Connecticut Data Privacy Act (CTDPA)

Why does it matter?

The CTDPA now reaches far more organizations than its 2023 text did: the 35,000-consumer threshold applies from July 1, 2026, and any controller that processes sensitive data is covered whatever its volume. The Attorney General has published enforcement reports for 2023, 2024 and 2025 that show what it prioritizes.

Key benefits include:

• A wider coverage test

From July 1, 2026 the CTDPA applies at 35,000 consumers, or to any controller that processes sensitive data or offers personal data for sale, and consumer health data controllers are covered at any size (§ 42-516; Attorney General FAQ).

• Rights that now include profiling

Consumers can access data including inferences, correct, delete, port, opt out of targeted advertising, sale and profiling, and, where feasible, question a profiling result and learn the reason for it (§ 42-518).

• Opt-out preference signals

Since January 1, 2025, controllers must honor opt-out preference signals, such as the Global Privacy Control, for targeted advertising and sale (§ 42-520).

• Protection for young people

From October 1, 2026, controllers may not process the personal data of consumers aged 13 to 17 for targeted advertising or sale, and §§ 42-528 to 42-529e add duties for online services offered to minors.

• Assessments the Attorney General can request

Data protection assessments for heightened-risk processing and impact assessments for profiling are confidential and available to the Attorney General on request (§ 42-522).

How does it work?

The CTDPA sits in Chapter 743jj, Part I of the Connecticut General Statutes: definitions (§ 42-515), applicability (§ 42-516), exemptions (§ 42-517), consumer rights and appeals (§ 42-518), authorized agents and opt-out (§ 42-519), controller duties (§ 42-520), processor duties and contracts (§ 42-521), data protection assessments (§ 42-522), de-identified data (§ 42-523), construction (§ 42-524), enforcement (§ 42-525) and consumer health data (§ 42-526). Sections 42-528 to 42-529e add rules for social media platforms and for online services offered to minors.

Controllers implement it by inventorying personal data and purposes, publishing a privacy notice and a clear opt-out link, answering rights requests within 45 days with a 60-day appeal, honoring opt-out preference signals, obtaining consent before processing sensitive data and documenting assessments. A processor acts only on the controller's instructions under a contract (§ 42-521).

In SmartSuite, teams can use Privacy Management for the processing inventory and the rights request log, keep assessments and consent records beside them, and follow processor contracts in Third Party Risk Management.

Key Elements

• Applicability and exemptions (§§ 42-516 and 42-517)

The thresholds are 35,000 consumers, processing sensitive data, or offering personal data for sale, excluding data processed only to complete a payment. Exemptions include state and local government, nonprofits (except for consumer health data), higher education institutions, HIPAA covered entities, insurers, certain banks and credit unions, and data subject to Title V of the Gramm-Leach-Bliley Act. The 2026 amendments replaced the exemption for all financial institutions with a narrower bank and credit union exemption.

• Consumer rights (§ 42-518)

Access, including inferences and whether data is used for profiling; correction; deletion; a portable copy; a list of third parties that received sold data; and opt-out of targeted advertising, sale and profiling. A controller has 45 days to respond, extendable by 45, and 60 days to answer an appeal. One request every 12 months must be free.

• Controller duties (§ 42-520)

Limit collection to what is reasonably necessary and proportionate, not process data for a new purpose without consent, keep reasonable security, obtain consent for sensitive data, avoid discrimination, and let consumers revoke consent as easily as they gave it, ceasing processing within 15 days.

• Sensitive data (§ 42-515)

Data revealing racial or ethnic origin, religious beliefs, health condition, diagnosis, disability or treatment, sex life, sexual orientation, status as nonbinary or transgender, citizenship or immigration status; consumer health data; genetic or biometric data; data of a known child; victim-of-crime status; precise geolocation; neural data; and certain financial account credentials.

• Assessments (§ 42-522)

Data protection assessments are required for targeted advertising, sale, certain profiling and sensitive data, for activities created after July 1, 2023. Impact assessments are required for profiling that produces legal or similarly significant effects, for activities created on or after August 1, 2026, and cover purpose, risks, data inputs and outputs, metrics, limitations, transparency and post-deployment monitoring.

• Minors (§§ 42-528 to 42-529e)

For online services offered to minors under 18, controllers must use reasonable care to avoid heightened risk of harm, may not process data for targeted advertising or sale, need consent for profiling, may not use design features that extend use, must limit precise geolocation and direct messaging, and must run assessments. These provisions took effect on October 1, 2024.

• Enforcement (§ 42-525)

Only the Attorney General enforces, and a violation is an unfair trade practice with civil penalties of up to $5,000 per violation. A 60-day cure period was mandatory until December 31, 2024; since January 1, 2025 the Attorney General decides whether to offer a cure, weighing the number of violations, the size of the controller and the sensitivity of the data.

What does it cover?

The CTDPA protects Connecticut residents acting in an individual or household context, and not individuals acting in an employment context. It applies to controllers and processors that meet § 42-516, and to consumer health data controllers at any size. Public Act 25-113, effective July 1, 2026, widened coverage and narrowed the financial institution exemption, and Public Act 26-64, effective October 1, 2026, adds the teen, geolocation, deletion and pricing rules.

What are its objectives?

The CTDPA aims to give Connecticut residents rights over their personal data and to bind controllers and processors to defined duties.

Give consumers rights to access, correct, delete, port and opt out, and to question consequential profiling.

Require controllers to honor opt-out preference signals for targeted advertising and sale.

Limit collection to what is reasonably necessary and proportionate, and require consent for sensitive data.

Require documented data protection assessments and profiling impact assessments for heightened-risk processing.

Protect minors under 18 online, including limits on targeted advertising, sale and design features.

Make the Attorney General the sole enforcer under § 42-525.

Framework in Context

Public Act 22-15 has been amended by Public Act 23-56 (minors and consumer health data), Public Act 25-113 (effective July 1, 2026) and Public Act 26-64 (effective October 1, 2026), so the version in force depends on the date. Connecticut's separate Safeguards Law (§ 42-471) and data breach notification statute (§ 36a-701b) are not part of the CTDPA, although the Attorney General's Privacy Section enforces them. The Colorado Privacy Act and the California Privacy Rights Act regulate similar rights with their own thresholds.

Common Framework Mappings

Organizations map the CTDPA to other U.S. state privacy laws and to international instruments to reuse consent records, assessments and request workflows.

Mapped frameworks include:

APEC PF

LGPD

CCPA/CPRA

CPA (CO)

GDPR

ISO 27701

NIST Privacy Framework v1.0

VCDPA