Connecticut (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Connecticut Data Privacy Act (CTDPA) | Conn. Gen. Stat. §§ 42-515 to 42-526 | In force | 1 July 2023 |
| Online services and minors (part of the CTDPA chapter) | Conn. Gen. Stat. §§ 42-528 to 42-530 | In force | 1 July 2024 |
| Breach of security concerning computerized data containing personal information | Conn. Gen. Stat. § 36a-701b | In force | 1 January 2006 |
| An Act Concerning Online Safety (Public Act 26-15) | Conn. Public Act No. 26-15 (Substitute Senate Bill 5, 2026) | In force | 1 October 2026 |
| An Act Concerning Consumer Privacy and Protection (Public Act 26-64) | Conn. Public Act No. 26-64 (Substitute Senate Bill 4, 2026), as amended by Public Act 26-100 | In force | 1 October 2026 |
| An Act Concerning Consumer Protection, Cannabis, Data Privacy, Fire Inspections, Criminal Mischief and Artificial Intelligence (Public Act 26-100) | Conn. Public Act No. 26-100 (Substitute House Bill 5222, 2026), sections 39 to 46 | In force | 1 October 2026 |
| Surveillance pricing (Public Act 26-130, section 11) | Conn. Public Act No. 26-130 (House Bill 5563, 2026), section 11 | Enacted, not yet in force | 1 July 2027 |
| Connected devices with a camera or microphone | Conn. Gen. Stat. § 42-531 | In force | 1 July 2026 |
- Connecticut Data Privacy Act (CTDPA): Public Act 25-113 made major changes from 1 July 2026, including lower thresholds, more sensitive data, new profiling rights, impact assessments and a ban on targeted ads and sales to under-18s. Public Act 26-64 added more from 1 October 2026, including a ban on selling precise geolocation data, wider deletion rights and signs for facial recognition used for security (as replaced by Public Act 26-100).
- Online services and minors (part of the CTDPA chapter): Section 42-528 (a minor’s social media account must be unpublished within 15 business days, or deleted within 45, on request) has applied since 1 July 2024, and sections 42-529 to 42-529e since 1 October 2024, expanded by Public Act 25-113 from 1 July 2026. Section 42-530 required social media platforms to add an online safety centre and a cyberbullying policy by 1 October 2026.
- An Act Concerning Online Safety (Public Act 26-15): AI and online safety rules in stages. A few sections took effect on passage (approved 27 May 2026) or on 1 July 2026, but builders’ first duties start on 1 October 2026 (content provenance, frontier AI whistleblowers, parts of the employment rules). AI companions follow from 1 January 2027, employment decision tools deployed from 1 October 2027, and minors’ feeds from 1 January 2028, with yearly public reports from 1 March 2028. Public Act 26-100 repealed section 1 and re-enacted its AI subscription rule.
- An Act Concerning Consumer Privacy and Protection (Public Act 26-64): Approved 27 May 2026 and in force from 1 October 2026. Data broker registration from 1 January 2027 and a state deletion mechanism by 1 July 2028, plus CTDPA changes and rules for direct-to-consumer genetic testing companies. Its price setting and facial recognition sections were repealed before taking effect; Public Act 26-100 re-enacted the facial recognition rule.
- An Act Concerning Consumer Protection, Cannabis, Data Privacy, Fire Inspections, Criminal Mischief and Artificial Intelligence (Public Act 26-100): An omnibus act approved 2 June 2026. For builders, it amends the data broker rules of Public Act 26-64, re-enacts its facial recognition rule with a consent exception, and adds a key-terms notice for generative AI subscriptions, all from 1 October 2026.
- Surveillance pricing (Public Act 26-130, section 11): Approved 4 June 2026. From 1 July 2027, retailers and food delivery services can’t use surveillance pricing, and anyone who raises an online price using a consumer’s personal data must say so. It replaced two earlier versions that never took effect.
