Connecticut lawmakers have broadened the state's data privacy law, pulling more businesses under its scope, banning the sale of precise geolocation data, and giving consumers new rights over how companies use their information.

 

What happened

Connecticut's amended Data Privacy Act (CTDPA) took effect on July 1, 2026, through Senate Bill 1295 (SB 1295). Lawmakers passed the bill in June 2025, and it builds on several amendments made to the CTDPA since the law first passed in 2022. Governor Ned Lamont also signed Senate Bill 4 (SB 4) into law on May 27, 2026. SB 4 creates a data broker registration program, amends the CTDPA to ban the sale of precise geolocation data, and adds new rules for direct-to-consumer genetic testing companies and businesses that use surveillance pricing. House Bill 5222 and House Bill 5563 later amended parts of SB 4 on June 2 and June 4, 2026. Data brokers must register with the state starting January 1, 2027, and SB 4's CTDPA amendments take effect October 1, 2026.

 

Going deeper

SB 1295 removes the CTDPA's old revenue and resident-count thresholds. The law previously only applied to companies that processed data for at least 25,000 Connecticut residents while earning 25% of revenue from data sales, or that processed data for at least 100,000 residents. Now the law applies to any entity that controls or processes personal data for at least 35,000 consumers, controls or processes sensitive data at all, or offers consumers' personal data for sale.

The amendment also limits who qualifies for the CTDPA's GLBA exemption. Only traditional financial institutions like banks and credit unions that meet specific regulatory requirements keep the entity-level exemption. The law's data-level GLBA exemption and its exemptions for HIPAA-covered entities, business associates, and protected health information stay unchanged.

SB 1295 widens the definition of "sensitive data" to cover financial account numbers or login credentials that could grant account access, along with government-issued ID numbers such as Social Security numbers, passport numbers, and driver's license numbers that aren't otherwise required to be public.

SB 4 prohibits companies from selling consumers' precise geolocation data, joining Maryland, Virginia, and Oregon with similar bans. Consumers can still direct a company to disclose their location data, since that type of disclosure doesn't count as a "sale" under the law.

 

What was said

Matt Schwartz, a senior policy analyst at Consumer Reports, praised the new law. His organization helped build California's Delete Act and recently put out a model bill for other states looking to ban the sale of precise geolocation data. Schwartz said the law makes it "harder to stalk people, steal their identity, or engage in hyper-targeted marketing for scams," and thanked the legislature and Governor Lamont for the improvements to the state's privacy framework.

 

By the numbers

  • Businesses now fall under the CTDPA if they process personal data for 35,000 or more consumers, down from the prior 100,000-resident threshold.
  • Data brokers must register with Connecticut's Department of Consumer Protection by January 1, 2027.
  • SB 4's CTDPA amendments take effect October 1, 2026.
  • The state must build a consumer deletion mechanism for data brokers by July 1, 2028.

 

In the know

A data broker registration program requires companies that buy and sell consumer data to register with a state agency, making their data practices more visible to regulators. Connecticut now joins California, Oregon, Texas, and Vermont in requiring this kind of registry. The new deletion mechanism will let a consumer submit one request that reaches every registered data broker, similar to California's Delete Request and Opt-out Platform.

 

Why it matters

Removing the revenue and resident-count limits, Connecticut brings in businesses that previously sat outside the CTDPA simply because they were smaller or didn't sell much data. The geolocation sales ban also closes a gap that data brokers have relied on, location data reveals patterns about where people work, worship, seek medical care, or spend time, and selling it has created concerns about surveillance and stalking risks. Pairing that ban with a public broker registry gives Connecticut regulators, and consumers, a way to see who is trading in this kind of data in the first place.

Healthcare organizations should pay close attention too, even though the CTDPA's exemptions for HIPAA-covered entities, business associates, and protected health information remain unchanged. SB 4's license plate reader restrictions specifically bar that data from being used in investigations involving reproductive or gender-affirming health care, addressing a privacy gap that surfaced as patients worried about being tracked while seeking care across state lines. And because sensitive data now triggers CTDPA coverage regardless of a company's size or revenue, healthcare-adjacent vendors that handle data falling outside HIPAA's scope, like wellness apps, health-related data brokers, or AI tools trained on health information, will need to take a look at their compliance obligations.

 

The bottom line

Connecticut has widened who has to comply with its privacy law and what companies can do with location and sensitive data. Businesses that assumed they were too small or didn't sell enough data to fall under the CTDPA should reassess that position before the October 2026 and January 2027 deadlines take effect.

 

FAQs

What is a comprehensive state privacy law?

It's a state statute that gives residents rights over their personal data, such as the ability to access, correct, or delete it, and sets rules for how businesses can collect and use that information.

 

What is a data broker?

A data broker is a company that collects personal information about consumers it has no direct relationship with and then sells or licenses that information to other businesses.

 

What counts as "precise geolocation data"?

It refers to information that can pinpoint a person's physical location to within a small radius, such as GPS coordinates from a phone or app.

 

What is automated profiling?

Automated profiling is the use of software to analyze a person's data and make predictions or decisions about them, like their creditworthiness or likelihood to respond to an ad, without a human directly involved.