United States – Connecticut

Regulator And AuthorityGreen

The Connecticut Attorney General has exclusive statutory authority to enforce the CTDPA; there is no dedicated state privacy agency (unlike California's CPPA).

Claims (1):

• The Connecticut Attorney General has exclusive authority to enforce violations of the CTDPA and there is no private right of action.

Act And InstrumentsAmber

Core instrument is the CTDPA as amended by the Online Privacy Act (2023), the 2024 minors' amendments, the 2025/2026 threshold-lowering amendments (effective July 1, 2026), and Public Act 26-64 (SB4, effective October 1, 2026) adding data-broker and facial-recognition provisions.

Claims (3):

• Governor Ned Lamont signed Senate Bill 6 (the CTDPA) into law on May 10, 2022, and the Act took effect on July 1, 2023.
• Amendments to the CTDPA going into effect on July 1, 2026 broaden applicability thresholds, including making all sensitive-data processing and all sales of personal data covered under the law.
• Public Act No. 26-64 (Senate Bill 4), signed May 27, 2026, amends the CTDPA and establishes a data-broker registration and deletion-request framework, with key provisions (data brokers, facial recognition technology, precise geolocation) taking effect October 1, 2026.

Material ScopeGreen

CTDPA covers personal data of CT residents acting in an individual/household context; excludes employment-context data and 16 categories of exempted data overlapping with federal sectoral laws (HIPAA, FCRA, GLBA, DPPA, FERPA, Farm Credit Act, Airline Deregulation Act).

Claims (2):

• The CTDPA protects a Connecticut resident acting in an individual or household context but does not protect an individual acting in an employment context.
• The CTDPA contains 16 categories of exempted data, including specific information regulated by HIPAA, the Fair Credit Reporting Act, the Driver's Privacy Protection Act, FERPA, the Farm Credit Act, and the Airline Deregulation Act, plus exemptions for specific employee and job-applicant data.

Territorial ScopeGreen

Applies to persons conducting business in Connecticut or targeting products/services to CT residents meeting the statutory thresholds; no extraterritorial reach beyond that consumer-targeting test.

Claims (1):

• The CTDPA protects a Connecticut resident acting in an individual or household context but does not protect an individual acting in an employment context.

Regulator Registration And FilingAmber

The CTDPA itself imposes no general controller registration/filing requirement; however, Public Act 26-64 (effective Oct 1, 2026) newly requires data brokers to register and establish a deletion mechanism.

Claims (1):

• Public Act No. 26-64 (Senate Bill 4), signed May 27, 2026, amends the CTDPA and establishes a data-broker registration and deletion-request framework, with key provisions (data brokers, facial recognition technology, precise geolocation) taking effect October 1, 2026.

Lawful BasesAmber

No enumerated Art.6-style lawful-bases list; general processing is permitted subject to purpose-limitation, data-minimization, and consumer opt-out rights for targeted advertising, sale, and certain profiling.

Claims (1):

• Controllers must limit the collection of personal data to what is adequate, relevant and reasonably necessary in relation to the disclosed purposes, and may not process personal data for purposes neither reasonably necessary to nor compatible with the disclosed purposes absent consent.

Consent ThresholdsGreen

Consent must be freely given, specific, informed and unambiguous and cannot be obtained through dark patterns; controllers must provide a revocation mechanism at least as easy as the consent mechanism, and must cease processing within 15 days of revocation.

Claims (1):

• A consumer's consent under the CTDPA must be freely given, specific, informed and unambiguous, cannot be obtained through dark patterns, and controllers must provide an effective revocation mechanism at least as easy as the consent mechanism, ceasing processing within 15 days of revocation.

Special CategoriesAmber

Sensitive data requires opt-in consent prior to processing; the July 2026 amendments expand the sensitive-data category list to include disability/treatment status, non-binary/transgender status, genetic/biometric-derived information, and neural data.

Claims (2):

• Sensitive data has heightened protections under the CTDPA and controllers must obtain affirmative opt-in consent before processing it.
• As amended, 'sensitive data' now includes data revealing disability or treatment, non-binary or transgender status, information derived from genetic or biometric data, data known to relate to a child, neural data, certain financial account information, and government-issued identification information.

Pseudonymisation And AnonymisationRed

No specific statutory safe-harbour definition for pseudonymised/anonymised data was identified in the sources reviewed for this run.

Absence provenance: not recorded. Searched: not recorded.

Access RightGreen

Consumers may confirm whether a controller is processing their personal data and access it, free of charge once every 12 months, subject to a trade-secret exception.

Claims (1):

• A consumer can request information about their personal data from a controller free of charge once every 12 months, with the controller permitted to charge an administrative fee beyond the annual free request.

Rectification And ErasureGreen

CTDPA grants rights to correct inaccuracies and to delete personal data, including data collected via third parties.

Claims (1):

• The CTDPA provides Connecticut consumers the right to correct inaccuracies in their personal data and the right to delete their personal data, including data that a business collected through third parties.

Restriction And ObjectionGreen

Consumers may opt out of processing for targeted advertising, sale of personal data, and profiling producing legal or similarly significant effects.

Claims (1):

• Connecticut consumers have the right to opt out of the sale of their personal data and targeted advertising, and, under the 2026 amendments, to know whether a controller is processing their personal data for profiling that produces a legal or similarly significant effect.

Data PortabilityGreen

The CTDPA as amended establishes a right to data portability for consumers.

Claims (1):

• The CTDPA as amended establishes rights including access, deletion, and portability for consumers.

Deadlines And Response WindowsGreen

Controllers must respond to consumer requests within 45 days of receipt, extendable by an additional 45 days under certain conditions; appeal responses are due within 60 days of receipt of the appeal.

Claims (2):

• A controller must respond to a consumer's requests no later than 45 days after receipt of the request, and under certain conditions may extend the response period by an additional 45 days.
• A controller has 60 days after receipt of an appeal to write back to the consumer explaining actions taken or reasons for refusal, and if denied must provide information to contact the Attorney General.

Accountability And DpiaGreen

Controllers must conduct and document Data Protection Assessments/Impact Assessments before processing for targeted advertising, sale, risky profiling, or sensitive data; the 2025 amendments extend impact-assessment obligations to profiling decisions.

Claims (2):

• Controllers must conduct assessments before processing personal data in a manner that presents a heightened risk of harm to consumers, including processing for targeted advertising, sale, profiling with reasonably foreseeable risk of substantial injury, and processing of sensitive data.
• Senate Bill 1295 amends the CTDPA to mandate impact assessments for profiling decisions in connection with social-media platform obligations regarding minors' data.

Dpo RequirementsRed

No CTDPA provision mandating appointment of a Data Protection Officer was identified in the sources reviewed for this run.

Absence provenance: not recorded. Searched: not recorded.

Ropa RequirementsAmber

No explicit statutory records-of-processing-activities obligation distinct from the DPA/impact-assessment documentation requirement was identified.

Absence provenance: not recorded. Searched: not recorded.

Claims (1):

• Controllers must conduct assessments before processing personal data in a manner that presents a heightened risk of harm to consumers, including processing for targeted advertising, sale, profiling with reasonably foreseeable risk of substantial injury, and processing of sensitive data.

Joint Controller ArrangementsGreen

CTDPA distinguishes controllers and processors; a processor exercising independent decision-making authority over purposes/means becomes a controller for that processing and assumes controller obligations.

Claims (1):

• If a processor exercises decision-making authority with respect to the purposes and means of personal-data processing, it becomes a controller with respect to that processing and is subject to controller obligations under the CTDPA.

Security MeasuresGreen

Controllers must use reasonable safeguards to secure personal data (CTDPA), supplemented by the Connecticut Safeguards Law (Conn. Gen. Stat. § 42-471) and Social Security Number Law (§ 42-470).

