Connecticut Data Privacy Act

The act was rewritten on 1 July 2026

Connecticut’s law took effect on 1 July 2023. Public Act 25-113, passed in the 2025 session, rewrote most of its working sections from 1 July 2026: who is covered, what counts as sensitive, what the privacy notice says, which rights a consumer has and what must be assessed in writing. A checklist written before that session describes the old text.

The table below is the redline, section by section. The left column is the text as it stood on 30 June 2026; the right is the text the General Assembly’s 2026 Supplement prints as in force “on and after July 1, 2026”.

Connecticut is not the only state that moves its line on a fixed date: Delaware’s drops on 1 January 2027. The state privacy law map holds every state’s line in one table.

Who it reaches since 1 July 2026

Until 30 June 2026 Connecticut used the familiar two-part test: 100,000 consumers, or 25,000 consumers plus more than a quarter of gross revenue from selling personal data. The amended 42-516 keeps a count but lowers it, and adds two doors that have no count at all.

Since 1 July 2026, holding one Connecticut consumer’s sensitive data, or offering one list for sale, can bring a firm inside the act with no head count at all. For a small health, dating or location app, the question is no longer how many users it has but what it holds about them.

Who counts as a consumer

A consumer is a Connecticut resident acting as an individual. Someone dealing with you only in a commercial or employment role, as an employee, owner, director, officer or contractor of a company, nonprofit or agency, is not counted. A business-to-business firm whose contacts are all buyers at other companies may still sit under 35,000; its website visitors and newsletter subscribers are a different question.

Sensitive data, before and after

Sensitive data matters four times over in Connecticut: it is now a door into the act on its own, it needs consent before you process it, it may not be sold without consent, and processing it calls for a written data protection assessment. The amendment changed the list as much as it changed the rules around it: 3 new kinds, 4 widened, 2 as they were.

The two new financial and ID items reach ordinary businesses, not only health and data firms. A shop that keeps a scan of a driver’s licence for age checks, or a platform that stores bank log-ins to pull statements, now holds sensitive data. The earlier text is still worth keeping on file for anything that happened before 1 July 2026; it is posted in the general statutes revised to 1 January 2025.

What a controller must do

Section 42-520(a)(1) is the list a controller lives with every day: rules lettered (A) to (I). The notes in grey mark what the 2026 text changed.

The five factors for a new purpose

Whether a new use is compatible with what you told people turns on:

1. what the consumer reasonably expected when the data was collected.
2. how the new purpose relates to the disclosed ones.
3. the impact of the new use on the consumer.
4. the relationship with the consumer and the context of collection.
5. safeguards such as encryption or pseudonymization.

Discounts and loyalty schemes

You may not deny service, charge more or lower quality because someone used a right. You may still run a bona fide loyalty, rewards, premium-features, discount or club-card programme that people join voluntarily, and you need not offer a product that depends on data you do not collect.

Processors carry their own duties under 42-521: follow your instructions and help with requests, security and breach notice, under a binding contract that sets out the instructions, the nature and purpose of the processing, the types of data, the duration and both parties’ rights. A processing agreement template is a starting point for that contract.

The opt-out link and the opt-out signal

A covered controller with a website needs two routes for opting out of targeted advertising and sale. The link has been required since the act began; the signal since 1 January 2025.

• A link. A clear and conspicuous hyperlink on the website to a page where the consumer, or an agent, can opt out. No new account may be required to use it (42-520(c)(1)).
• A signal. An opt-out preference signal sent with the consumer’s consent by a platform, technology or mechanism must be honoured as an opt-out of targeted advertising and sale.

The mechanism behind the signal must meet five conditions. It must:

1. not unfairly disadvantage another controller.
2. not be on by default: the consumer makes an affirmative, freely given and unambiguous choice.
3. be consumer-friendly and easy for the average consumer to use.
4. be as consistent as possible with similar mechanisms other federal or state rules require.
5. let the controller tell whether the consumer lives in Connecticut and whether the opt-out request is legitimate.

