Foundational law
CTDPA
Attorney-verified · August 29, 2026Connecticut · Privacy Law
Scope summary
Comprehensive Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515–42-526). **Round 1 — PA 25-113 / SB 1295** (signed June 24, 2025; official: cga.ct.gov 2025PA-00113): Applicability (eff. **July 1, 2026**): controllers qualify if ANY prong applies: (1) 35,000+ Connecticut consumers/year (lowered from 100,000); (2) offers personal data for sale (volume-free); (3) processes sensitive data (volume-free). Prior 25%-of-revenue prong deleted. Substantive obligations: LLM-training disclosure in privacy notices; expanded sensitive-data categories (neural data, disability/treatment-related); under-18 online-safety center, dark-pattern limits, profiling/ad-targeting limits; profiling/ADM consumer rights; separate consent for sensitive-data sale; data minimization (necessary AND proportionate); consent for material new purposes. Profiling impact assessments eff. **Aug. 1, 2026**. **Round 2 — PA 26-64 / SB 4** (signed May 27, 2026; official: cga.ct.gov 2026PA-00064): Amends CTDPA effective **October 1, 2026** unless noted: absolute ban on sale of precise geolocation data (1,750-foot radius); facial-recognition for security/fraud limited to closed-loop internal-database matching (no public/third-party biometric networks); enhanced profiling/consumer-rights provisions; ALPR contract sharing limits. Surveillance/algorithmic-pricing transparency when personalized pricing increases a consumer's price. Brokered-personal-data registration requirement effective **January 1, 2027**. Data-broker registration, annual DCP fee, and centralized deletion-mechanism operator duties are tracked on separate anchor e9dcc845 (Connecticut Data Broker Registration / SB 4, 2026). This CTDPA anchor covers the comprehensive privacy statute and CTDPA-amending provisions in PA 25-113, PA 26-64, and PA 26-100 (HB 5222). **Round 3 — HB 5222 / PA 26-100** (signed June 2, 2026; official: cga.ct.gov 2026PA-00100): Technical cleanup to PA 26-64 / CTDPA amendments effective **October 1, 2026**: refines data-broker registration mechanics, geolocation-sale prohibition, and surveillance-pricing disclosure (conspicuous on-screen **"THIS PRICE WAS INCREASED"** warning when algorithmic pricing raises an individual's price).


