DPO SchoolDPO School

Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)

Connecticut privacy law (CTDPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is reasonably necessary and proportionate, get consent for material new purposes, keep reasonable security and give a detailed privacy notice. Since 1 July 2026 the notice must also state whether data is used to train large language models and the date of last update, and be posted through a 'privacy' link. Data protection assessments are required for heightened-risk processing, and impact assessments for significant-effect profiling begun on or after 1 August 2026. Opt-out preference signals must be honored since 1 January 2025.

Key points

  1. Collection limited to what is reasonably necessary and proportionate; consent needed for a material new purpose.

    Section: Conn. Gen. Stat. § 42-520(a)(1)(A) to (B)

  2. Notice contents include data categories, purposes, rights and appeals, categories of data sold and buyers, targeted advertising disclosures, a contact address, an LLM training statement and the last-update month and year.

    Section: Conn. Gen. Stat. § 42-520(b)(1)

  3. Notice posted via a link containing 'privacy', in each language of business, and accessible to people with disabilities; notice of retroactive material changes.

    Section: Conn. Gen. Stat. § 42-520(b)(2) to (3)

  4. Opt-out link plus opt-out preference signals (required since 1 January 2025).

    Section: Conn. Gen. Stat. § 42-520(c)(1)(A)

  5. Data protection assessments for targeted advertising, sale, risky profiling and sensitive data.

    Section: Conn. Gen. Stat. § 42-522(a) to (b)

  6. Impact assessments for profiling used for significant-effect decisions, for activities from 1 August 2026.

    Section: Conn. Gen. Stat. § 42-522(c), (g)(2)

  7. Minors: data protection and impact assessments and a rebuttable presumption of reasonable care if followed.

    Section: Conn. Gen. Stat. §§ 42-529a(a), 42-529b

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Connecticut statute

Reference material, not legal advice.