Connecticut. Comprehensive data protection. Act

CTDPAConnecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.)

In force

§1Summary

Synopsis

Provides Virginia-style consumer rights and recognises universal opt-out signals. The 2025 overhaul lowers thresholds, removes the entity-level GLBA exemption, expands sensitive data and adds profiling impact assessments and LLM-training disclosures.

Key themes

consumer rights (access, deletion, correction, portability)
opt-out of sale, targeted advertising and profiling
sensitive data consent
data protection assessments
processor contracts
profiling impact assessments
minors
LLM training disclosure
data minimisation

Unique features

From July 2026 applies to any controller processing sensitive data or selling personal data, regardless of volume; bans targeted ads to and sale of minors' data.

SaaS relevance

From 2026-07-01 applies at 35,000 Connecticut consumers, or any processing of sensitive data or sale; SaaS privacy notices must disclose LLM training.

§2Obligations

Extraterritorial: Yes
Breach notification: See Conn. Gen. Stat. § 36a-701b (separate statute)
DPO: No
Cross-border transfers: None
Maximum penalty: Up to $5,000 per wilful violation (CUTPA)

§3Dates

Key dates

Adopted 10 May 2022
In force 1 July 2023
SB 3 (2023) added consumer health and minors provisions; cure period expired 2024-12-31; SB 1295 (signed 2025-06-24) amendments effective 2026-07-01, impact assessments for processing from 2026-08-01.

§4Text and authority

Text

Authoritative text cga.ct.gov

Authority

Connecticut Attorney General

§5Where it applies

Domestic law of: Connecticut

§6Sources and verification

Verification: High confidence.