Connecticut’s text names no particular signal and sets no list of approved ones. Colorado is different: its Attorney General keeps a list, and today it holds one entry, Global Privacy Control; the Colorado Privacy Act guide explains how that list works. To see what a browser signal looks like when it reaches a site, the GPC checker reads it from your own browser.

When the signal conflicts with a setting the consumer chose

If a signal clashes with an account privacy setting, or with a loyalty or discount programme the person joined, the signal wins. You may tell the person about the conflict and offer the choice to confirm the setting or the programme. If you answer an opt-out by mentioning a charge, you must present the terms of the financial incentive.

Agents, authentication and fraud

A consumer may name an authorised agent to opt out for them, including through an internet link, a browser setting, a browser extension or a global device setting (42-519). You comply where you can verify, with commercially reasonable effort, the consumer’s identity and the agent’s authority.

California asks for its own opt-out link, with wording the law sets; the Do Not Sell or Share link guide covers it. One opt-out page can serve both states only if it does everything each one requires.

The privacy notice, item by item

The amended 42-520(b) lists nine things a Connecticut privacy notice must say. Two are new, four were reworded, and the posting rules beneath the list are new too. One general notice is enough if it meets every item; it need not be specific to Connecticut (42-520(b)(4)).

Item (H) is easy to miss. It asks for a statement either way: a firm that does not use personal data to train large language models still has to say whether it does.

Where and how the notice is posted

• Through a conspicuous hyperlink that includes the word “privacy” on your website’s home page; on the app store or download page of a mobile app; and in the app’s settings menu or a similar place.
• Through the medium you usually use with consumers, such as mail, if you have no website.
• In every language in which you offer the product or service it covers.
• In a way people with disabilities can reach and use.

A retroactive material change to the notice or to your practices needs notice to the people affected and a reasonable chance to withdraw consent to further, materially different use of data already collected. The privacy policy checklist covers the GDPR and CCPA items; many of Connecticut’s nine overlap with them, and (H) and (I) are the ones to add by hand.

Seven rights on one clock

Connecticut gave consumers five rights in 2023. The 2026 text adds two, widens access and opt-out, and keeps the same clock: 45 days + 45.

• 1Confirm and accessIncluding inferences drawn from the data, and whether it is used for profiling behind a significant decision.
• 2CorrectInaccuracies, given the nature of the data and the purpose.
• 3DeleteData the consumer gave and data obtained about them.
• 4Portable copyWhere processing is automated, in a readily usable format; no trade secrets.
• 5Opt outOf targeted advertising, sale, and profiling behind any automated decision with a legal or similarly significant effect.
• 6Question a profiling decisionnewWhere feasible: question the result, learn the reason, review the data used; for housing, correct the data and have the decision re-run.
• 7List of buyersnewThe third parties the controller sold the consumer's data to, or else a list of all third parties it sold data to.

Smaller rules that shape the reply

• Answers are free once per consumer in any twelve months. A manifestly unfounded, excessive or repetitive request can be charged a reasonable fee or declined, and proving that is on you.
• If you cannot authenticate a request to access, correct, delete, copy or question a profiling decision with commercially reasonable effort, tell the consumer and ask for what you need.
• Data obtained from someone other than the consumer counts as deleted if you keep a minimal suppression record, or opt the consumer out of all non-exempt processing.

The 45-day clock with one 45-day extension is the one the DSAR deadline calculator runs for the CCPA, so its CCPA dates fit a Connecticut request too.

Two kinds of assessment

Connecticut now asks for two written assessments. The first has been required since 2023; the second is new and applies only to one kind of profiling.

The data protection assessment

Required for each processing activity with a heightened risk of harm. The statute names 4:

1. targeted advertising.
2. selling personal data.
3. profiling with a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, an offensive intrusion on private affairs, or other substantial injury.
4. processing sensitive data.

