Regulations › US states › Connecticut
CTDPA
Connecticut Data Privacy Act
WhenIn effect since 1 July 2023
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsFrom July 1, 2026: 35,000+ consumers, or any controller that processes sensitive data or offer…
Universal opt-outControllers must honor universal opt-out preference signals for targeted ads and sales since J…
Cure periodMandatory 60-day cure ended December 31, 2024
Request deadline45 days, extendable once by 45 days
Maximum penaltyUp to $5,000 per willful violation under CUTPA, plus restitution, disgorgement and injunctions
Private actionNo private right of action under the CTDPA.
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
3
From July 1, 2026: 35,000+ consumers, or any controller that processes sensitive data or offers personal data for sale, regardless of volume.Conn. Gen. Stat. § 42-516 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. Previously 100,000, or 25,000 plus 25% revenue.
Exemptions
2
GLBA exemption narrowed to data level in 2026; HIPAA entity exemption and nonprofit exemption appear to remain.Conn. Gen. Stat. § 42-517 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. AG's 2024 report confirmed nonprofit and entity-level GLBA/HIPAA exemptions before the amendment; HIPAA and nonprofit status after July 2026 not confirmed.
Sensitive data and minors
Sensitive data
2
Consent plus reasonable necessity for sensitive data, which now includes consumer health, neural, financial account and government ID data and transgender/nonbinary status.Conn. Gen. Stat. §§ 42-515, 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Children and teens
3
Minors 13 to 17: targeted advertising and sale banned regardless of consent, engagement-extending design barred, heightened assessments; under 13 per COPPA.Conn. Gen. Stat. § 42-529a et seq. · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Data minimization
2
Collection must be reasonably necessary and proportionate to disclosed purposes; material new secondary uses need fresh consent.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Consumers' rights
Rights
3
Access (incl. inferences), correct, delete, portability, three opt-outs, list of third parties sold to, and explanation and review of profiling decisions.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Request deadline
2
45 days, extendable once by 45 days.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Deadline from pre-amendment statute knowledge; not read this session.
Appeals
2
Internal appeal answered within 60 days, with an online way to contact the Attorney General if denied.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Appeal timing from statute knowledge; AG report mentions appeal duties but not timing.
Universal opt-out
2
Controllers must honor universal opt-out preference signals for targeted ads and sales since January 1, 2025.Conn. Gen. Stat. § 42-518 · source ↗
Subsection not confirmed.
Business duties
Assessments
3
Data protection assessments plus a separate profiling impact assessment for significant decisions, for processing created on or after August 1, 2026; AG may request them.Conn. Gen. Stat. § 42-522 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. Scored 3 for algorithmic (profiling) impact assessments.
Processor contracts
3
Contract with instructions, confidentiality, deletion, compliance info, assessments, and subcontractor flow-down after notice and chance to object.Conn. Gen. Stat. § 42-521 · secondary source · source ↗
Terms from statute knowledge (Virginia model with Connecticut objection right); not read this session.
Privacy notice
2
Notice must disclose LLM training use, profiling and targeted ads, be linked with the word 'privacy', translated and accessible.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Loyalty programs
1
Different prices allowed for voluntary participation in bona fide loyalty or rewards programs.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
From statute knowledge; not read this session.
De-identified data
3
Public commitment, reasonable measures and contract flow-down for deidentified data; pseudonymous data rules mirror Virginia.Conn. Gen. Stat. § 42-523 · secondary source · source ↗
From statute knowledge; not read this session.
Enforcement
Who enforces
1
Attorney General enforces as an unfair trade practice under CUTPA.Conn. Gen. Stat. § 42-525; § 42-110a et seq. · source ↗
Cure period
1
Mandatory 60-day cure ended December 31, 2024; the AG may still allow a cure at its discretion.Conn. Gen. Stat. § 42-525 · source ↗
Maximum penalty
1
Up to $5,000 per willful violation under CUTPA, plus restitution, disgorgement and injunctions.Conn. Gen. Stat. § 42-110o(b) · source ↗
Section 42-110o not named in AG report; cite from statute knowledge. Snell & Wilmer notes $2,500 for non-willful violations.
Private action
0
No private right of action under the CTDPA.Conn. Gen. Stat. § 42-525 · secondary source · source ↗
Rulemaking
0
No rulemaking authority.Conn. Gen. Stat. § 42-515 et seq. · secondary source · source ↗
No rulemaking provision reported.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws