Research › State Privacy Laws › Connecticut
CONNECTICUT · STATE RESEARCH PROFILE

Connecticut Data Privacy Act

CTDPA · Normalized Research Card v2.1

IN FORCELAST VERIFIED · AUG 26 2026

At a glance

ScopeExpanded threshold / activity model
Threshold35,000 consumers; processing sensitive data; or offering personal data for sale, subject to statutory qualifications
Sensitive dataConsent required
Universal opt-outYes — since January 1, 2025
EnforcementConnecticut Attorney General
Private actionNo general private action
PenaltyEnforced through Connecticut consumer-protection authority
EffectiveJuly 1, 2023

Who must comply?

Applicability model: Expanded threshold / activity model.

Core threshold: 35,000 consumers; processing sensitive data; or offering personal data for sale, subject to statutory qualifications

Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.

Consumer rights

Right / protectionStatus
Access, including specified inferences/profiling information✓ Included / qualified by statute
Correction✓ Included / qualified by statute
Deletion✓ Included / qualified by statute
Portability✓ Included / qualified by statute
Third-party sale disclosure✓ Included / qualified by statute
Opt-out sale✓ Included / qualified by statute
Opt-out targeted advertising✓ Included / qualified by statute
Profiling rights✓ Included / qualified by statute

Sensitive data & minors

Sensitive-data standard: Consent required

Expanded protections effective in 2026 prohibit targeted advertising and sale involving minors, restrict addictive design, precise geolocation and profiling, and impose other online-safety duties.

Business obligations

Notice, minimization, consent for sensitive data, reasonable safeguards, consumer-request handling and assessments for heightened-risk processing.

Enforcement

Authority: Connecticut Attorney General

Private right of action: No general private action

Penalty / remedy baseline: Enforced through Connecticut consumer-protection authority

What makes Connecticut different?

Connecticut has evolved rapidly. Its 2026 amendments broaden scope and create a strong bridge between privacy law, minors' online safety and AI/chatbot enforcement priorities.

Developments to watch

The Attorney General publishes recurring CTDPA enforcement reports. Expanded minors protections are in force; additional youth measures have later effective dates.

Editorial rule: future-effective, proposed and pending measures are kept separate from current law.

Primary sources & verification

Last verified: August 26, 2026

Research standard: primary official sources prioritized; official guidance used to explain operational requirements.

← ALL STATE PRIVACY LAWS

← Colorado   Delaware →

USDataLaws.com provides independent legal and regulatory research for informational purposes. It does not provide legal advice. Laws, regulations and enforcement positions may change after the stated verification date.

COMPARE ALL 19 STATES →   ALL STATE PROFILES →