Connecticut Data Privacy Act (CTDPA)

The Connecticut Data Privacy Act (CTDPA) provides Connecticut residents with rights to access, correct, delete, and obtain a copy of their personal data. It also includes specific provisions for the protection of sensitive data.

JurisdictionConnecticut
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Connecticut Data Privacy Act (CTDPA) imposes several key requirements on businesses that process personal data of Connecticut residents:

  • Sensitive Data Protection: Explicit consent is required for processing sensitive data, including racial/ethnic origin, religious beliefs, health information, and biometric data.
  • Data Protection Assessments: Controllers must conduct and document data protection assessments for certain high-risk processing activities.

Compliance Challenges

Organizations face several challenges in complying with the CTDPA:

Implementation Best Practices

To effectively implement CTDPA requirements, organizations should:

Recent Updates

The Connecticut Attorney General recently released an enforcement report highlighting key focus areas:

  • Enforcement Grace Period: The 60-day cure period for violations ends on December 31, 2024.

Related Regulations

The CTDPA shares similarities with other state privacy laws:

Industry Impact

The CTDPA has significant implications across industries:

  • Financial Services: Institutions must enhance data governance and rights fulfillment processes, particularly for non-GLBA covered data.

Sources

Recent developments

  • — Connecticut Governor Ned Lamont signed SB 4 (Public Act 26-64) on 2026-05-27, significantly expanding the CTDPA with a Delete Act–style data broker registry and centralized deletion mechanism, new rules on geolocation, facial recognition, surveillance pricing, profiling, and DTC genetic testing companies.[8] (source)
  • — A new Connecticut law inspired by California’s Delete Act requires data brokers to register and join an online one-click deletion platform and prohibits sale of geolocation data, while CTDPA updates signed earlier in May expand the law’s scope by lowering applicability thresholds and adding AI-related transparency and profiling assessment obligations.[4] (source)
  • — Legal analysis highlights that major CTDPA amendments taking effect on 2026-07-01 will extend coverage to entities processing personal data of at least 35,000 consumers, those processing any sensitive data, or those offering personal data for sale, marking a substantial expansion of Connecticut’s consumer privacy regime.[1] (source)
  • — Commentary on SB 1295 (Public Act 25-113) explains that, effective 2026-07-01, CTDPA’s scope is broadened via a 35,000-consumer threshold, coverage for any processing of sensitive data or sale of personal data, and new obligations around minors’ data, with a separate 2026-08-01 start date for profiling impact assessments.[7] (source)
  • — A practitioner update describes Connecticut’s 2025 revisions via SB 1295, noting that from 2026-07-01 the CTDPA will cover more companies (including some previously exempt financial institutions), expand the definition of sensitive data (e.g., neural, financial, nonbinary/transgender status, disability, biometric-derived, and ID numbers), and require new profiling “impact assessments” for activities created on or after 2026-08-01.[6] (source)
  • — Hunton’s privacy blog reports that Connecticut’s SB 1295, enacted 2025-06-24, again amends the CTDPA by lowering applicability thresholds, expanding controller obligations, banning targeted advertising and sale of minors’ data regardless of consent, and introducing new impact assessment requirements that begin for profiling activities from 2026-08-01.[3] (source)
  • — The Future of Privacy Forum characterizes recent CTDPA amendments as an “overhaul,” emphasizing significantly expanded scope via lower thresholds and narrowed exemptions, new/modified consumer rights (including a right to contest certain profiling decisions), strengthened minimization and consent rules, new impact assessment duties, and enhanced protections for minors such as a targeted advertising ban effective 2026-07-01.[5] (source)
  • — The Connecticut Attorney General’s CTDPA page notes that, as of 2025-01-01, covered businesses must honor universal opt-out preference signals from Connecticut residents and outlines enforcement powers under the CTDPA, including civil penalties up to $5,000 per violation and the ability to seek injunctive relief, restitution, and disgorgement.[2] (source)
  • — Industry-focused reporting underscores that Connecticut’s updates are seen as moving the state toward a leading-edge privacy framework, with stakeholders highlighting new compliance pressure on data brokers, location data vendors, and AI-driven profiling practices as the CTDPA’s expanded scope and AI-related provisions come online.[4] (source)
  • — Employment-law commentary notes that CTDPA changes will particularly affect employers and HR-tech providers using profiling and automated decision-making, who will need to prepare for profiling impact assessments, expanded employee-related processing rules, and new contestability rights for individuals once the 2026 effective dates arrive.[7] (source)

Read the full guide to Connecticut Data Privacy Act (CTDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates