Connecticut Data Privacy Act: Rights, Requests & Enforcement

The Connecticut Data Privacy Act is a state law that took effect on July 1, 2023 and gives Connecticut residents the right to see, correct, delete, and move the personal data that businesses hold about them, and to opt out of having that data sold or used for targeted advertising.¹ Connecticut was the fifth state to pass a comprehensive consumer privacy law, and the framework has since grown to include stronger rules for minors and a requirement that companies honor automated opt-out signals from your browser.

Your Rights Under the Law

If you live in Connecticut and are acting in a personal capacity, you have six rights over your personal data under § 42-518. These rights do not apply when you are acting in a commercial or employment role, so a job applicant interacting with an employer’s hiring system cannot use the law to pull their application file.²

Confirm whether a business is processing your personal data, and get access to it. The one carve-out is information that would reveal a trade secret.
Correct inaccuracies in your data.
Have your data deleted.
Receive a portable, usable digital copy you can hand to another company.
Opt out of the sale of your data and of its use for targeted advertising.
Opt out of profiling that feeds solely automated decisions producing legal or similarly significant effects on you.

A “sale” is defined broadly. It covers any exchange of your personal data to a third party for money or other valuable consideration, including trading data for free services or discounts.³

How to Submit a Request and What to Expect

You exercise your rights by contacting the business directly through the channels listed in its privacy notice. Every covered business must also post an easily accessible link on its website for opting out of targeted advertising and data sales.¹

The business has 45 days from receiving your request to respond. It may add another 45 days if the request is complex or you have made several, but only if it tells you about the extension and the reason within the original window.³

If the business denies your request, you can appeal. It then has 60 days to respond in writing with its reasons. If the appeal is also denied, the business must give you a way to contact the Attorney General’s office to file a complaint.² Filing that appeal is worth the trouble even when you expect another denial, because it creates a documented record the Attorney General can look at later.

Sensitive Data and Protections for Minors

Certain categories of data are treated as “sensitive” and flip the default: a business cannot process them without your affirmative, opt-in consent. Sensitive data includes:¹

Information revealing racial or ethnic origin, religious beliefs, citizenship, or immigration status.
Mental or physical health conditions or diagnoses, including reproductive health and gender-affirming health data.
Sexual orientation or activity.
Biometric and genetic data used to uniquely identify a person.
Precise geolocation.
Personal data of a child under 13, which also triggers federal rules under COPPA.

Minors get another layer of protection. For consumers under 16, a business must get opt-in consent before selling their data or using it for targeted advertising, and a parent or legal guardian can exercise data rights for a child under 13.¹

For anyone under 18 using an online service, product, or feature, businesses face a wider set of restrictions. They cannot use design features that extend a minor’s time on the platform without consent. They cannot collect precise geolocation unless necessary, and must display a signal for the whole time it is being collected. They cannot offer direct messaging to minors without safeguards that limit unsolicited contact from unconnected adults. They must also document a data protection assessment and use reasonable care to avoid heightened risks of harm.¹

Automated Opt-Out Signals

Since January 1, 2025, every business covered by the law must honor automated opt-out preference signals you send through a privacy-protective browser or extension such as Global Privacy Control. One setting in your browser can therefore cover every covered site you visit, without a per-site click-through.¹

The signal has to reflect your actual choice; a default on by itself does not count. If your signal conflicts with an earlier setting you selected or with a loyalty program you joined, the business still has to comply with the signal, though it can tell you about the conflict and ask you to re-confirm the earlier choice.¹

Which Businesses Have to Comply

Under § 42-516, the law reaches any person or organization doing business in Connecticut or targeting products and services to Connecticut residents, provided it meets one of two data-volume thresholds in the previous calendar year:²

Controlled or processed the personal data of at least 100,000 consumers, not counting data processed solely to complete a payment transaction, or
Controlled or processed the personal data of at least 25,000 consumers and earned more than 25% of gross revenue from selling personal data.

Company size and revenue are not the trigger; data volume is. A small company that handles a large amount of consumer data can be covered, and a large company that barely touches personal data may not be.

Several categories of organizations are entirely outside the law: state and local government bodies, nonprofits (except when acting as a consumer health data controller), institutions of higher education, national securities associations registered under the Securities Exchange Act of 1934, and financial institutions covered by the Gramm-Leach-Bliley Act. Specific types of data already regulated under federal law are also carved out, including protected health information under HIPAA, data under the Fair Credit Reporting Act, and data under the Family Educational Rights and Privacy Act.³ If the business you want to complain about falls into one of these buckets, the Act will not help you.

Enforcement and Penalties

The Connecticut Attorney General has exclusive authority to enforce the law. There is no private right of action, so you cannot sue a business directly for a violation. Complaints go through the Attorney General’s office, which decides whether to investigate and bring an action.¹

From July 1, 2023 through December 31, 2024, the Attorney General had to notify a business of a violation and give it 60 days to fix the problem before suing, if a cure was possible. That mandatory cure period expired on December 31, 2024.⁴

Since January 1, 2025, the Attorney General has discretion over whether to offer a cure opportunity at all. Under § 42-525(c), the decision takes into account the number of violations, the size and complexity of the business, the nature of its processing activities, the likelihood of public injury, whether the violation stemmed from human or technical error, and the sensitivity of the data involved.⁴

Any violation is classified as an unfair trade practice under Connecticut’s Unfair Trade Practices Act, which carries civil penalties of up to $5,000 per violation.¹ Because each affected consumer and each instance of non-compliant processing can count separately, exposure adds up quickly for a business engaged in widespread data misuse.

1
Office of the Attorney General. The Connecticut Data Privacy Act
2
Connecticut General Assembly. Connecticut General Statutes Chapter 743jj – Consumer Data Privacy and Online Monitoring
3
Connecticut General Assembly. Connecticut Public Act 22-15 – An Act Concerning Personal Data Privacy and Online Monitoring
4
Justia Law. Connecticut Code Title 42 – Section 42-525 – Enforcement by Attorney General