- Connected devices with a camera or microphone: Makers of internet-connected home appliances, TVs and toys with a camera or microphone, and partners who access them, must show a set-up disclosure, let the first user decline to turn the camera or microphone on (unless that makes the device useless), secure what it collects, and use or sell recordings for targeted ads only with opt-in consent.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Since 1 July 2026, applies to anyone processing Connecticut consumers’ sensitive data or offering personal data for sale, and to businesses in or targeting Connecticut that processed data of 35,000 or more consumers in the previous year (payment-only data doesn’t count). Consumer health data rules apply at any size, non-profits included. Exempt are government, non-profits, universities, political committees, HIPAA covered entities, tribal bodies, air carriers, insurers, qualifying banks and credit unions, regulated securities firms and GLBA data. Employees and B2B contacts aren’t consumers.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm · cga.ct.gov/current/pub/chap_743jj.htm · portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
Lawful bases
Section titled “Lawful bases”There are no GDPR-style lawful bases. Controllers give a privacy notice, saying whether data trains large language models, and honour rights to access (including inferences), correct, delete and port data, opt out of targeted ads, sale and significant profiling, and learn who bought it. Sensitive data and new purposes need opt-in consent. Since 1 October 2026, selling precise geolocation data is banned and deletion covers public data compiled into profiles or sold. Consumer health data can’t be sold without consent or geofenced within 1,750 feet of mental, reproductive or sexual health sites.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm · cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF · cga.ct.gov/current/pub/chap_743jj.htm
Consent age for online services
Section titled “Consent age for online services”A child is under 13, and a known child’s data is sensitive data handled under COPPA, with parental consent. Since 1 July 2026, controllers that know or wilfully disregard that a consumer is 13 to 17 can’t use their data for targeted advertising or sell it, even with consent.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm
Children
Section titled “Children”Services that know or wilfully disregard that a user is under 18 must take reasonable care against heightened risk of harm, avoid engagement-extending features, get consent for significant profiling, block unsolicited adult messages by default and collect precise geolocation only if strictly necessary. AI companion rules for minors start in 2027. From 1 January 2028, platforms need age checks or verifiable parental consent before giving minors personalised feeds; by default minors get 1 hour of feeds a day, no feed alerts from 9pm to 8am and private accounts, plus daily mental-health warnings.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm · cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
Leads, not sources: ropesgray.com/en/insights/alerts/2026/06/connecticut-enacts-sweeping-…
Cookies and similar technologies
Section titled “Cookies and similar technologies”There’s no cookie-consent rule. Consumers can opt out of targeted advertising and sale, and since 1 January 2025 controllers must honour opt-out preference signals such as Global Privacy Control. Signals can’t be on by default.
Sources: portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act · cga.ct.gov/2026/sup/chap_743jj.htm
Electronic marketing
Section titled “Electronic marketing”Email relies on federal CAN-SPAM. Connecticut’s telemarketing law covers sales calls and texts to its residents or to Connecticut area codes. Unless an exception applies, such as an existing customer or a reply to the person’s own request, they need prior express written consent, can’t go to numbers on the National Do Not Call Registry (which is also the state list) and may only be made between 9am and 8pm. Callers must identify themselves within 10 seconds and honour opt-outs. Fines are up to $20,000 per violation, on top of unfair trade practice penalties.
Sources: cga.ct.gov/current/pub/chap_743m.htm
Breach notification
Section titled “Breach notification”Notify affected Connecticut residents without unreasonable delay and no later than 60 days after discovering a breach, and notify the Attorney General no later than the residents, using its online form. If Social Security or taxpayer ID numbers were exposed, offer at least 24 months of identity theft prevention services. Failing to comply is an unfair trade practice.
Sources: portal.ct.gov/ag/sections/privacy/reporting-a-data-breach · cga.ct.gov/current/pub/chap_669.htm
Registration and fees
Section titled “Registration and fees”From 1 January 2027, data brokers can’t sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection, at $2,500 a year. The Department must open a single deletion mechanism by 1 July 2028, and from 1 October 2028 registered brokers must check it at least every 45 days and delete the data of consumers who used it. Penalties are up to $200 per day per consumer for each violation. FCRA, GLBA and HIPAA activities and businesses with a direct relationship are exempt. The CTDPA itself has no registration or fee.
Sources: cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF · cga.ct.gov/2026/ACT/PA/PDF/2026PA-00100-R00HB-05222-PA.PDF · cga.ct.gov/2026/sup/chap_743jj.htm
Data protection officer
Section titled “Data protection officer”There’s no requirement to appoint a data protection officer.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm
International transfers
Section titled “International transfers”Connecticut law sets no restrictions on transferring personal data abroad; federal rules are in us-federal.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm
Impact assessments
Section titled “Impact assessments”Document a data protection assessment for targeted advertising, sale, sensitive data and risky profiling. Since 1 August 2026, profiling for significant decisions also needs an impact assessment covering purpose, data, performance, limits and monitoring. Services offered to minors need a data protection assessment, plus an impact assessment if they profile. The Attorney General can require assessments, which stay confidential.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm
Automated decisions and AI
Section titled “Automated decisions and AI”Since 1 July 2026, consumers can opt out of profiling for significant automated decisions and, where feasible, contest the result and learn why. Under Public Act 26-15, from 1 October 2026 large generative AI providers must embed provenance data and frontier AI developers can’t silence safety whistleblowers (up to $1,000 per violation); AI companion duties start on 1 January 2027 and notices for employment decision tools deployed from 1 October 2027. Since 1 October 2026, generative AI subscriptions with over 1 million monthly users need key terms disclosed and accepted first.
Sources: cga.ct.gov/2026/sup/chap_743jj.htm · cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF · cga.ct.gov/2026/ACT/PA/PDF/2026PA-00100-R00HB-05222-PA.PDF
Penalties
Section titled “Penalties”The Attorney General enforces alone, treating violations as unfair trade practices, with civil penalties up to $5,000 per wilful violation and injunctions. The mandatory 60-day cure period ended on 31 December 2024; since then the Attorney General may offer one. There’s no private right of action.
Sources: cga.ct.gov/current/pub/chap_743jj.htm · cga.ct.gov/current/pub/chap_735a.htm
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ct.yaml.