Claims (1):

• Controllers must use reasonable safeguards to secure personal data as part of their obligations to comply with the CTDPA.

Breach NotificationGreen

Under Conn. Gen. Stat. § 36a-701b, notice to affected CT residents must be made without unreasonable delay and no later than 60 days from discovery of the breach; AG notice is due no later than resident notification; SSN/TIN compromise triggers a mandatory 24-month credit-monitoring offer.

Claims (2):

• Notice to Connecticut residents of a security breach must be made without unreasonable delay and no later than sixty days from discovery of the breach, per Conn. Gen. Stat. § 36a-701b(b)(1); notice to the Attorney General must be provided no later than when residents are notified.
• If a Connecticut resident's Social Security number or Taxpayer Identification Number is believed compromised in a breach, Connecticut law requires the resident be offered 24 months of credit monitoring services.

Retention And DisposalAmber

No CTDPA-specific numeric retention-limit provision was identified beyond the general purpose-limitation/data-minimization principle.

Absence provenance: not recorded. Searched: not recorded.

Claims (1):

• Controllers must limit the collection of personal data to what is adequate, relevant and reasonably necessary in relation to the disclosed purposes, and may not process personal data for purposes neither reasonably necessary to nor compatible with the disclosed purposes absent consent.

Transfer MechanismsRed

No CTDPA transfer-mechanism provision identified.

Absence provenance: not recorded. Searched: not recorded.

Adequacy ReceivedRed

Not applicable; CT is a sub-national US jurisdiction with no adequacy-receiving framework.

Absence provenance: not recorded. Searched: not recorded.

Adequacy GrantedRed

Not applicable; Connecticut does not issue adequacy determinations.

Absence provenance: not recorded. Searched: not recorded.

Sccs And BcrsRed

No SCC/BCR uptake mechanism exists under CTDPA.

Absence provenance: not recorded. Searched: not recorded.

Transfer Impact AssessmentRed

No transfer-impact-assessment requirement exists under CTDPA.

Absence provenance: not recorded. Searched: not recorded.

Data LocalisationRed

No data-localisation mandate exists under CTDPA.

Absence provenance: not recorded. Searched: not recorded.

Financial Sector OverlayGreen

GLBA-regulated financial institutions and their data are generally exempt from CTDPA; the Connecticut Insurance Data Security Law imposes its own breach-notification duties, including a 72-hour TPSP-event notification for assuming insurers to ceding insurers and domiciliary regulators.

Claims (1):

• Under the Connecticut Insurance Data Security Law, a licensee acting as an assuming insurer must notify affected ceding insurers and its domiciliary regulator of a cybersecurity event involving nonpublic information in the possession of a third-party service provider (TPSP) not later than 72 hours after the assuming insurer received notice from the TPSP.

Health Sector OverlayAmber

HIPAA-covered entities/business associates and their protected health information are exempt from CTDPA; the AG's Privacy Section separately enforces HIPAA under delegated federal authority. The CTDPA's standalone Consumer Health Data provisions (Online Privacy Act) apply to non-HIPAA consumer health data with no size threshold.

Claims (1):

• The CTDPA applies to all Consumer Health Data Controllers doing business in or targeting Connecticut residents regardless of size or processing volume, with no revenue or processing threshold and no nonprofit exemption.

Telecoms And EprivacyAmber

No CT-specific ePrivacy/cookie-consent statute distinct from CTDPA's general opt-out framework was identified.

Absence provenance: not recorded. Searched: not recorded.

Employment DataGreen

CTDPA expressly excludes personal data processed in an employment context (e.g., job applications) from its scope.

Claims (1):

• The CTDPA protects a Connecticut resident acting in an individual or household context but does not protect an individual acting in an employment context.

Credit And ScoringGreen

FCRA-regulated data and entities are exempt from CTDPA; the AG's Privacy and Data Security Department separately enforces the FCRA under delegated federal authority.

