Connecticut consumer health data rules

Connecticut added consumer health data rules to its privacy law in 2023 (Public Act 23-56). Unlike the rest of the law, they apply to anyone who does business in Connecticut or targets its residents, with no revenue or volume threshold. The Attorney General says the nonprofit exemption doesn’t apply to them. HIPAA entities, Gramm-Leach-Bliley financial institutions, colleges and state agencies are exempt.

“Consumer health data” is personal data used to identify a consumer’s physical or mental health condition, diagnosis or (since July 1, 2026) status, including reproductive, sexual and gender-affirming care data.

• Consent before selling consumer health data. Since July 1, 2026, processing it also needs consent and must be reasonably necessary.
• Consent must be a clear affirmative act; accepting broad terms, hovering, closing content or dark patterns don’t count.
• Only employees and contractors bound by confidentiality may access it, and processors need a written contract.
• No geofencing within 1,750 feet of a mental health, reproductive or sexual health facility to identify, track or message consumers.

The Attorney General enforces the rules alone, as unfair trade practices, with civil penalties of up to $5,000 per violation; there’s no private right of action. Since January 1, 2025, giving a chance to cure is at the Attorney General’s discretion.

The Attorney General’s reports flag health data as a priority: a cure notice to a telehealth company over weak consent, concern about telehealth firms sending health data to Meta and Google, and a 2025 investigation of a fertility-tracking app.