Connecticut CTDPA
Connecticut Data Privacy Act (Public Act 22-15, as amended by Public Act 25-113 and Public Act 26-64)
The CTDPA is Connecticut's consumer privacy law, in force since 1 July 2023. Amendments under SB 1295 (Public Act 25-113) took effect on 1 July 2026 and made it one of the broadest state laws: it now applies to any controller that processes sensitive data, lowered the general threshold to 35,000 consumers, and added profiling and minors' protections. A further amendment, SB 4 (Public Act 26-64), added changes from 1 October 2026, including a ban on selling precise geolocation data.
Who it applies to
From 1 July 2026, persons doing business in Connecticut or targeting its residents that control or process the personal data of 35,000 or more consumers, control or process any sensitive data (other than solely for completing a payment), or offer personal data for sale. Before that date the threshold was 100,000 consumers, or 25,000 consumers plus more than 25 percent of revenue from data sales.
Identity requirements
- Obtain consent before processing sensitive data, which now includes biometric and genetic data, government-issued identification data, financial account credentials and neural data
- Do not sell minors' data or target them with advertising, even with consent, and avoid design features that significantly extend a minor's use of a service
- Honor rights to access, correct, delete and port data, and to opt out of sale, targeted advertising and profiling used for significant decisions
- Let consumers question the outcome of a profiling decision and review the personal data used
- Conduct data protection assessments and, for processing created on or after 1 August 2026, profiling impact assessments
- Recognize universal opt-out preference signals
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Sensitive-data consent, minors' protections and opt-out signals must be enforced in sign-up and preference flows. |
| Identity verification (KYC/proofing) | Collecting government ID data or biometrics for identity proofing is now sensitive-data processing that needs consent and brings the controller into scope regardless of volume. |
| Identity governance (IGA) | Access, correction, deletion and profiling-review rights need governed processes over consumer identity records. |
| Audit, logging & accountability | Data protection and profiling impact assessments must be documented and produced to the Attorney General on request. |
Penalties
Violations are unfair trade practices under the Connecticut Unfair Trade Practices Act (CUTPA), which the Attorney General's office describes as carrying civil penalties of up to 5,000 dollars per wilful violation, plus restitution, disgorgement and injunctive relief. The mandatory cure period ended on 31 December 2024.
Status and dates last verified against primary sources on 2026-10-31.
Connecticut CTDPA: frequently asked questions
- What changed in the CTDPA on 1 July 2026?
- SB 1295 (Public Act 25-113) lowered the applicability threshold to 35,000 consumers, brought in any controller processing sensitive data, expanded sensitive data to include government ID data, financial account data and neural data, and strengthened profiling and minors' rights.
- Does the CTDPA cover biometric identity verification?
- Yes. Biometric data is sensitive data that requires consent, and after the 2026 amendments processing any sensitive data brings a business into scope regardless of how many Connecticut consumers it serves.
- Who enforces the CTDPA?
- The Connecticut Attorney General enforces it exclusively under CUTPA; there is no private right of action.