Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)
Connecticut privacy law (CTDPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Only the Attorney General enforces the Act; violations are unfair trade practices under CUTPA. The mandatory 60-day cure period ended on 31 December 2024, and any cure opportunity is now at the Attorney General's discretion. CUTPA allows civil penalties of up to $5,000 per wilful violation. There is no private right of action.
Key points
Exclusive Attorney General enforcement.
Section: Conn. Gen. Stat. § 42-525(a)
Mandatory notice and 60-day cure from 1 July 2023 to 31 December 2024.
Section: Conn. Gen. Stat. § 42-525(b)
From 1 January 2025, discretionary cure based on listed factors.
Section: Conn. Gen. Stat. § 42-525(c)
Violations are unfair trade practices enforced solely by the Attorney General.
Section: Conn. Gen. Stat. § 42-525(e)
CUTPA civil penalty up to $5,000 per wilful violation.
Section: Conn. Gen. Stat. § 42-110o(b)
No private right of action.
Section: Conn. Gen. Stat. § 42-525(d)
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Connecticut statute
Reference material, not legal advice.