Claims (1):

• The AG's Privacy and Data Security Department is responsible for enforcement of federal laws under which the Attorney General has enforcement authority, including HIPAA, COPPA, and the Fair Credit Reporting Act.

EducationGreen

FERPA-regulated education records are among the CTDPA's exempted data categories.

Claims (1):

• The CTDPA contains 16 categories of exempted data, including specific information regulated by HIPAA, the Fair Credit Reporting Act, the Driver's Privacy Protection Act, FERPA, the Farm Credit Act, and the Airline Deregulation Act, plus exemptions for specific employee and job-applicant data.

InsuranceGreen

The Connecticut Insurance Data Security Law requires licensees to notify the Insurance Commissioner and affected consumers of cybersecurity events and imposes a distinct 72-hour TPSP-related notification duty for assuming insurers.

Claims (1):

• Under the Connecticut Insurance Data Security Law, a licensee acting as an assuming insurer must notify affected ceding insurers and its domiciliary regulator of a cybersecurity event involving nonpublic information in the possession of a third-party service provider (TPSP) not later than 72 hours after the assuming insurer received notice from the TPSP.

Cookies And TrackersGreen

No dedicated cookie-consent statute; tracking for targeted advertising/sale falls under the general CTDPA opt-out and universal-signal framework.

Claims (1):

• As of January 1, 2025, Connecticut consumers can send an opt-out preference signal, such as the Global Privacy Control, through a privacy-protective browser or browser extension, to automatically tell controllers they intend to opt out of targeted advertising and sale of personal data.

Dark PatternsGreen

Consent cannot be obtained through the use of dark patterns under the CTDPA.

Claims (1):

• A consumer's consent under the CTDPA must be freely given, specific, informed and unambiguous, cannot be obtained through dark patterns, and controllers must provide an effective revocation mechanism at least as easy as the consent mechanism, ceasing processing within 15 days of revocation.

Opt Out SignalsGreen

As of January 1, 2025, businesses covered under the CTDPA must honor universal opt-out preference signals like the Global Privacy Control sent via a privacy-protective browser or extension, without requiring authentication.

Claims (2):

• As of January 1, 2025, Connecticut consumers can send an opt-out preference signal, such as the Global Privacy Control, through a privacy-protective browser or browser extension, to automatically tell controllers they intend to opt out of targeted advertising and sale of personal data.
• Unlike Colorado's law, the CTDPA does not require controllers to authenticate opt-out signals, making it easier for consumers to exercise universal opt-out rights, similar to the approach under the California Privacy Rights Act.

Clean Rooms And DcrRed

No CTDPA-specific clean-room/data-collaboration-room provision identified.

Absence provenance: not recorded. Searched: not recorded.

Cross Context AdvertisingAmber

CTDPA regulates 'sale' of personal data and 'targeted advertising' analogous to CPRA's sale/share concepts, but does not use CPRA's specific 'cross-context behavioral advertising/share' terminology.

Claims (1):

• Connecticut consumers have the right to opt out of the sale of their personal data and targeted advertising, and, under the 2026 amendments, to know whether a controller is processing their personal data for profiling that produces a legal or similarly significant effect.

Direct MarketingGreen

Targeted advertising and sale of personal data for marketing purposes are subject to opt-out rights and, for minors under 16, to opt-in consent requirements.

Claims (1):

• Controllers must obtain opt-in consent before selling a consumer's personal data or processing it for targeted advertising when the consumer is under 16 years old, or where the controller has actual knowledge or willfully disregards that the consumer is between 13 and 16.

Profiling RestrictionsGreen

Controllers must conduct a Data Protection Assessment before processing personal data for profiling presenting a reasonably foreseeable risk of substantial injury to consumers, and must obtain consent before profiling a minor's personal data.

Claims (2):

• Controllers must conduct a Data Protection Assessment before processing personal data for the purposes of profiling where such profiling presents a reasonably foreseeable risk of substantial injury to consumers.
• A controller must obtain consent prior to processing a minor's personal data for profiling.

Automated Decision Making TransparencyAmber

The 2026 amendments grant consumers rights to know whether profiling is used to make legally or similarly significant decisions and, where feasible, to question results, learn the decision's reasoning, review the data used, and — for housing decisions specifically — correct data and obtain reevaluation.

Claims (1):

• New consumer rights let Connecticut residents obtain a list of third parties to which a business sold their data, access inferences drawn from their personal data, and know whether profiling is used to make a decision producing legal or similarly significant effects, with feasible rights to question results, learn reasoning, review data used, and (for housing decisions) correct data and obtain reevaluation.

Ai Risk AssessmentsAmber

A new disclosure requirement enacted for 2025/2026 requires companies to disclose whether personal data is used to train large language models; Senate Bill 5 separately establishes broader AI regulatory measures in Connecticut.

Claims (1):

• New disclosure requirements enacted for the CTDPA require companies to disclose whether personal data is used to train large language models.

Biometric RegimeAmber

The 2026 amendments drastically expand biometric-data coverage under 'sensitive data' to include such data regardless of purpose of collection and to include information derived therefrom; Public Act 26-64 separately introduces facial-recognition-technology limitations and transparency requirements effective October 1, 2026.

Claims (2):

• The 2026 CTDPA amendment drastically expands the biometric and genetic data categories, removing the existing purpose-based limitation to include such data regardless of collection purpose and to include information derived therefrom, i.e., inferences created from genetic or biometric data.
• Public Act No. 26-64 introduces and revises the definition of 'facial recognition technology' and sets limitations and transparency requirements for its use, with these provisions taking effect October 1, 2026.

Genetic DataAmber

The AG's 2026 report recommends adoption of a standalone genetic-data privacy law; in the interim, genetic data is covered as sensitive data under the CTDPA as amended, with expanded coverage of genetically-derived inferences.

Claims (2):

• The Connecticut Attorney General's 2026 report on the CTDPA recommends the state legislature adopt a standalone genetic data privacy law, alongside adoption of a genetic-testing amendment expansion already introduced via Senate Bill 4.
• The 2026 CTDPA amendment drastically expands the biometric and genetic data categories, removing the existing purpose-based limitation to include such data regardless of collection purpose and to include information derived therefrom, i.e., inferences created from genetic or biometric data.

State Surveillance CarveoutsRed

No CTDPA-specific national-security/state-surveillance carveout distinct from general exemptions was identified in the sources reviewed.

Absence provenance: not recorded. Searched: not recorded.

Age VerificationAmber

CTDPA relies on an actual-knowledge/willful-disregard standard for identifying minors under 16 (and generally under 18 for enhanced online-service protections) rather than mandating affirmative age-verification technology.

Claims (1):

• Consent is required to process a consumer's personal data for targeted advertising or to sell their data where a controller has actual knowledge of, and willfully disregards, that the consumer is between 13 and 16 years old.

Parental ConsentGreen

A child's parent or legal guardian may exercise privacy rights on the child's behalf, and controllers must follow COPPA parental-consent requirements for children under 13.

Claims (1):

• If a child's personal data is processed by a controller, the child's parent or legal guardian may exercise rights on the child's behalf, and controllers must follow COPPA regulations including parental-consent requirements.

Minor Profiling BansGreen

Controllers must obtain consent before processing a minor's personal data for profiling, and may not process a minor's data for targeted advertising or sale.

Claims (2):

• A controller shall not process a minor's data for purposes of targeted advertising or any sale, and shall not use any design feature to significantly increase, sustain, or extend a minor's use of an online service, product, or feature.
• A controller must obtain consent prior to processing a minor's personal data for profiling.

Education SettingsAmber

FERPA-regulated education records are exempted from CTDPA; no CT-specific education-technology privacy statute distinct from FERPA/COPPA was identified for this run.

Absence provenance: not recorded. Searched: not recorded.

