--- title: "Connecticut privacy law (CTDPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights" source: "https://www.cga.ct.gov/current/pub/chap_743jj.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring) # Connecticut privacy law (CTDPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may access their data (including inferences and whether it is used for significant-effect profiling), correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling in furtherance of any automated decision with legal or similarly significant effects. Since 1 July 2026 they may also contest such profiling decisions and obtain a list of third parties to which their data was sold; from 1 October 2026 deletion extends to compiled publicly available information. Controllers respond within 45 days, extendable by 45 days, and decide appeals within 60 days. ## Key points 1. Access now includes inferences and whether the data is used for significant-effect profiling; some identifiers (for example SSN, account numbers, biometrics) must not be disclosed, only their collection confirmed. Section: [Conn. Gen. Stat. § 42-518(a)(1), (e)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 2. Correction, deletion and portability. Section: [Conn. Gen. Stat. § 42-518(a)(2) to (4)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 3. Opt-out of targeted advertising, sale, and profiling for any automated decision with legal or similarly significant effects (no longer limited to 'solely' automated). Section: [Conn. Gen. Stat. § 42-518(a)(5)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 4. Right to question a profiling decision, learn the reason, review the data, and in housing cases correct data and have the decision reevaluated. Section: [Conn. Gen. Stat. § 42-518(a)(6)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 5. Right to a list of third parties the controller sold the consumer's data to. Section: [Conn. Gen. Stat. § 42-518(a)(7)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 6. From 1 October 2026, deletion covers publicly available information compiled into profiles or offered for sale, and inferences from it. Section: [Conn. Gen. Stat. § 42-518(a)(3) (P.A. 26-64, § 13)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 7. 45 days to respond, one 45-day extension; free once per 12 months; opt-out requests need no authentication. Section: [Conn. Gen. Stat. § 42-518(c)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 8. Appeal decided within 60 days, with a route to the Attorney General if denied. Section: [Conn. Gen. Stat. § 42-518(d)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) ## Sources - [Public Act 25-113 (Substitute SB 1295), approved 24 June 2025](https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF) - [Public Act 26-64 (Substitute SB 4), approved 27 May 2026](https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Connecticut statute](https://www.cga.ct.gov/current/pub/chap_743jj.htm) Reference material, not legal advice. ## Other topics for Connecticut - [Applicability](https://dposchool.com/state-privacy-laws/state/connecticut/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/connecticut/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/connecticut/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents