Connecticut Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What Connecticut’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed August 2026.

What You Need to Know

Originally passed in 2022, the Connecticut Data Privacy Act has been amended three times since and is one of the strongest in the country. The 2023 amendment added children's privacy and consumer health data privacy provisions. The 2025 amendment modified the law's applicability standard, exemptions, definitions, consumer rights, data minimization provisions, and minors' privacy sections, and significantly changed the law's approach to profiling in ways that will affect the use of artificial intelligence in some contexts. The 2026 amendment narrowed the publicly available information exception, expanded the right to delete to cover certain publicly available information and inferences drawn from it, prohibited the sale of precise geolocation data, and imposed new requirements on controllers using facial recognition technology on their premises.

Official law text

Who the law applies to

Threshold	Requirement
Main Provisions (until June 30, 2026)
Annual gross revenue	N/A
Consumers whose data is processed	100,000 consumers 2.78% of state's 3.6 million population
Revenue from sale of personal data	Derives more than 25% of gross revenue from sale of personal data and controls or processes personal data of not less than 25,000 consumers.
Main Provisions (effective July 1, 2026)
Annual gross revenue	N/A
Consumers whose data is processed	35,000 consumers 0.97% of state's 3.6 million population
Revenue from sale of personal data	–
Other conditions	Control or process consumers' sensitive data, excluding personal data controlled or processed solely for purposes of completing payment transaction. Offer consumers' personal data for sale in trade or commerce.
Children's Privacy Provisions
Annual gross revenue	N/A
Consumers whose data is processed	–
Revenue from sale of personal data	–
Other conditions	Controllers that offer any online service, product, or feature to consumers whom such controller has actual knowledge, or willfully disregards, are minors.

Consumer rights under Connecticut's law15

Right	Provided?
Know	Yes
Access	Yes
Obtain list of third parties to which personal data was disclosed note Consumers can obtain a list of the third parties the controller sold the consumer's personal data to, or if such controller does not maintain a list of the third parties to which the controller sold the consumer's personal data, a list of all third parties to which such controller has sold personal data.	Partial
Data portability	Yes
Delete	Yes
Correct inaccuracies	Yes
Not be discriminated against for exercising rights	Yes
Opt-out of sale	Yes
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling note If the consumer’s personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, the consumer has the right to question the result of such profiling, be informed of the reason that such profiling resulted in such decision, review the consumer’s personal data that were processed for the purposes of such profiling, and if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, allow the consumer the right to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data.	Yes
Opt-out of ADMT	No
Recognize opt-out signals	Yes
Revoke consent	Yes
Not process data in discriminatory manner	No
Appeal	Yes

Tracking Connecticut’s privacy law? We write about it as the law changes.

Categories treated as sensitive data18

Racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis
Mental or physical health condition
Mental or physical health treatment
Mental or physical disability
Sexual orientation
Sex life
Status as transgender or nonbinary
Citizenship or immigration status
Genetic or biometric data or information derived therefrom
Personal data from individual controller has actual knowledge or willfully disregards is a child
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
Consumer health data
Status as victim of crime
Government-issued identification #, including, but not limited to, Social Security #, passport #, state identification card # or driver's license #, that applicable law does not require to be publicly displayed
Financial account number, financial account log-in information or credit card or debit card number that, in combination with any required access or security code, password or credential, would allow access to a consumer's financial account
Neural data

How sensitive data must be treated4

Obtain Consent to Process and Processing is Reasonably Necessary for Purposes for Which Sensitive Data are Processed
Must Obtain Consent to Sell Sensitive Data
Cannot Sell Precise Geolocation Data
Conduct Data Protection or Risk Assessment

Requirements for minors' data5

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Opt-in for targeted advertising or sale of personal data of children ages 13-17
Cannot sell personal data, engage in targeted advertising, or profile for consequential decisions for children under 18 unless certain conditions are met
Creates requirements for collection of precise geolocation of children under 18
Duty of care to avoid heightened risk of harm to children under 18 years of age

Activities that trigger a risk or impact assessment7

Targeted advertising (“sharing”)
Sale of personal data
Processing of sensitive data
Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
Each controller that offers any online service, product, or feature to consumers whom such controller has actual knowledge, or willfully disregards are minors (under 18 years of age) shall conduct a data protection assessment for such online, product, service, or feature
Each controller that offers any online service, product, or feature to consumers whom such controller has actual knowledge, or willfully disregards, are minors (under 18 years of age) shall, if such online service, product, or feature engages in any profiling based on such consumers’ personal data, conduct an impact assessment for such online service, product, or feature
Profiling for purposes of making a decision that produces any legal or similarly significant effect concerning a consumer
note
Decision that produces any legal or similarly significant effect means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment or any health care service.

Other notable provisions7

Definition of “Sale” Includes “Other Valuable Consideration”
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Duty to Avoid Secondary Use
Data Minimization
Attorney General Enforcement

Enforcement actions1

1 enforcement action logged against businesses under Connecticut’s consumer data privacy law.

$85,000 — Online Ticketing Marketplace — Jul 8, 2025 — Connecticut Attorney General

Full details →

Key dates2

Date	What happens
July 1, 2023	Connecticut's consumer data privacy law takes effect
October 1, 2026	Connecticut SB 4 (2026) amendments take effect

Questions about Connecticut’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Connecticut’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.