Claims (1):

• The CTDPA contains 16 categories of exempted data, including specific information regulated by HIPAA, the Fair Credit Reporting Act, the Driver's Privacy Protection Act, FERPA, the Farm Credit Act, and the Airline Deregulation Act, plus exemptions for specific employee and job-applicant data.

Dependent AdultsRed

No CTDPA provision specific to dependent/incapacitated adults distinct from the general consumer-rights framework was identified.

Absence provenance: not recorded. Searched: not recorded.

Regulator Powers And PenaltiesGreen

The AG has exclusive enforcement authority; violations are treated as unfair trade practices under CUTPA, carrying civil penalties of up to $5,000 per willful violation.

Claims (2):

• The Attorney General has exclusive authority to enforce violations of the CTDPA.
• Entities or individuals that violate the CTDPA may face civil penalties up to $5,000 per violation pursuant to the Connecticut Unfair Trade Practices Act, and the CTDPA does not include a private cause of action for individuals.

Enforcement Activity IndexGreen

By the end of 2025, the AG's office had issued dozens of notices of violation/warning letters, finalized multiple data-breach settlements, and resolved its first formal CTDPA enforcement action; the TicketNetwork matter settled for $85,000 in mid-2025.

Claims (2):

• By the end of 2025, the AG's office had issued dozens of notices of violation and warning letters, finalized multiple data breach settlements, and resolved its first enforcement action under the CTDPA.
• The Connecticut Attorney General announced a settlement with TicketNetwork, Inc. under which the company agreed to comply with the CTDPA, maintain consumer-rights-request metrics, report those metrics to the AG, and pay $85,000.

Regulator Funding And CapacityAmber

Enforcement is conducted through the AG's Privacy and Data Security Department/Section, which also handles federal HIPAA/COPPA/FCRA enforcement delegated to the state; no specific headcount or budget figures were identified in the sources reviewed.

Absence provenance: not recorded. Searched: not recorded.

Claims (1):

• SRC_placeholder (claim on file)

Collective Redress And Class ActionsAmber

No CTDPA-specific collective-redress or class-action mechanism was identified; general Connecticut civil procedure class-action rules would apply to any underlying tort/CUTPA claim, but CTDPA itself channels enforcement solely through the AG.

Absence provenance: not recorded. Searched: not recorded.

Claims (1):

• Entities or individuals that violate the CTDPA may face civil penalties up to $5,000 per violation pursuant to the Connecticut Unfair Trade Practices Act, and the CTDPA does not include a private cause of action for individuals.

Private Right Of ActionRed

The CTDPA does not include a private cause of action for individuals; enforcement is exclusively through the Attorney General.

Claims (1):

• Entities or individuals that violate the CTDPA may face civil penalties up to $5,000 per violation pursuant to the Connecticut Unfair Trade Practices Act, and the CTDPA does not include a private cause of action for individuals.

Recent Developments 180DAmber

Within the last 180 days of the run date (2026-08-05): AG Tong released the third annual CTDPA enforcement report (Feb 5, 2026) disclosing the first resolved enforcement action and new investigations into chatbots/AI products harming minors; Governor Lamont signed Senate Bill 4 (Public Act 26-64) on May 27, 2026 adding data-broker registration and facial-recognition rules effective Oct 1, 2026; and CTDPA amendments broadening applicability thresholds and sensitive-data categories took/take effect July 1, 2026.

Claims (3):

• By the end of 2025, the AG's office had issued dozens of notices of violation and warning letters, finalized multiple data breach settlements, and resolved its first enforcement action under the CTDPA.
• Public Act No. 26-64 (Senate Bill 4), signed May 27, 2026, amends the CTDPA and establishes a data-broker registration and deletion-request framework, with key provisions (data brokers, facial recognition technology, precise geolocation) taking effect October 1, 2026.
• Amendments to the CTDPA going into effect on July 1, 2026 broaden applicability thresholds, including making all sensitive-data processing and all sales of personal data covered under the law.