CT HB 5222 — CTDPA Amendments to Public Act 26-64

Summary

AI law The statute implements strict consumer disclosure rules aimed at suppressing "surveillance pricing"—the practice of using automated processes and machine learning models to dynamically inflate the price of consumer goods and services based on individual user profile data. Any commercial entity using automated architectures to increase prices for an individual must feature a clear and conspicuous on-screen warning stating, “THIS PRICE WAS INCREASED,” alongside a notice explaining the dynamic calculation. Data law The legislation enacts an aggressive regulatory governance structure over the secondary data monetization market by establishing an official registration, operational tracking, and fee framework for commercial "data brokers" operating in the state. Beginning January 1, 2027, covered entities meeting the statutory threshold must register annually with the Department of Consumer Protection, pay a $2,500 administrative fee, and implement permanent tracking architectures to record consumer data deletion pipelines. Privacy law The Act significantly expands the scope of the Connecticut Data Privacy Act (CTDPA) by instituting an absolute statutory prohibition on the commercial sale of any resident's "precise geolocation data" (defined as technical tracking metrics accurate within a 1,750-foot radius). Additionally, the law targets physical surveillance on commercial premises by restricting the deployment of facial recognition technology for security or fraud detection to closed-loop systems matching images exclusively against internal databases under the controller's direct control, while explicitly outlawing matches against public or third-party biometric networks.

AI-drafted · Attorney-reviewed