Connecticut Data Privacy Act (Conn. Gen. Stat. Sec. 42-515 et seq.)
Connecticut · Conn. Gen. Stat. Sec. 42-515 to 42-525; P.A. 22-15
Connecticut's consumer privacy law lets residents opt out of having their personal data used for profiling that feeds automated decisions carrying legal or similarly significant effects. Businesses that profile consumers for high-risk purposes must also run data protection assessments to weigh the risks. Other consumer rights include access, correction, deletion, and opting out of targeted advertising and data sales. The Attorney General enforces the law under Connecticut's unfair trade practices framework, and there is no individual right to sue.
Technical detail
Conn. Gen. Stat. Sec. 42-515 et seq. (CTDPA) grants consumers a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects and requires controllers to conduct data protection assessments for high-risk processing including such profiling; violations are enforced as CUTPA violations.
Who is protected: Connecticut residents acting in an individual or household context (consumers).
Who must comply: Controllers meeting CTDPA applicability thresholds that process Connecticut consumers' personal data.
Key facts
| Jurisdiction | Connecticut |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2023-07-01 |
| Enacted | 2022-05-10 |
| Citation | Conn. Gen. Stat. Sec. 42-515 to 42-525; P.A. 22-15 |
| Enforced by | Connecticut Attorney General (under the Connecticut Unfair Trade Practices Act) |
| Private right of action | No — agency enforcement only |
| Penalties | Enforced as a CUTPA violation, with civil penalties of up to $5,000 per willful violation, plus injunctive relief and restitution. |
| Topics | consumer data privacy · automated decision-making |
| Last verified | 2026-07-22 |
| Official source | Connecticut General Statutes Title 42, Chapter 743jj (Data Privacy and Security), Sec. 42-515 et seq. ↗ |
More AI rules in Connecticut
- Connecticut algorithmic rent ban — HB 8002 (eff. Jan 1, 2026) · In effect
- CT Rideshare Dynamic-Pricing Law (surge-price limits) · In effect
- CT SB 1103 (state-government AI oversight) · In effect
- CT SB 1295 (AI training-data disclosure) · In effect
- CT SB 5 (2026 AI Act) · Enacted (not yet in effect)
- 2025 State of Connecticut Artificial Intelligence Inventory · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.