Connecticut
Connecticut privacy law: the coverage test just got wider
Connecticut amended its Act so that handling sensitive data, or offering personal data for sale, can trigger coverage on its own — no consumer count required. The mandatory cure period has already expired, so a fix now happens at the Attorney General's discretion, not as of right.
At a glance
- Applies if
- As amended effective July 1, 2026, you are a Connecticut business (or target Connecticut residents) and you: process personal data of not fewer than 35,000 consumers in the preceding calendar year, excluding payment-only processing; or control or process consumers' sensitive data, excluding payment-only processing; or offer consumers' personal data for sale in trade or commerce (§42-516(1)–(3)). There is no fixed dollar-revenue or share-of-revenue test.
- Opt-out signal
- Required for sale and targeted advertising (§42-520(c)(1)(A)(ii)); the Attorney General confirms the duty began January 1, 2025. A signal that meets the statutory conditions wins over conflicting loyalty or privacy settings (§42-520(c)(1)(B)).
- Response deadline
- 45 calendar days, extendable by 45 additional days (§42-518(c)(1)). An appeals process is required, with a decision not later than 60 days after the appeal (§42-518(d)).
- Right to cure
- The mandatory right to cure expired December 31, 2024 (§42-525(b)). Since January 1, 2025 the Attorney General may offer a cure at its discretion, weighing the statutory factors (§42-525(c)).
- Max penalty
- Enforced exclusively by the Attorney General (§42-525(a), (e)). Willful violations carry up to $5,000 each (§42-110o(b)); violating a qualifying restraining order or injunction carries up to $25,000 per violation (§42-110o(a)).
- Consumer rights
- access · correction · deletion · portability · opt out of sale · opt out of targeted advertising · opt out of profiling supporting significant decisions · consent for sensitive data · review and explanation of significant automated decisions · list of third parties to whom data was sold
Connecticut Data Privacy Act, Conn. Gen. Stat. §42-515 et seq. — in force July 1, 2023, with amended coverage tests applying from July 1, 2026.
Three separate doors into coverage
The 35,000-consumer door is the one most businesses expect. The other two are easier to trip: processing sensitive data at all, or offering personal data for sale in trade or commerce, each triggers the Act on its own (§42-516(2)–(3)). A lead-generation site that offers leads for sale can be covered without ever counting consumers.
The signal beats your loyalty program
If a visitor's browser sends a qualifying opt-out preference signal, a conflicting setting in your loyalty program or preference center does not override it (§42-520(c)(1)(B)). That is a build question: the signal has to reach the systems that actually decide whether a pixel fires.
What else Connecticut requires
- Collection limited to what is reasonably necessary and proportionate (§42-520(a)(1)(A)).
- Review and explanation rights for significant automated decisions, plus correction and reevaluation for housing data (§42-518(a)(6)).
- A list of third parties to whom a consumer's data was sold (§42-518(a)(7)).
- Consent before processing sensitive data (§42-520(a)(1)(D)).
Why the expired cure period changes the math
Connecticut no longer guarantees a chance to fix a violation before enforcement (§42-525(b)). Finding and documenting a broken opt-out yourself, on a monthly cycle, is the practical substitute — and the dated record is what supports a request for discretionary cure (§42-525(c)).
Primary sources
- Connecticut General Assembly — Chap. 743jj, Connecticut Data Privacy Act (Conn. Gen. Stat. §42-515 et seq.)
- Connecticut Attorney General — The Connecticut Data Privacy Act
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.