Connecticut Data Privacy Act

A major 2025 amendment took effect July 1, 2026 and dramatically lowered the bar: it now applies at 35,000+ Connecticut residents, OR if you sell personal data of even a single resident, OR process sensitive data (health, biometric, genetic, precise geolocation, children's/teens' data, immigration status, and more) of even a single resident — the old 25%-of-revenue test is effectively gone. The amendment also added neural data, transgender/nonbinary status, and government ID numbers as new sensitive-data categories, plus a new AI-training-use disclosure duty. The same amendment eliminated CTDPA's broad entity-level GLBA exemption — it's now data-level only (GLBA-regulated data specifically, not GLBA-regulated financial institutions generally), so a GLBA-regulated company is no longer automatically exempt for its other personal data. Connecticut then amended the law a third time: SB 4 (Public Act 26-64, signed May 27, 2026, effective Oct 1, 2026) bans selling precise geolocation data, adds transparency and signage duties for on-premises facial recognition (which may only be run against the controller's own database), restricts "surveillance pricing," expands deletion rights, strengthens protections for genetic data and biological samples, and creates a separate data-broker registration regime starting Jan 1, 2027 — see the Data Broker entry for Connecticut.