DPO SchoolDPO School

Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)

Connecticut privacy law (CTDPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may access their data (including inferences and whether it is used for significant-effect profiling), correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling in furtherance of any automated decision with legal or similarly significant effects. Since 1 July 2026 they may also contest such profiling decisions and obtain a list of third parties to which their data was sold; from 1 October 2026 deletion extends to compiled publicly available information. Controllers respond within 45 days, extendable by 45 days, and decide appeals within 60 days.

Key points

  1. Access now includes inferences and whether the data is used for significant-effect profiling; some identifiers (for example SSN, account numbers, biometrics) must not be disclosed, only their collection confirmed.

    Section: Conn. Gen. Stat. § 42-518(a)(1), (e)

  2. Correction, deletion and portability.

    Section: Conn. Gen. Stat. § 42-518(a)(2) to (4)

  3. Opt-out of targeted advertising, sale, and profiling for any automated decision with legal or similarly significant effects (no longer limited to 'solely' automated).

    Section: Conn. Gen. Stat. § 42-518(a)(5)

  4. Right to question a profiling decision, learn the reason, review the data, and in housing cases correct data and have the decision reevaluated.

    Section: Conn. Gen. Stat. § 42-518(a)(6)

  5. Right to a list of third parties the controller sold the consumer's data to.

    Section: Conn. Gen. Stat. § 42-518(a)(7)

  6. From 1 October 2026, deletion covers publicly available information compiled into profiles or offered for sale, and inferences from it.

    Section: Conn. Gen. Stat. § 42-518(a)(3) (P.A. 26-64, § 13)

  7. 45 days to respond, one 45-day extension; free once per 12 months; opt-out requests need no authentication.

    Section: Conn. Gen. Stat. § 42-518(c)

  8. Appeal decided within 60 days, with a route to the Attorney General if denied.

    Section: Conn. Gen. Stat. § 42-518(d)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Connecticut statute

Reference material, not legal advice.