74%
of Connecticut's 19 requirements are already met by California (CA). Here is what CTDPA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
CTDPA adds3 From July 1, 2026: 35,000+ consumers, or any controller that processes sensitive data or offers personal data for sale, regardless of volume.
Conn. Gen. Stat. § 42-516 · source ↗
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
CTDPA adds2 Consent plus reasonable necessity for sensitive data, which now includes consumer health, neural, financial account and government ID data and transgender/nonbinary status.
Conn. Gen. Stat. §§ 42-515, 42-520 · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
CTDPA adds2 Internal appeal answered within 60 days, with an online way to contact the Attorney General if denied.
Conn. Gen. Stat. § 42-518 · source ↗
Children and teensSensitive data and minorsGap
CA2 Opt-in consent needed to sell or share data of consumers under 16: parental consent under 13, the teen's own consent for ages 13 to 15.
CTDPA adds3 Minors 13 to 17: targeted advertising and sale banned regardless of consent, engagement-extending design barred, heightened assessments; under 13 per COPPA.
Conn. Gen. Stat. § 42-529a et seq. · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
CTDPA adds3 Public commitment, reasonable measures and contract flow-down for deidentified data; pseudonymous data rules mirror Virginia.
Conn. Gen. Stat. § 42-523 · source ↗
Already covered by CA: Exemptions, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means CTDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
