Privacy
Connecticut Data Privacy Act (CTDPA)
As of October 9, 2026, the CTDPA applies to persons that conduct business in Connecticut or target products or services to Connecticut residents and that, during the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers, excluding data processed only to complete a payment transaction. It also applies, with no volume threshold, to persons that control or process consumers' sensitive data, other than data processed only to complete a payment transaction, and to persons that offer consumers' personal data for sale. Before July 1, 2026 the thresholds were 100,000 consumers, or 25,000 consumers plus more than 25 percent of gross revenue from selling personal data.
What the website needs
- From July 1, 2026, the privacy notice must list the categories of personal data processed, the purposes, how to submit rights requests and appeal decisions, the categories of personal data sold to third parties and the categories of those third parties, any targeted advertising or sale for targeted advertising, an active email address or online contact method, whether the controller collects, uses or sells personal data to train large language models, and the most recent month and year the notice was updated (Conn. Gen. Stat. § 42-520(b)(1), as amended by PA 25-113).
- The privacy notice must be available through a conspicuous hyperlink that includes the word 'privacy' on the website homepage, in each language in which the controller offers the covered products or services, and in a form that is accessible to people with disabilities (§ 42-520(b)(2), as amended by PA 25-113).
- The controller must provide a clear and conspicuous hyperlink on its website to a page where a consumer or agent can opt out of targeted advertising and the sale of personal data (§ 42-520, as amended by PA 25-113).
- A controller may not process sensitive data without consent, may not sell sensitive data without consent, and from October 1, 2026 may not sell a consumer's precise geolocation data (§ 42-520 as amended by PA 25-113; PA 26-64).
