← All compliance guides
Connecticut
Connecticut Data Privacy Act
Conn. Gen. Stat. §42-515 et seq. (CTDPA)Who it applies to
Businesses that control or process personal data of 100,000 or more Connecticut residents in a calendar year (excluding data processed solely to complete a payment transaction), or 25,000 or more residents if 25%+ of gross revenue comes from selling personal data.
What it requires
- Opt-out rights for targeted advertising, sale of data, and certain profiling
- Recognition of universal opt-out mechanisms, required since January 1, 2025
- Data protection assessments for higher-risk processing
- Opt-in consent, not opt-out, for processing minors' data for targeted ads, sale, or profiling
What's changed recently
As of January 1, 2025, Connecticut requires businesses to honor universal opt-out signals like Global Privacy Control automatically, rather than relying solely on a manual cookie banner choice made on each site.
Informational summary, not legal advice. Reviewed for accuracy as of August 2026; laws and enforcement priorities change, so verify current requirements against the official regulator text before relying on this page.