Connecticut CTDPA: Data Privacy Act Requirements

Businesses conducting business in Connecticut or targeting its residents that, in the preceding calendar year, controlled or processed personal data of at least 100,000 consumers (excluding data processed solely for payment transactions), or 25,000+ consumers while deriving more than 25% of gross revenue from selling personal data. The 2025 amendments lower and broaden these thresholds and trim exemptions, so re-run your applicability analysis annually; Connecticut's is no longer static Virginia boilerplate.

SB 3 (2023) created 'consumer health data' protections inside the CTDPA: opt-in consent for processing, restrictions on selling, and a ban on geofencing within 1,750 feet of mental health, reproductive, or sexual health facilities to identify, track, or target consumers. This is the Washington My Health My Data concept executed as an amendment, without the private right of action, but with the AG's full attention on reproductive-health data flows.

Layered and expanding: the CTDPA requires consent for targeted advertising and sales involving consumers aged 13-15 (known), SB 3 added social-media account deletion rights for minors, and later amendments impose duties of care for online services likely to be accessed by minors, default protections, and restrictions on features that increase engagement of minor users. Connecticut is among the most active states here; check current text before launching minor-facing features.

Since January 1, 2025, controllers must recognize universal opt-out preference signals (GPC in practice) as valid requests to opt out of targeted advertising and sale. The mechanics mirror Colorado's: automatic processing, no consumer confirmation demanded, authenticated consent may override with logging. If you built the Colorado/California signal pipeline, Connecticut is configuration.

Exclusively through the Attorney General, as CUTPA violations, up to $5,000 per willful violation plus restitution, disgorgement, and injunctions. The mandatory 60-day cure window expired December 31, 2024; cure is now at the AG's discretion, weighing violation history and size. The AG's published enforcement report describes sweeps on privacy-policy deficiencies, sensitive-data consent, and teen-data practices, with cure letters converting into investigations where responses lag.