What are the Connecticut Data Privacy Act (CTDPA) compliance deadlines?

Jul 1, 2023: CTDPA takes effect. Dec 31, 2024: Mandatory 60-day cure period expires. Jan 1, 2025: Universal opt-out preference signals required. Jul 1, 2026: PA 25-113 (SB 1295) amendments take effect. Aug 1, 2026: Profiling impact assessments apply. Oct 1, 2026: PA 26-64 (SB 4) amendments take effect. Jan 1, 2027: Data broker registration required. Oct 1, 2028: Data brokers must process state deletion mechanism requests.

When does Connecticut Data Privacy Act (CTDPA) take effect?

Connecticut Data Privacy Act (CTDPA) took effect on Jul 1, 2023. The next milestone is Jan 1, 2027: Data broker registration required.

Who does Connecticut Data Privacy Act (CTDPA) apply to?

From July 1, 2026: entities doing business in Connecticut or targeting residents that in the preceding calendar year (1) controlled or processed personal data of 35,000+ consumers (excluding payment-only data), (2) controlled or processed any consumers' sensitive data, or (3) offered consumers' personal data for sale. Before July 1, 2026: 100,000+ consumers, or 25,000+ consumers and more than 25% of gross revenue from selling personal data.

What are the penalties under Connecticut Data Privacy Act (CTDPA)?

Violations are unfair trade practices under CUTPA; civil penalties up to $5,000 per willful violation, plus restitution and injunctive relief. Mandatory 60-day cure period ended Dec 31, 2024; AG now has discretion to offer a cure.

Connecticut Data Privacy Act (CTDPA)

Amended Connecticut · In force Jul 1, 2023 · next deadline Jan 1, 2027 (in 2 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

ComplianceJan 1, 2027 · in 2 months · Source

Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).

ComplianceOct 1, 2028 · in 23 months · Source

Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.

Already passed

Takes effectOct 1 · 26 days ago · Source

PA 26-64 (SB 4) amendments take effectProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.

ComplianceAug 1 · 3 months ago · Source

Profiling impact assessments applyImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended).

Takes effectJul 1 · 4 months ago · Source

PA 25-113 (SB 1295) amendments take effectThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure in privacy notices.

ComplianceJan 1, 2025 · 22 months ago · Source

Universal opt-out preference signals requiredControllers must honor opt-out preference signals for targeted advertising and sale (effective Jan 1, 2025).

EnforcementDec 31, 2024 · 22 months ago · Source

Mandatory 60-day cure period expiresAfter Dec 31, 2024, the AG is no longer required to offer a 60-day cure before enforcement; cure becomes discretionary.

Takes effectJul 1, 2023 · 3.3 years ago · Source

CTDPA takes effectCore consumer rights and controller obligations apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.

Who it applies to: From July 1, 2026: entities doing business in Connecticut or targeting residents that in the preceding calendar year (1) controlled or processed personal data of 35,000+ consumers (excluding payment-only data), (2) controlled or processed any consumers' sensitive data, or (3) offered consumers' personal data for sale. Before July 1, 2026: 100,000+ consumers, or 25,000+ consumers and more than 25% of gross revenue from selling personal data.
Penalties: Violations are unfair trade practices under CUTPA; civil penalties up to $5,000 per willful violation, plus restitution and injunctive relief. Mandatory 60-day cure period ended Dec 31, 2024; AG now has discretion to offer a cure.
Enforced by: Connecticut Attorney General
Official name: Connecticut Data Privacy Act (Public Act 22-15), Conn. Gen. Stat. 42-515 et seq., as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4)
Citation: Public Act 22-15 (SB 6, 2022); Conn. Gen. Stat. 42-515 to 42-526; PA 25-113; PA 26-64
Topics: Privacy, Children, AI, Health data

Verified 2026-09-22 cga.ct.gov cga.ct.gov cga.ct.gov wiley.law

Research notes

PA 25-113 is an omnibus act (also covers broadband, gaming, social media). Opt-out preference signal date (Jan 1, 2025) and CUTPA $5,000 willful-violation penalty are from the original act/CUTPA and not re-verified line by line. The DCP must establish the deletion mechanism by July 1, 2028. Consumer health data and minors' provisions added by PA 23-56 (2023) are folded into this record.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025

EnactedCalifornia

California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months

AmendedCalifornia

California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months

In forceCalifornia

California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026

Questions about Connecticut Data Privacy Act (CTDPA)

What are the Connecticut Data Privacy Act (CTDPA) compliance deadlines?: Jul 1, 2023: CTDPA takes effect. Dec 31, 2024: Mandatory 60-day cure period expires. Jan 1, 2025: Universal opt-out preference signals required. Jul 1, 2026: PA 25-113 (SB 1295) amendments take effect. Aug 1, 2026: Profiling impact assessments apply. Oct 1, 2026: PA 26-64 (SB 4) amendments take effect. Jan 1, 2027: Data broker registration required. Oct 1, 2028: Data brokers must process state deletion mechanism requests.
When does Connecticut Data Privacy Act (CTDPA) take effect?: Connecticut Data Privacy Act (CTDPA) took effect on Jul 1, 2023. The next milestone is Jan 1, 2027: Data broker registration required.
Who does Connecticut Data Privacy Act (CTDPA) apply to?: From July 1, 2026: entities doing business in Connecticut or targeting residents that in the preceding calendar year (1) controlled or processed personal data of 35,000+ consumers (excluding payment-only data), (2) controlled or processed any consumers' sensitive data, or (3) offered consumers' personal data for sale. Before July 1, 2026: 100,000+ consumers, or 25,000+ consumers and more than 25% of gross revenue from selling personal data.
What are the penalties under Connecticut Data Privacy Act (CTDPA)?: Violations are unfair trade practices under CUTPA; civil penalties up to $5,000 per willful violation, plus restitution and injunctive relief. Mandatory 60-day cure period ended Dec 31, 2024; AG now has discretion to offer a cure.

Deadlines

What it does

Related