DPO SchoolDPO School

Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)

Connecticut privacy law (CTDPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data includes racial or ethnic origin, religious beliefs, health conditions and disabilities, sex life, sexual orientation, nonbinary or transgender status, citizenship or immigration status, consumer health data, genetic or biometric data, data of a known child, crime-victim status, precise geolocation, and (from 1 July 2026) neural data, financial account credentials and government ID numbers. Processing requires consent and must be reasonably necessary, and selling sensitive data requires consent. Controllers may not process minors' (under 18) data for targeted advertising or sale. From 1 October 2026 no one may sell precise geolocation data.

Key points

  1. Sensitive data definition widened from 1 July 2026 (neural data, financial account credentials, government ID numbers, disability, nonbinary or transgender status).

    Section: Conn. Gen. Stat. § 42-515(39) (as amended by P.A. 25-113)

  2. Processing sensitive data requires consent and must be reasonably necessary; known child data must follow COPPA.

    Section: Conn. Gen. Stat. § 42-520(a)(1)(D)

  3. No sale of sensitive data without consent.

    Section: Conn. Gen. Stat. § 42-520(a)(1)(H)

  4. No targeted advertising or sale where the controller knows or wilfully disregards that the consumer is 13 to 17 (was 13 to 15, with consent possible).

    Section: Conn. Gen. Stat. § 42-520(a)(1)(I)

  5. Controllers offering online services to known minors (under 18) may not process their data for targeted advertising or sale, and face limits on geolocation and profiling plus a duty of reasonable care.

    Section: Conn. Gen. Stat. §§ 42-529(1), 42-529a

  6. From 1 October 2026 controllers and third parties may not sell precise geolocation data.

    Section: Conn. Gen. Stat. §§ 42-520(a)(3), 42-521(a)(2) (P.A. 26-64, §§ 14 to 15)

  7. Consumer health data: no sale without consent and geofencing limits near health facilities.

    Section: Conn. Gen. Stat. § 42-526(a)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Connecticut statute

Reference material, not legal advice.