Connecticut Data Privacy Act (CTDPA)
Amended Connecticut · In force Jul 1, 2023 · next deadline Oct 1, 2026 (in 5 days)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.
- Who it applies to
- From July 1, 2026: entities doing business in Connecticut or targeting residents that in the preceding calendar year (1) controlled or processed personal data of 35,000+ consumers (excluding payment-only data), (2) controlled or processed any consumers' sensitive data, or (3) offered consumers' personal data for sale. Before July 1, 2026: 100,000+ consumers, or 25,000+ consumers and more than 25% of gross revenue from selling personal data.
- Penalties
- Violations are unfair trade practices under CUTPA; civil penalties up to $5,000 per willful violation, plus restitution and injunctive relief. Mandatory 60-day cure period ended Dec 31, 2024; AG now has discretion to offer a cure.
- Enforced by
- Connecticut Attorney General
- Official name
- Connecticut Data Privacy Act (Public Act 22-15), Conn. Gen. Stat. 42-515 et seq., as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4)
- Citation
- Public Act 22-15 (SB 6, 2022); Conn. Gen. Stat. 42-515 to 42-526; PA 25-113; PA 26-64
- Topics
- privacy, children, ai, health
Research notes
PA 25-113 is an omnibus act (also covers broadband, gaming, social media). Opt-out preference signal date (Jan 1, 2025) and CUTPA $5,000 willful-violation penalty are from the original act/CUTPA and not re-verified line by line. The DCP must establish the deletion mechanism by July 1, 2028. Consumer health data and minors' provisions added by PA 23-56 (2023) are folded into this record.
Related
Questions about Connecticut Data Privacy Act (CTDPA)
- What are the Connecticut Data Privacy Act (CTDPA) compliance deadlines?
- Jul 1, 2023: CTDPA takes effect. Dec 31, 2024: Mandatory 60-day cure period expires. Jan 1, 2025: Universal opt-out preference signals required. Jul 1, 2026: PA 25-113 (SB 1295) amendments take effect. Aug 1, 2026: Profiling impact assessments apply. Oct 1, 2026: PA 26-64 (SB 4) amendments take effect. Jan 1, 2027: Data broker registration required. Oct 1, 2028: Data brokers must process state deletion mechanism requests.
- When does Connecticut Data Privacy Act (CTDPA) take effect?
- Connecticut Data Privacy Act (CTDPA) took effect on Jul 1, 2023. The next milestone is Oct 1, 2026: PA 26-64 (SB 4) amendments take effect.
- Who does Connecticut Data Privacy Act (CTDPA) apply to?
- From July 1, 2026: entities doing business in Connecticut or targeting residents that in the preceding calendar year (1) controlled or processed personal data of 35,000+ consumers (excluding payment-only data), (2) controlled or processed any consumers' sensitive data, or (3) offered consumers' personal data for sale. Before July 1, 2026: 100,000+ consumers, or 25,000+ consumers and more than 25% of gross revenue from selling personal data.
- What are the penalties under Connecticut Data Privacy Act (CTDPA)?
- Violations are unfair trade practices under CUTPA; civil penalties up to $5,000 per willful violation, plus restitution and injunctive relief. Mandatory 60-day cure period ended Dec 31, 2024; AG now has discretion to offer a cure.