🇺🇸Connecticut Data Privacy Act

Skin

← Back to laws in United States

Connecticut Data Privacy Act

Connecticut Data Privacy Act

Connecticut Data Privacy Act is part of the United States state privacy-law framework. It regulates covered processing of personal data about Connecticut residents and must be assessed separately from federal sectoral laws and other states' statutes.

Current official version

Effective status: July 1, 2023

Citation: Conn. Gen. Stat. ss. 42-515 through 42-526

Source basis: Connecticut General Assembly 2026 Supplement, Chapter 743jj; Public Act 26-64 as amended by Public Act 26-100 for enacted October 1, 2026 changes.

Scope and applicability

The Act applies to persons conducting business in Connecticut or targeting Connecticut residents that satisfy the current processing thresholds in section 42-516. The operative text includes the 2026 Supplement and changes made by Public Act 25-113 that took effect July 1, 2026; the original 2022 enactment is no longer sufficient.

Thresholds must be calculated using the law's defined consumer population and lookback period. Exemptions should be recorded at entity, data and processing-activity level; an exemption covering one regulated dataset should not automatically be applied to unrelated marketing, website, workforce or customer-support data.

Consumer rights

Consumers may access, correct, delete and obtain portable copies of personal data, and opt out of targeted advertising, sale and qualifying profiling. Authorized agents and universal opt-out signals are recognized for specified opt-outs, and denied requests are subject to appeal.

The operational workflow should authenticate requests without collecting excessive new data, meet the applicable response period, document extensions and denials, propagate deletion and opt-out decisions where required, and preserve evidence of the response and any appeal.

Controller and processor duties

Controllers must limit collection, avoid incompatible processing without consent, secure data, obtain consent for sensitive data, publish a clear notice, maintain request methods, bind processors by contract and assess processing presenting heightened risk.

Processor agreements should identify instructions, purpose, duration, data types, confidentiality, subprocessor controls, deletion or return, audit information and assistance with rights, security, breach response and assessments to the extent required by the statute.

State-specific point

Current controls must include Connecticut protections for consumer health data, minors, online services and other higher-risk processing. Public Act 26-64, as amended by Public Act 26-100, adds data-broker, deletion-mechanism, profiling, facial-recognition and precise-geolocation rules, most of which take effect October 1, 2026 and therefore require a separately dated implementation plan.

Enforcement and evidence

The Connecticut Attorney General has exclusive enforcement authority. The statutory cure structure has changed over time and must be checked for the date and circumstances of the conduct.

Maintain an applicability memorandum, data map, notice versions, request and appeal logs, consent and opt-out records, processor contracts, assessment records, security evidence and a dated record of the official statutory version used. Recheck the official legislature and regulator sources before each scheduled legal review.

What this means for you

Use a shared multi-state privacy operating model, but configure it for this law's exact scope, exemptions, rights, deadlines, consent rules, opt-out signals, assessment triggers and enforcement provisions. Do not substitute a generic US privacy checklist for the state-specific controls.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis