Connecticut
Connecticut Data Privacy Act (CTDPA)
- Effective date
- July 1, 2023
- Enacted
- May 10, 2022
- Enforcement
- Connecticut Attorney General
- Last reviewed
- October 3, 2026
Overview
At a Glance
Effective Date
July 1, 2023
Enforcement Authority
Connecticut Attorney General
Consumer Request Deadline
45 days; one additional 45-day extension when reasonably necessary.
Cure Period
Mandatory 60-day cure period expired; cure is discretionary for current enforcement.
Mandatory cure period ended December 31, 2024; the AG may still offer one.
Universal Opt-Out / GPC
Yes
Private Right of Action
No
Sensitive Data Consent
Yes
Opt-in consent required
Appeals Process
Yes
Applicability
Who Does This Law Apply To?
Current coverage was broadened effective July 1, 2026 and includes volume-based coverage plus sensitive-data and sale triggers.
General Coverage Thresholds
- Consumer volume
- Controls or processes personal data of 35,000+ Connecticut consumers (per 2025 amendments)
- Sensitive data
- Controls or processes consumers' sensitive data (any volume)
- Data sales
- Offers consumers' personal data for sale in trade or commerce
- Business nexus
- Conducts business in Connecticut or targets residents
Rights
Consumer Rights
Right to Opt Out of Sale
Opt out of sale of covered personal data as defined by the statute.
Right to Access
Confirm processing and access covered personal data, subject to statutory limits.
Right to Delete
Request deletion of covered personal data, subject to exceptions.
Right to Opt Out of Profiling
Opt out of qualifying profiling or solely automated decisions where provided.
Right to Correct
Request correction of inaccuracies in covered personal data.
Right to Data Portability
Obtain covered personal data in a portable format where the statute provides.
Right to Opt Out of Targeted Advertising
Opt out of covered targeted or cross-context behavioral advertising.
Obligations
Business Obligations
- AppealsRequiredInternal appeal process for denied rights requests.
- Data securityRequiredMaintain reasonable administrative, technical, and physical safeguards as required by the statute.
- Privacy noticeRequiredProvide required privacy disclosures/notices.
- Sensitive dataState-specificOpt-in consent is generally required before processing sensitive data, subject to statutory exceptions.
- Data minimizationRequired / state-specificLimit or govern collection/use consistent with the statute's duties and disclosed purposes.
- Universal opt outRequiredHonor qualifying opt-out preference signals/universal mechanisms.
- Processor contractsRequiredUse contracts governing processors/service providers as required.
- Consumer request processRequiredProvide methods for consumers to exercise statutory rights.
- Data protection assessmentRequiredConduct assessments for specified higher-risk processing.
Exemptions
Common Exemptions
Exemptions are state-specific and may apply at the entity level, data level, or both. Verify the official statute before relying on an exemption. Treatment commonly varies for government, regulated financial/health information, higher education, nonprofits, employment data, and B2B data. Connecticut generally exempts nonprofits, but consumer-health-data provisions can have different reach.
This list is not exhaustive.
Enforcement
Enforcement & Penalties
Authority: Connecticut Attorney General
Violations are enforceable under the Connecticut Unfair Trade Practices Act; civil penalties may apply.
Self-check
Could This Law Apply to My Business?
Your result
Answer the 4 questions to see a general, educational indication.
Sources
Sources & Verification
- View source
Connecticut Data Privacy Act (statute)
State legislature
- View source
Attorney General guidance
State Attorney General
- View source
iapp.org
Secondary reference
- View source
ncsl.org
Secondary reference
- View source
privacylawnetwork.com
Secondary reference
- View source
ketch.com
Secondary reference
Last reviewed: October 3, 2026· Verified against official sources
From understanding to action
Digital Data Rights helps you understand the privacy landscape.
DataRightsOS helps businesses put privacy processes into operation.
Educational information only, not legal advice. Summaries may omit details; verify against the statute, regulations and official guidance.