Connecticut Data Broker Registration Law: Requirements and Deadlines

What Connecticut’s data broker law requires, maintained by Stauss PLLC. Last reviewed September 2026.

What You Need to Know

Connecticut's law was enacted in 2026 and will require data brokers to register and pay an annual fee starting in 2027. The law also creates a California-style one-stop shop deletion mechanism.

Official law text

SB 4

How Connecticut defines and regulates data brokers

Who counts as a data broker	Any business or, if such business is not an individual, any portion of such business that sells or licenses brokered personal data to another person
Which businesses it applies to	“Business” means (i) any person who regularly engages in commercial activities for purpose of generating income, (ii) any bank, Connecticut credit union, federal credit union, out-of-state bank, out-of-state trust company or out-of-state credit union, as such terms are defined in section 36a-2 of the general statutes, and (iii) any other person who controls, is controlled by or is under common control with any person described above. It does not include any body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of Connecticut
Information covered	“Brokered personal data” means one or more of the following personal data elements concerning a consumer, if categorized or organized for sale or license to a third party: (A) Name; (B) address; (C) date of birth; (D) place of birth; (E) mother’s maiden name; (F) unique biometric data (i) generated from measurement or technical analysis of a human body characteristic, including, but not limited to, a fingerprint, retina or iris image or other unique physical or digital representation of biometric data, and (ii) used by the owner or licensee of such unique biometric data to identify or authenticate the consumer; (G) name or address of a member of the consumer’s immediate family or household; (H) Social Security number or other government-issued identification number; or (I) other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty.
Other provisions	Third-party audit requirement starting July 1, 2031
Penalties	$200 per day, per violation

Compliance requirements5

Requirement	Applies?
Annual Registration Requirement	Yes
Registration Disclosure Obligations	Yes
Privacy Policy Disclosure Obligations	Yes
Creates Substantive Consumer Rights *But creates DROP mechanism through which consumers can exercise rights	No
Delete Request & Opt-out Platform (DROP) Data brokers must process requests starting Oct. 1, 2028	Yes

Tracking Connecticut data broker law? We write about it as the law changes.

Key dates5

Date	What happens
January 1, 2027	Initial deadline for Connecticut data brokers to register
July 1, 2028	Deadline for the Connecticut Commissioner of Consumer Protection to establish an accessible deletion mechanism program
October 1, 2028	Connecticut data brokers must access an accessible deletion mechanism at least once every 45 days and process deletion requests
July 1, 2029	Annual deadline for Connecticut data brokers to post deletion request metrics
July 1, 2030	Annual deadline for Connecticut data brokers to post deletion request metrics

Questions about Connecticut’s data broker law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Connecticut’s data broker law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.