CTDPA

Scope summary

Comprehensive Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515–42-526). **Round 1 — PA 25-113 / SB 1295** (signed June 24, 2025; official: cga.ct.gov 2025PA-00113): Applicability (eff. **July 1, 2026**): controllers qualify if ANY prong applies: (1) 35,000+ Connecticut consumers/year (lowered from 100,000); (2) offers personal data for sale (volume-free); (3) processes sensitive data (volume-free). Prior 25%-of-revenue prong deleted. Substantive obligations: LLM-training disclosure in privacy notices; expanded sensitive-data categories (neural data, disability/treatment-related); under-18 online-safety center, dark-pattern limits, profiling/ad-targeting limits; profiling/ADM consumer rights; separate consent for sensitive-data sale; data minimization (necessary AND proportionate); consent for material new purposes. Profiling impact assessments eff. **Aug. 1, 2026**. **Round 2 — PA 26-64 / SB 4** (signed May 27, 2026; official: cga.ct.gov 2026PA-00064): Amends CTDPA effective **October 1, 2026** unless noted: absolute ban on sale of precise geolocation data (1,750-foot radius); facial-recognition for security/fraud limited to closed-loop internal-database matching (no public/third-party biometric networks); enhanced profiling/consumer-rights provisions; ALPR contract sharing limits. Surveillance/algorithmic-pricing transparency when personalized pricing increases a consumer's price. Brokered-personal-data registration requirement effective **January 1, 2027**. Data-broker registration, annual DCP fee, and centralized deletion-mechanism operator duties are tracked on separate anchor e9dcc845 (Connecticut Data Broker Registration / SB 4, 2026). This CTDPA anchor covers the comprehensive privacy statute and CTDPA-amending provisions in PA 25-113, PA 26-64, and PA 26-100 (HB 5222). **Round 3 — HB 5222 / PA 26-100** (signed June 2, 2026; official: cga.ct.gov 2026PA-00100): Technical cleanup to PA 26-64 / CTDPA amendments effective **October 1, 2026**: refines data-broker registration mechanics, geolocation-sale prohibition, and surveillance-pricing disclosure (conspicuous on-screen **"THIS PRICE WAS INCREASED"** warning when algorithmic pricing raises an individual's price).

ROUND 1 — AMENDED by SB 1295 / PA 25-113 (signed June 24, 2025; substantive eff. July 1, 2026; profiling impact assessments eff. Aug. 1, 2026). Lowers threshold 100,000 → 35,000 consumers; deletes 25%-of-revenue prong; volume-free sale/sensitive-data triggers; LLM-training notice; neural data as sensitive; under-18 ADMT limits. ROUND 2 — AMENDED by PA 26-64 / SB 4 (signed May 27, 2026; CTDPA amendments eff. Oct. 1, 2026; broker registration eff. Jan. 1, 2027): brokered-personal-data registration; geolocation-sale ban; facial-recognition closed-loop rule; strengthened profiling rights; surveillance-pricing transparency; ALPR contract limits. ROUND 3 — AMENDED by HB 5222 / PA 26-100 (signed June 2, 2026; eff. Oct. 1, 2026): refines PA 26-64 broker/deletion/geolocation/surveillance-pricing mechanics including mandatory "THIS PRICE WAS INCREASED" consumer warning. Cross-ref: Data-broker registration, annual DCP fee, and centralized deletion-mechanism operator duties are tracked on separate anchor e9dcc845 (Connecticut Data Broker Registration / SB 4, 2026). This CTDPA anchor covers the comprehensive privacy statute and CTDPA-amending provisions in PA 25-113, PA 26-64, and PA 26-100 (HB 5222).

Compliance milestones

• Operative: 2026-07-01 — PA 25-113 / SB 1295 substantive CTDPA amendments in forcesince July 1, 2026
• Compliance deadline: 2026-08-01 — Profiling impact-assessment obligation in force (PA 25-113)since August 1, 2026
• Operative: 2026-10-01 — PA 26-64 / PA 26-100 CTDPA amendments in force (geolocation, FR, surveillance pricing)10d
• Compliance deadline: 2027-01-01 — Data broker registration requirement (PA 26-64)102d