Each one weighs the benefits to you, the consumer, other stakeholders and the public against the risks to the consumer’s rights, after the safeguards you can apply. It must take account of de-identified data, consumers’ reasonable expectations, the context and your relationship with the people concerned. The duty covers processing activities created or generated after 1 July 2023; it is not retroactive.

The impact assessment, new in 2026

A controller that uses profiling to make a decision with a legal or similarly significant effect must also run an impact assessment. The statute defines that kind of decision as one that provides or denies financial or lending services, housing, insurance, education enrolment or opportunity, criminal justice, employment opportunities or health care services. The assessment covers, as far as the controller reasonably knows:

1. the purpose, intended use cases, deployment context and benefits of the profiling.
2. whether it poses a known or reasonably foreseeable heightened risk of harm, what that risk is, and the steps taken to reduce it.
3. the main categories of personal data used as inputs, and the outputs.
4. the main categories of data used to customise the profiling, if any.
5. the metrics used to evaluate performance, and known limitations.
6. the transparency measures, including how consumers are told profiling is happening.
7. post-deployment monitoring and user safeguards.

What happens to them

• The Attorney General can require any assessment relevant to an investigation, and may evaluate it against the act.
• Assessments are confidential and exempt from the Freedom of Information Act; handing one over does not waive privilege or work-product protection.
• One assessment may cover a set of comparable processing operations.
• An assessment done for another law counts if it is reasonably similar in scope and effect.

Who and what sits outside

Section 42-517 has two lists: bodies the act never reaches, and kinds of data it never reaches whoever holds them. The 2026 text lists 12 kinds of body, 4 of them new.

• State and local government bodies
• Their contractors, while processing consumer health data for them
• Nonprofit organisations
• Candidate, national, party and political committeesnew
• Institutions of higher education
• A national securities association registered with the SEC
• HIPAA covered entities and business associates
• Tribal nation government organisations
• Air carriers under the Federal Aviation Act
• Insurers and their affiliates, health carriers, insurance-support organisations, insurance agents and producersnew
• Banks and credit unions engaged only in financial activities, regulated and examined, with a data compliance programmenew
• Broker-dealers, investment advisers and agents regulated by the Department of Banking or the SECnew

One limit on that list: the consumer health data rules in 42-526 carry their own exemptions, which do not include nonprofits, and reach any person doing business in Connecticut.

The data exemptions include, among others:

• protected health information under HIPAA, and related research and patient-safety data.
• credit-reporting activity regulated by the Fair Credit Reporting Act.
• data handled under the Driver's Privacy Protection Act, FERPA or the Farm Credit Act.
• job-applicant, employee, agent and contractor data used in that role; emergency contacts; benefits data.
• data subject to Title V of the Gramm-Leach-Bliley Act (new as a data exemption).
• airline price, route or service data.

Enforcement

Enforced by the Attorney General (exclusive) (42-525(a)). Cure period: 60 days, ended 31 Dec 2024; AG discretion from 1 Jan 2025. The act creates no private right of action (42-525(d)).

When the Attorney General decides whether to offer a cure, the statute lists 7 things to weigh:

1. the number of violations.
2. the size and complexity of the firm.
3. the nature and extent of its processing.
4. the substantial likelihood of injury to the public.
5. the safety of persons or property.
6. whether the violation was likely caused by human or technical error.
7. the sensitivity of the data.

Where the penalty comes from

The privacy chapter sets no fine of its own. A violation is an unfair trade practice under the Connecticut Unfair Trade Practices Act (42-110b), enforced solely by the Attorney General; CUTPA’s private-suit section, 42-110g, does not apply. In an Attorney General action a court can award a civil penalty of up to $5,000 for each wilful violation, and up to $25,000 for each violation of an injunction, under Conn. Gen. Stat. § 42-110o.

Other states kept the cure. Virginia and Texas still give 30 days and Iowa 90 before an action; Connecticut no longer has to give any.

Questions