--- title: "Connecticut privacy law (CTDPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties" source: "https://www.cga.ct.gov/current/pub/chap_743jj.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring) # Connecticut privacy law (CTDPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must limit collection to what is reasonably necessary and proportionate, get consent for material new purposes, keep reasonable security and give a detailed privacy notice. Since 1 July 2026 the notice must also state whether data is used to train large language models and the date of last update, and be posted through a 'privacy' link. Data protection assessments are required for heightened-risk processing, and impact assessments for significant-effect profiling begun on or after 1 August 2026. Opt-out preference signals must be honored since 1 January 2025. ## Key points 1. Collection limited to what is reasonably necessary and proportionate; consent needed for a material new purpose. Section: [Conn. Gen. Stat. § 42-520(a)(1)(A) to (B)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 2. Notice contents include data categories, purposes, rights and appeals, categories of data sold and buyers, targeted advertising disclosures, a contact address, an LLM training statement and the last-update month and year. Section: [Conn. Gen. Stat. § 42-520(b)(1)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 3. Notice posted via a link containing 'privacy', in each language of business, and accessible to people with disabilities; notice of retroactive material changes. Section: [Conn. Gen. Stat. § 42-520(b)(2) to (3)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 4. Opt-out link plus opt-out preference signals (required since 1 January 2025). Section: [Conn. Gen. Stat. § 42-520(c)(1)(A)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 5. Data protection assessments for targeted advertising, sale, risky profiling and sensitive data. Section: [Conn. Gen. Stat. § 42-522(a) to (b)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 6. Impact assessments for profiling used for significant-effect decisions, for activities from 1 August 2026. Section: [Conn. Gen. Stat. § 42-522(c), (g)(2)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 7. Minors: data protection and impact assessments and a rebuttable presumption of reasonable care if followed. Section: [Conn. Gen. Stat. §§ 42-529a(a), 42-529b](https://www.cga.ct.gov/current/pub/chap_743jj.htm) ## Sources - [Public Act 25-113 (Substitute SB 1295), approved 24 June 2025](https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF) - [General Statutes of Connecticut, Chapter 743jj (2026 Supplement, revised to 1 January 2026; does not yet show P.A. 25-113 text in force 1 July 2026)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Connecticut statute](https://www.cga.ct.gov/current/pub/chap_743jj.htm) Reference material, not legal advice. ## Other topics for Connecticut - [Applicability](https://dposchool.com/state-privacy-laws/state/connecticut/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/connecticut/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/connecticut/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents