticut - [Consumer rights](https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/connecticut/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut) / Applicability Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents