Connecticut
Connecticut Data Privacy Act
Connecticut’s consumer privacy law. It gives Connecticut residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since July 1, 2023
- Citation
- Conn. Gen. Stat. § 42-515 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 35,000+ Connecticut residents a year, or sell personal data, or handle any sensitive data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Honor Global Privacy Control as an opt-out (from Jan 1, 2025).
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- Don’t use data of consumers you know are under 18 for targeted ads, or sell it (from Jul 1, 2026).
- Say in your privacy notice whether you use personal data to train large language models, and when it was last updated (from Jul 1, 2026).
Who has to comply (changed July 1, 2026)
Amendments signed in June 2025 (Public Act 25-113) widened the law from July 1, 2026. It now applies to businesses that handle the personal data of 35,000 or more Connecticut consumers, or process any consumer’s sensitive data, or offer consumers’ personal data for sale. Before that date the thresholds were 100,000 consumers, or 25,000 with more than 25% of revenue from selling data.
Visitors’ rights and your deadlines
- Rights to access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling.
- New from July 1, 2026: a right to a list of the third parties you sold the consumer’s data to, and rights to question the result of profiling used for decisions and be told why.
- Respond within 45 days, extendable by 45 more with notice.
- Appeals: answer within 60 days.
Global Privacy Control
Since January 1, 2025, businesses covered by the law must honor universal opt-out preference signals; the Attorney General names Global Privacy Control as an example. In September 2025 Connecticut, California and Colorado ran a joint sweep, sending letters to businesses that didn’t appear to honor GPC.
Sensitive data, minors and your privacy notice
Sensitive data needs consent, and from July 1, 2026 its processing must also be reasonably necessary, and selling it needs consent. For consumers under 18 that a business knows about, the amended law bars processing for targeted advertising or any sale of personal data.
The privacy notice must be reasonably accessible, clear and meaningful. From July 1, 2026 it must also disclose targeted advertising and sales, say whether personal data is used to train large language models, show the month and year it was last updated, and be linked conspicuously from your homepage with the word “privacy”.
Enforcement
The Attorney General has exclusive authority; there’s no private right of action. A violation is an unfair trade practice, with civil penalties of up to $5,000 per willful violation. The mandatory 60-day cure period ended on December 31, 2024; since then a cure is at the Attorney General’s discretion.
The Attorney General’s April 2025 report described dozens of violation notices, privacy notice sweeps and a cookie banner sweep. In July 2025 TicketNetwork paid $85,000 after its privacy notice was found largely unreadable and its rights tools misconfigured, and it hadn’t fixed them by the cure deadline.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Global Privacy Control
On by default. Honored as an opt-out, shown to the visitor, and logged with the consent record.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Did Connecticut lower its thresholds?
Yes. From July 1, 2026 the law covers businesses handling data of 35,000 or more consumers, or any sensitive data, or that offer personal data for sale.
Does Connecticut require honoring Global Privacy Control?
Yes, since January 1, 2025, for businesses the law covers.
What are the penalties?
Up to $5,000 per willful violation, enforced by the Attorney General as an unfair trade practice.
Sources
- Connecticut Attorney General: the Connecticut Data Privacy Act(opens in a new tab)
- Public Act 25-113 (SB 1295), chaptered(opens in a new tab)
- CGS § 42-525 (enforcement)(opens in a new tab)
- CGS § 42-110o (penalties)(opens in a new tab)
- Connecticut Attorney General: enforcement report (April 2025)(opens in a new tab)
- Connecticut Attorney General: TicketNetwork settlement(opens in a new tab)
- Connecticut Attorney General: joint GPC sweep(opens in a new tab)
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
