Connecticut's Major Data Privacy Act Amendments Take Effect July 1, 2026

Published July 3, 2026

Score

Why it matters

Connecticut's comprehensive data privacy overhaul took effect on July 1, 2026, substantially tightening compliance obligations across the state. Senate Bill 1295, signed by Governor Ned Lamont on June 24, 2025, amended the Connecticut Data Privacy Act with rules that lower the consumer threshold to 35,000 residents—or even a single resident's sensitive data—and expand regulated categories to include precise geolocation, genetic information, and algorithmic profiling. The Connecticut Department of Consumer Protection will enforce new data broker registration requirements and administer a state-run deletion mechanism. The law now restricts the sale of minors' data for targeted advertising and imposes new disclosure requirements for companies using consumer information to train large language models.

The compliance timeline creates immediate pressure. Data broker registration begins January 1, 2027. Profiling impact assessments for automated decision-making apply to processing activities created after August 1, 2026. The specific scope of certain provisions—particularly how courts will interpret "sensitive data" and what constitutes prohibited "surveillance pricing"—remains unsettled as enforcement begins.

Attorneys representing retailers, food delivery platforms, genetic testing companies, and data brokers should audit current data handling practices against the lowered thresholds and new categorical restrictions. The law's expansion beyond the original 2022 CTDPA makes prior compliance assessments obsolete. Connecticut now ranks among the nation's strictest privacy regimes, and the rolling implementation deadlines mean businesses cannot defer compliance decisions.