CT SB 1295 / Public Act 25-113 — Connecticut Data Privacy Act Amendments; LLM Training Disclosure; Expanded Applicability; Minor Protections

Summary

AI law The text integrates rigorous new operational constraints targeting commercial facial recognition technology (FRT) and automated biometric ingestion systems. Under the amended statutory framework, commercial data controllers are flatly prohibited from deploying FRT to track, identify, or profile a consumer in public or commercial spaces without obtaining explicit, affirmative opt-in consent. A narrow statutory exception is carved out if the FRT deployment occurs strictly "in the course of a commercial transaction" to verify identity, check age, or prevent fraud, provided that the automated system does not retain the structural biometric identifiers beyond the immediate execution of that transaction. Privacy law This amendment dramatically reshapes corporate compliance by lowering the law’s applicability threshold to any business processing the personal data of at least 35,000 individuals (down from 100,000) or selling the data of at least one consumer. Furthermore, it eliminates the blanket Gramm-Leach-Bliley Act (GLBA) corporate entity exemption, replacing it with a narrow data-level exemption. The statute introduces an aggressive "privacy-by-design" framework for minors (under 18), forcing social media platforms to integrate dedicated "online safety centers," enact strict cyberbullying policies, and completely disable manipulative dark patterns, profiling, or targeted advertising designed to prolong minor screen time. Finally, the definition of "sensitive data" is broadened to explicitly protect neural data, financial details, non-binary/transgender status, precise government IDs, and medical disability treatments, while shifting the data collection standard from "adequate and relevant" to "reasonably necessary and proportionate."

AI-drafted · Attorney-reviewed