--- title: "Connecticut privacy law (CTDPA): sensitive data" canonical: "https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data" source: "https://www.cga.ct.gov/current/pub/chap_743jj.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring) # Connecticut privacy law (CTDPA): sensitive data Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Sensitive data includes racial or ethnic origin, religious beliefs, health conditions and disabilities, sex life, sexual orientation, nonbinary or transgender status, citizenship or immigration status, consumer health data, genetic or biometric data, data of a known child, crime-victim status, precise geolocation, and (from 1 July 2026) neural data, financial account credentials and government ID numbers. Processing requires consent and must be reasonably necessary, and selling sensitive data requires consent. Controllers may not process minors' (under 18) data for targeted advertising or sale. From 1 October 2026 no one may sell precise geolocation data. ## Key points 1. Sensitive data definition widened from 1 July 2026 (neural data, financial account credentials, government ID numbers, disability, nonbinary or transgender status). Section: [Conn. Gen. Stat. § 42-515(39) (as amended by P.A. 25-113)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 2. Processing sensitive data requires consent and must be reasonably necessary; known child data must follow COPPA. Section: [Conn. Gen. Stat. § 42-520(a)(1)(D)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 3. No sale of sensitive data without consent. Section: [Conn. Gen. Stat. § 42-520(a)(1)(H)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 4. No targeted advertising or sale where the controller knows or wilfully disregards that the consumer is 13 to 17 (was 13 to 15, with consent possible). Section: [Conn. Gen. Stat. § 42-520(a)(1)(I)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 5. Controllers offering online services to known minors (under 18) may not process their data for targeted advertising or sale, and face limits on geolocation and profiling plus a duty of reasonable care. Section: [Conn. Gen. Stat. §§ 42-529(1), 42-529a](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 6. From 1 October 2026 controllers and third parties may not sell precise geolocation data. Section: [Conn. Gen. Stat. §§ 42-520(a)(3), 42-521(a)(2) (P.A. 26-64, §§ 14 to 15)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) 7. Consumer health data: no sale without consent and geofencing limits near health facilities. Section: [Conn. Gen. Stat. § 42-526(a)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) ## Sources - [Public Act 25-113 (Substitute SB 1295), approved 24 June 2025](https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF) - [Public Act 26-64 (Substitute SB 4), approved 27 May 2026](https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF) - [General Statutes of Connecticut, Chapter 743jj (2026 Supplement, revised to 1 January 2026; does not yet show P.A. 25-113 text in force 1 July 2026)](https://www.cga.ct.gov/current/pub/chap_743jj.htm) [Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Connecticut statute](https://www.cga.ct.gov/current/pub/chap_743jj.htm) Reference material, not legal advice. ## Other topics for Connecticut - [Applicability](https://dposchool.com/state-privacy-laws/state/connecticut/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/connecticut/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut) / Sensitive data Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights) Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents