State Guide
Connecticut Privacy & Data Security Laws
Every statute below can apply to a business handling Connecticut residents' data, depending on your revenue, the number of Connecticut consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
A major 2025 amendment took effect July 1, 2026 and dramatically lowered the bar: it now applies at 35,000+ Connecticut residents, OR if you sell personal data of even a single resident, OR process sensitive data (health, biometric, genetic, precise geolocation, children's/teens' data, immigration status, and more) of even a single resident — the old 25%-of-revenue test is effectively gone. The amendment also added neural data, transgender/nonbinary status, and government ID numbers as new sensitive-data categories, plus a new AI-training-use disclosure duty.
Data Security & Breach Notification · 1
Connecticut law separately requires a safeguards program for entities handling Social Security numbers, plus an insurance-sector data security law. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
Consumer Health Data · 1
Layers a specific "consumer health data" definition (including reproductive/sexual health and gender-affirming care data) onto CTDPA, restricting its sale/processing regardless of the base law's thresholds.
Student Data Privacy · 1
Requires contracts with school districts governing student data use, security, and deletion; restricts advertising uses.