The Connecticut Data Privacy Act covers businesses that process personal data of 35,000 or more Connecticut consumers, and after the 2025 amendments it also reaches businesses of any size that sell personal data or process sensitive data, with the expanded coverage applying from July 1, 2026.
What the Connecticut Data Privacy Act Requires
Controllers must provide a clear privacy notice, minimize data collection to what is reasonably necessary, get consent before processing sensitive data, honor access, correction, deletion, and portability requests within 45 days, and offer opt-outs from targeted advertising and data sales. Since January 1, 2025, sites must honor universal opt-out preference signals such as the Global Privacy Control.
Enforcement and Penalties
Violations are enforced by the Attorney General under the state’s unfair trade practices act, with civil penalties up to $5,000 per willful violation plus other remedies. The earlier guaranteed cure period has ended, so the Attorney General now has discretion whether to offer a chance to fix problems first.
Source: Connecticut Attorney General: Public Act 22-15, Conn. Gen. Stat. 42-515 et seq.
Report a violation: If you believe a business is violating this law, you can file a complaint with the Connecticut Attorney General Consumer Assistance Unit.
