Overview
The Connecticut Data Privacy Act (CTDPA) is a comprehensive data privacy law that grants Connecticut residents new rights over their personal data while imposing data protection obligations on businesses. Signed into law in May 2022, the CTDPA took effect on July 1, 2023, making Connecticut the fifth U.S. state to enact a broad consumer privacy law after California, Virginia, Colorado, and Utah.
CTDPA is closely modeled after GDPR, CPRA, and CPA, providing strong consumer rights, clear business compliance rules, and enhanced privacy protections.
Who Must Comply?
The CTDPA applies to companies that conduct business in Connecticut or target Connecticut residents and meet one of the following criteria:
✔ Process personal data of at least 100,000 Connecticut consumers annually
✔ Process personal data of at least 25,000 consumers and derive 25%+ of revenue from selling personal data
Exemptions:
The law does not apply to:
🚫 Government agencies
🚫 Nonprofits
🚫 Financial institutions subject to GLBA
🚫 HIPAA-covered entities (healthcare providers)
🚫 Higher education institutions
Key Consumer Rights Under CTDPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request corrections to inaccurate personal data.
✔ Right to Delete – Consumers can request the deletion of personal data.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
- Automated profiling that affects legal or financial decisions
Business Compliance Requirements
✔ Universal Opt-Out Mechanism (Starting January 1, 2025) – Businesses must honor global privacy opt-out signals (e.g., Global Privacy Control (GPC)).
✔ Obtain Consent for Sensitive Data Processing – Companies must get explicit opt-in consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Health conditions
📌 Biometric data
📌 Children’s data
✔ Data Protection Assessments (DPA) – Businesses must evaluate high-risk data processing activities, including:
📌 Targeted advertising
📌 Data sales
📌 Automated decision-making
✔ Privacy Notices & Data Minimization – Businesses must publish clear privacy policies and limit data collection to what is necessary.
✔ Data Security Measures – Companies must apply reasonable security measures to protect personal data from breaches.
Real-World Enforcement Cases
The Connecticut Attorney General is responsible for enforcing CTDPA. Violations can result in civil penalties of up to $5,000 per violation.
While there have been no major enforcement cases yet, similar laws in California (CPRA) and Colorado (CPA) suggest data brokers, ad tech firms, and companies handling large amounts of consumer data will be early targets for enforcement.
📌 Comparison with Other State Privacy Laws
The Connecticut CTDPA shares similarities with Virginia (CDPA) and Colorado (CPA) but has some distinct features:
✅ Stronger Enforcement – The Connecticut AG can take direct action without a cure period (after 2024).
✅ Universal Opt-Out Required (2025) – Businesses must respect global privacy controls.
✅ Lower Revenue Threshold (25%) – More businesses fall under CTDPA than under Virginia CDPA (50%).
Future of CTDPA Regulation
📌 Expanded enforcement against ad networks, data brokers, and AI-driven profiling.
📌 Potential stricter AI & automated decision-making rules in future amendments.
📌 Closer alignment with federal privacy laws if the U.S. enacts nationwide privacy legislation.
Connecticut’s CTDPA is emerging as one of the most enforceable state privacy laws and is expected to shape future data privacy regulations across the U.S.
