Connecticut's Data Privacy Act (CTDPA) was signed into law on May 10, 2022, and became effective July 1, 2023. Connecticut is widely regarded as having one of the strongest comprehensive state privacy laws in the country. The CTDPA requires covered businesses to honor universal opt-out signals (like GPC) by October 1, 2024, making Connecticut one of only a handful of states with this requirement. Connecticut also has notably broad protections for minors — data of consumers under 18 is treated as sensitive data requiring opt-in consent, not just data of consumers under 13 or 16 as in many other states. The law also includes strong limits on the use of geolocation data and prohibits businesses from processing sensitive personal data for purposes beyond providing the requested service without consent.
Residents of Connecticut have the following legally enforceable privacy rights under CTDPA:
Confirm whether a business processes your personal data and obtain a copy in portable format.
Request correction of inaccurate personal data held about you by covered businesses.
Request deletion of personal data you've provided or that has been collected about you.
Receive your personal data in a machine-readable, portable format to transfer to other services.
Prevent businesses from selling your personal data to third parties for commercial purposes.
Stop businesses from using your data to show you personalized ads based on your online behavior.
Opt out of automated decision-making used in significant decisions about credit, employment, or housing.
Businesses cannot penalize you with higher prices or reduced service for exercising your rights.
The CTDPA applies to persons that conduct business in Connecticut or produce products or services targeted to Connecticut residents AND that during the preceding calendar year controlled or processed personal data of at least 100,000 consumers (excluding data controlled or processed solely for completing a payment transaction), or controlled or processed personal data of at least 25,000 consumers and derived more than 25% of gross revenue from the sale of personal data.
Under CTDPA, the following categories are classified as sensitive personal data and require explicit opt-in consent before processing:
Racial or ethnic origin · Religious or philosophical beliefs · Mental or physical health diagnoses · Sexual orientation or gender identity · Citizenship or immigration status · Genetic or biometric data uniquely identifying a person · Personal data of known minors · Precise geolocation data (within 1,750 feet)
Under CTDPA, businesses must respond to consumer rights requests within 45 days of receipt. This may be extended by an additional 45 days with prior written notice explaining the reason for the delay. Businesses must also establish an internal appeals process for denied requests, with a response due within 60 days.
The Connecticut Attorney General has exclusive enforcement authority. The AG may bring an action for civil penalties of up to $5,000 per willful violation. Businesses have a 60-day cure period through December 31, 2024, after which cure is at the AG's discretion. Connecticut's AG has signaled active enforcement intent, particularly around universal opt-out signal compliance.
To exercise your rights under CTDPA, contact the business through their official privacy portal (typically linked at the bottom of their website under "Privacy" or "Your Privacy Rights"). Clearly state:
1. That you are a Connecticut resident invoking rights under CTDPA
2. Your full name and contact information linked to your account
3. The specific right you are invoking (access, deletion, opt-out of sale, etc.)
4. The legal deadline for response (45 days)
If the company denies your request, you have the right to appeal. If the company does not respond or appeal fails, you may file a complaint with the Connecticut Attorney General's office.
| Term | Definition Under CTDPA |
|---|---|
| Personal Data | Any information linked or reasonably linkable to an identified or identifiable natural person. Does not include de-identified data or publicly available information. |
| Controller | A natural or legal person that, alone or jointly with others, determines the purposes and means of processing personal data. |
| Processor | A natural or legal person that processes personal data on behalf of a controller (e.g., a cloud hosting vendor). |
| Sale of Personal Data | The exchange of personal data for monetary or other valuable consideration by the controller to a third party. |
| Targeted Advertising | Displaying ads selected based on personal data obtained from a consumer's activities across non-affiliated websites or applications. |
| Profiling | Automated processing to evaluate, analyze, or predict aspects of a consumer's economic situation, health, personal preferences, behavior, location, or movements. |